fix(ui): timestamps in logs, proper call debounce, no cross-calling

- Copy/Share log now includes HH:MM:SS timestamps
- callInProgress stays true until call resolves (setup or hangup),
  preventing multiple taps from firing multiple place_call offers
- Block place_call when there's a pending incoming call
- leaveVoice clears all call state (callInProgress, pendingCallId)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cargo.toml

@@ -32,6 +32,7 @@ serde = { version = "1", features = ["derive"] }
 
 # Transport
 quinn = "0.11"
+socket2 = "0.5"
 
 # FEC
 raptorq = "2"

android/app/src/main/java/com/wzp/engine/WzpEngine.kt

@@ -96,6 +96,17 @@ class WzpEngine(private val callback: WzpCallback) {
         if (nativeHandle != 0L) nativeForceProfile(nativeHandle, profile)
     }
 
+    /**
+     * Signal a network transport change (e.g. WiFi → LTE handoff).
+     *
+     * @param networkType matches Rust `NetworkContext` ordinals:
+     *   0=WiFi, 1=LTE, 2=5G, 3=3G, 4=Unknown, 5=None
+     * @param bandwidthKbps reported downstream bandwidth in kbps
+     */
+    fun onNetworkChanged(networkType: Int, bandwidthKbps: Int) {
+        if (nativeHandle != 0L) nativeOnNetworkChanged(nativeHandle, networkType, bandwidthKbps)
+    }
+
     /** Destroy the native engine and free all resources. The instance must not be reused. */
     @Synchronized
     fun destroy() {
@@ -163,6 +174,7 @@ class WzpEngine(private val callback: WzpCallback) {
     private external fun nativeStartSignaling(handle: Long, relay: String, seed: String, token: String, alias: String): Int
     private external fun nativePlaceCall(handle: Long, targetFp: String): Int
     private external fun nativeAnswerCall(handle: Long, callId: String, mode: Int): Int
+    private external fun nativeOnNetworkChanged(handle: Long, networkType: Int, bandwidthKbps: Int)
 
     /**
      * Ping a relay server. Requires engine to be initialized.

android/app/src/main/java/com/wzp/net/NetworkMonitor.kt

@@ -0,0 +1,141 @@
+package com.wzp.net
+
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import android.os.Handler
+import android.os.Looper
+
+/**
+ * Monitors network connectivity changes via [ConnectivityManager.NetworkCallback]
+ * and classifies the active transport (WiFi, LTE, 5G, 3G).
+ *
+ * Callbacks fire on the main looper so callers can safely update UI state or
+ * dispatch to a native engine from any callback.
+ *
+ * Usage:
+ * 1. Set [onNetworkChanged] to receive `(type: Int, downlinkKbps: Int)` events
+ * 2. Optionally set [onIpChanged] for IP address change events (mid-call ICE refresh)
+ * 3. Call [register] when the call starts
+ * 4. Call [unregister] when the call ends
+ */
+class NetworkMonitor(context: Context) {
+
+    private val cm = context.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+    private val mainHandler = Handler(Looper.getMainLooper())
+
+    /**
+     * Called when the network transport type or bandwidth changes.
+     * `type` constants match the Rust `NetworkContext` enum ordinals.
+     */
+    var onNetworkChanged: ((type: Int, downlinkKbps: Int) -> Unit)? = null
+
+    /**
+     * Called when the device's IP address changes (link properties changed).
+     * Useful for triggering mid-call ICE candidate re-gathering.
+     */
+    var onIpChanged: (() -> Unit)? = null
+
+    // Track the last emitted type to avoid redundant callbacks
+    @Volatile
+    private var lastEmittedType: Int = TYPE_UNKNOWN
+
+    private val callback = object : ConnectivityManager.NetworkCallback() {
+        override fun onAvailable(network: Network) {
+            classifyAndEmit(network)
+        }
+
+        override fun onCapabilitiesChanged(network: Network, caps: NetworkCapabilities) {
+            classifyFromCaps(caps)
+        }
+
+        override fun onLinkPropertiesChanged(
+            network: Network,
+            linkProperties: android.net.LinkProperties
+        ) {
+            // IP address may have changed — notify for ICE refresh
+            onIpChanged?.invoke()
+            // Also re-classify in case the transport changed simultaneously
+            classifyAndEmit(network)
+        }
+
+        override fun onLost(network: Network) {
+            lastEmittedType = TYPE_NONE
+            onNetworkChanged?.invoke(TYPE_NONE, 0)
+        }
+    }
+
+    // -- Public API -----------------------------------------------------------
+
+    /** Register the network callback. Call when a call starts. */
+    fun register() {
+        val request = NetworkRequest.Builder()
+            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+            .build()
+        cm.registerNetworkCallback(request, callback, mainHandler)
+    }
+
+    /** Unregister the network callback. Call when the call ends. */
+    fun unregister() {
+        try {
+            cm.unregisterNetworkCallback(callback)
+        } catch (_: IllegalArgumentException) {
+            // Already unregistered — safe to ignore
+        }
+    }
+
+    // -- Classification -------------------------------------------------------
+
+    private fun classifyAndEmit(network: Network) {
+        val caps = cm.getNetworkCapabilities(network) ?: return
+        classifyFromCaps(caps)
+    }
+
+    private fun classifyFromCaps(caps: NetworkCapabilities) {
+        val type = when {
+            caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> TYPE_WIFI
+            caps.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> TYPE_WIFI // treat as WiFi
+            caps.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> classifyCellular(caps)
+            else -> TYPE_UNKNOWN
+        }
+        val bw = caps.getLinkDownstreamBandwidthKbps()
+
+        // Deduplicate: only emit when the transport type actually changes
+        if (type != lastEmittedType) {
+            lastEmittedType = type
+            onNetworkChanged?.invoke(type, bw)
+        }
+    }
+
+    /**
+     * Approximate cellular generation from reported downstream bandwidth.
+     * This avoids requiring READ_PHONE_STATE permission (needed for
+     * TelephonyManager.getNetworkType on API 30+).
+     *
+     * Thresholds are conservative — carriers over-report bandwidth, so we
+     * classify based on what's actually usable for VoIP:
+     * - >= 100 Mbps → 5G NR
+     * - >= 10 Mbps  → LTE
+     * - < 10 Mbps   → 3G or worse
+     */
+    private fun classifyCellular(caps: NetworkCapabilities): Int {
+        val bw = caps.getLinkDownstreamBandwidthKbps()
+        return when {
+            bw >= 100_000 -> TYPE_CELLULAR_5G
+            bw >= 10_000 -> TYPE_CELLULAR_LTE
+            else -> TYPE_CELLULAR_3G
+        }
+    }
+
+    companion object {
+        /** Constants matching Rust `NetworkContext` enum ordinals. */
+        const val TYPE_WIFI = 0
+        const val TYPE_CELLULAR_LTE = 1
+        const val TYPE_CELLULAR_5G = 2
+        const val TYPE_CELLULAR_3G = 3
+        const val TYPE_UNKNOWN = 4
+        const val TYPE_NONE = 5
+    }
+}

android/app/src/main/java/com/wzp/ui/call/CallViewModel.kt

@@ -5,6 +5,7 @@ import android.util.Log
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.wzp.audio.AudioPipeline
+import com.wzp.audio.AudioRoute
 import com.wzp.audio.AudioRouteManager
 import com.wzp.data.SettingsRepository
 import com.wzp.debug.DebugReporter
@@ -12,6 +13,7 @@ import com.wzp.engine.CallStats
 import com.wzp.service.CallService
 import com.wzp.engine.WzpCallback
 import com.wzp.engine.WzpEngine
+import com.wzp.net.NetworkMonitor
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.delay
@@ -43,6 +45,7 @@ class CallViewModel : ViewModel(), WzpCallback {
     private var engineInitialized = false
     private var audioPipeline: AudioPipeline? = null
     private var audioRouteManager: AudioRouteManager? = null
+    private var networkMonitor: NetworkMonitor? = null
     private var audioStarted = false
     private var appContext: Context? = null
     private var settings: SettingsRepository? = null
@@ -60,6 +63,9 @@ class CallViewModel : ViewModel(), WzpCallback {
     private val _isSpeaker = MutableStateFlow(false)
     val isSpeaker: StateFlow<Boolean> = _isSpeaker.asStateFlow()
 
+    private val _audioRoute = MutableStateFlow(AudioRoute.EARPIECE)
+    val audioRoute: StateFlow<AudioRoute> = _audioRoute.asStateFlow()
+
     private val _stats = MutableStateFlow(CallStats())
     val stats: StateFlow<CallStats> = _stats.asStateFlow()
 
@@ -226,7 +232,19 @@ class CallViewModel : ViewModel(), WzpCallback {
             audioPipeline = AudioPipeline(appCtx)
         }
         if (audioRouteManager == null) {
-            audioRouteManager = AudioRouteManager(appCtx)
+            audioRouteManager = AudioRouteManager(appCtx).also { arm ->
+                arm.onRouteChanged = { route ->
+                    _audioRoute.value = route
+                    _isSpeaker.value = (route == AudioRoute.SPEAKER)
+                }
+            }
+        }
+        if (networkMonitor == null) {
+            networkMonitor = NetworkMonitor(appCtx).also { nm ->
+                nm.onNetworkChanged = { type, bw ->
+                    engine?.onNetworkChanged(type, bw)
+                }
+            }
         }
         if (debugReporter == null) {
             debugReporter = DebugReporter(appCtx)
@@ -607,6 +625,27 @@ class CallViewModel : ViewModel(), WzpCallback {
         audioRouteManager?.setSpeaker(newSpeaker)
     }
 
+    /** Cycle audio output: Earpiece → Speaker → Bluetooth (if available) → Earpiece. */
+    fun cycleAudioRoute() {
+        val routes = audioRouteManager?.availableRoutes() ?: return
+        val currentIdx = routes.indexOf(_audioRoute.value)
+        val next = routes[(currentIdx + 1) % routes.size]
+        when (next) {
+            AudioRoute.EARPIECE -> {
+                audioRouteManager?.setBluetoothSco(false)
+                audioRouteManager?.setSpeaker(false)
+            }
+            AudioRoute.SPEAKER -> {
+                audioRouteManager?.setSpeaker(true)
+            }
+            AudioRoute.BLUETOOTH -> {
+                audioRouteManager?.setBluetoothSco(true)
+            }
+        }
+        _audioRoute.value = next
+        _isSpeaker.value = (next == AudioRoute.SPEAKER)
+    }
+
     fun clearError() { _errorMessage.value = null }
 
     fun sendDebugReport() {
@@ -661,6 +700,7 @@ class CallViewModel : ViewModel(), WzpCallback {
             it.start(e)
         }
         audioRouteManager?.register()
+        networkMonitor?.register()
         audioStarted = true
     }
 
@@ -668,8 +708,10 @@ class CallViewModel : ViewModel(), WzpCallback {
         if (!audioStarted) return
         audioPipeline?.stop()    // sets running=false; DON'T null — teardown needs awaitDrain()
         audioRouteManager?.unregister()
+        networkMonitor?.unregister()
         audioRouteManager?.setSpeaker(false)
         _isSpeaker.value = false
+        _audioRoute.value = AudioRoute.EARPIECE
         audioStarted = false
     }
 

android/app/src/main/java/com/wzp/ui/call/InCallScreen.kt

@@ -49,6 +49,7 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
+import com.wzp.audio.AudioRoute
 import com.wzp.engine.CallStats
 import com.wzp.ui.components.CopyableFingerprint
 import com.wzp.ui.components.Identicon
@@ -74,6 +75,7 @@ fun InCallScreen(
     val callState by viewModel.callState.collectAsState()
     val isMuted by viewModel.isMuted.collectAsState()
     val isSpeaker by viewModel.isSpeaker.collectAsState()
+    val audioRoute by viewModel.audioRoute.collectAsState()
     val stats by viewModel.stats.collectAsState()
     val qualityTier by viewModel.qualityTier.collectAsState()
     val errorMessage by viewModel.errorMessage.collectAsState()
@@ -621,12 +623,12 @@ fun InCallScreen(
 
                 Spacer(modifier = Modifier.height(16.dp))
 
-                // Controls: Mic / End / Spk
+                // Controls: Mic / End / Route (Ear/Spk/BT)
                 ControlRow(
                     isMuted = isMuted,
-                    isSpeaker = isSpeaker,
+                    audioRoute = audioRoute,
                     onToggleMute = viewModel::toggleMute,
-                    onToggleSpeaker = viewModel::toggleSpeaker,
+                    onCycleRoute = viewModel::cycleAudioRoute,
                     onHangUp = { viewModel.stopCall() }
                 )
 
@@ -915,9 +917,9 @@ private fun AudioLevelBar(audioLevel: Int) {
 @Composable
 private fun ControlRow(
     isMuted: Boolean,
-    isSpeaker: Boolean,
+    audioRoute: AudioRoute,
     onToggleMute: () -> Unit,
-    onToggleSpeaker: () -> Unit,
+    onCycleRoute: () -> Unit,
     onHangUp: () -> Unit
 ) {
     Row(
@@ -959,22 +961,28 @@ private fun ControlRow(
             Text("End", style = MaterialTheme.typography.titleMedium.copy(fontWeight = FontWeight.Bold))
         }
 
-        // Speaker
+        // Audio route: cycles Earpiece → Speaker → Bluetooth (when available)
         FilledTonalIconButton(
-            onClick = onToggleSpeaker,
+            onClick = onCycleRoute,
             modifier = Modifier.size(56.dp),
-            colors = if (isSpeaker) {
-                IconButtonDefaults.filledTonalIconButtonColors(
+            colors = when (audioRoute) {
+                AudioRoute.SPEAKER -> IconButtonDefaults.filledTonalIconButtonColors(
                     containerColor = Color(0xFF0F3460), contentColor = Color.White
                 )
-            } else {
-                IconButtonDefaults.filledTonalIconButtonColors(
+                AudioRoute.BLUETOOTH -> IconButtonDefaults.filledTonalIconButtonColors(
+                    containerColor = Color(0xFF2563EB), contentColor = Color.White
+                )
+                else -> IconButtonDefaults.filledTonalIconButtonColors(
                     containerColor = DarkSurface2, contentColor = Color.White
                 )
             }
         ) {
             Text(
-                text = if (isSpeaker) "Spk\nOn" else "Spk",
+                text = when (audioRoute) {
+                    AudioRoute.EARPIECE -> "Ear"
+                    AudioRoute.SPEAKER -> "Spk"
+                    AudioRoute.BLUETOOTH -> "BT"
+                },
                 textAlign = TextAlign.Center,
                 style = MaterialTheme.typography.labelSmall,
                 lineHeight = 12.sp

crates/wzp-android/src/engine.rs

@@ -99,6 +99,9 @@ pub(crate) struct EngineState {
     /// QUIC transport handle — stored so stop_call() can close it immediately,
     /// triggering relay-side leave + RoomUpdate broadcast.
     pub quic_transport: Mutex<Option<Arc<wzp_transport::QuinnTransport>>>,
+    /// Network type from Android ConnectivityManager, polled by recv task.
+    /// 0xFF = no change pending; 0-5 = NetworkContext ordinal.
+    pub pending_network_type: AtomicU8,
 }
 
 pub struct WzpEngine {
@@ -120,6 +123,7 @@ impl WzpEngine {
             playout_ring: AudioRing::new(),
             audio_level_rms: AtomicU32::new(0),
             quic_transport: Mutex::new(None),
+            pending_network_type: AtomicU8::new(PROFILE_NO_CHANGE),
         });
         Self {
             state,
@@ -342,7 +346,7 @@ impl WzpEngine {
                     Ok(Some(SignalMessage::DirectCallAnswer { call_id, accept_mode, .. })) => {
                         info!(call_id = %call_id, mode = ?accept_mode, "signal: call answered");
                     }
-                    Ok(Some(SignalMessage::CallSetup { call_id, room, relay_addr })) => {
+                    Ok(Some(SignalMessage::CallSetup { call_id, room, relay_addr, .. })) => {
                         info!(call_id = %call_id, room = %room, relay = %relay_addr, "signal: call setup");
                         // Connect to media room via the existing start_call mechanism
                         // Store the room info so Kotlin can call startCall with it
@@ -351,7 +355,7 @@ impl WzpEngine {
                         // Store call setup info for Kotlin to pick up
                         stats.incoming_call_id = Some(format!("{relay_addr}|{room}"));
                     }
-                    Ok(Some(SignalMessage::Hangup { reason })) => {
+                    Ok(Some(SignalMessage::Hangup { reason, .. })) => {
                         info!(reason = ?reason, "signal: call ended by remote");
                         let mut stats = signal_state.stats.lock().unwrap();
                         stats.state = crate::stats::CallState::Closed;
@@ -404,6 +408,13 @@ impl WzpEngine {
 
     pub fn force_profile(&self, _profile: QualityProfile) {}
 
+    /// Signal a network transport change from Android ConnectivityManager.
+    /// Stores the type atomically; the recv task polls it on each packet.
+    pub fn on_network_changed(&self, network_type: u8, bandwidth_kbps: u32) {
+        info!(network_type, bandwidth_kbps, "on_network_changed");
+        self.state.pending_network_type.store(network_type, Ordering::Release);
+    }
+
     pub fn get_stats(&self) -> CallStats {
         let mut stats = self.state.stats.lock().unwrap().clone();
         if let Some(start) = self.call_start {
@@ -871,6 +882,23 @@ async fn run_call(
                         );
                     }
 
+                    // Check for network transport change from ConnectivityManager
+                    {
+                        let net = state.pending_network_type.swap(PROFILE_NO_CHANGE, Ordering::Acquire);
+                        if net != PROFILE_NO_CHANGE {
+                            use wzp_proto::NetworkContext;
+                            let ctx = match net {
+                                0 => NetworkContext::WiFi,
+                                1 => NetworkContext::CellularLte,
+                                2 => NetworkContext::Cellular5g,
+                                3 => NetworkContext::Cellular3g,
+                                _ => NetworkContext::Unknown,
+                            };
+                            quality_ctrl.signal_network_change(ctx);
+                            info!(?ctx, "quality controller: network context updated");
+                        }
+                    }
+
                     // Adaptive quality: ingest quality reports from relay
                     if auto_profile {
                         if let Some(ref qr) = pkt.quality_report {
@@ -1181,6 +1209,15 @@ async fn run_call(
                     stats.room_participant_count = count;
                     stats.room_participants = members;
                 }
+                Ok(Some(SignalMessage::QualityDirective { recommended_profile, reason })) => {
+                    let idx = profile_to_index(&recommended_profile);
+                    info!(
+                        codec = ?recommended_profile.codec,
+                        reason = reason.as_deref().unwrap_or(""),
+                        "relay quality directive: switching profile"
+                    );
+                    pending_profile_recv.store(idx, Ordering::Release);
+                }
                 Ok(Some(msg)) => {
                     info!("signal received: {:?}", std::mem::discriminant(&msg));
                 }

crates/wzp-android/src/jni_bridge.rs

@@ -222,6 +222,29 @@ pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeForceProfile(
     }));
 }
 
+/// Signal a network transport change from the Android ConnectivityManager.
+///
+/// `network_type` matches the Rust `NetworkContext` enum:
+///   0=WiFi, 1=CellularLte, 2=Cellular5g, 3=Cellular3g, 4=Unknown, 5=None
+///
+/// The engine forwards this to the `AdaptiveQualityController` which:
+/// - Preemptively downgrades one tier on WiFi→cellular
+/// - Activates a 10-second FEC boost
+/// - Uses faster downgrade thresholds on cellular
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeOnNetworkChanged(
+    _env: JNIEnv,
+    _class: JClass,
+    handle: jlong,
+    network_type: jint,
+    bandwidth_kbps: jint,
+) {
+    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
+        let h = unsafe { handle_ref(handle) };
+        h.engine.on_network_changed(network_type as u8, bandwidth_kbps as u32);
+    }));
+}
+
 /// Write captured PCM samples from Kotlin AudioRecord into the engine's capture ring.
 /// pcm is a Java short[] array.
 #[unsafe(no_mangle)]

crates/wzp-client/Cargo.toml

@@ -21,9 +21,20 @@ anyhow = "1"
 serde = { workspace = true }
 serde_json = "1"
 chrono = "0.4"
+clap = { version = "4", features = ["derive"] }
+ratatui = "0.29"
+crossterm = "0.28"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 cpal = { version = "0.15", optional = true }
 libc = "0.2"
+# Phase 5.5 — LAN host-candidate ICE: enumerate local network
+# interface addresses for inclusion in DirectCallOffer/Answer so
+# peers on the same LAN can direct-connect without NAT hairpinning
+# through the WAN reflex addr (which many consumer NATs, including
+# MikroTik's default masquerade, don't support).
+if-addrs = "0.13"
+rand = { workspace = true }
+socket2 = "0.5"
 
 # coreaudio-rs is Apple-framework-only; gate it to macOS so enabling
 # the `vpio` feature from a non-macOS target builds cleanly instead of
@@ -93,6 +104,10 @@ linux-aec = ["dep:webrtc-audio-processing"]
 name = "wzp-client"
 path = "src/cli.rs"
 
+[[bin]]
+name = "wzp-analyzer"
+path = "src/analyzer.rs"
+
 [[bin]]
 name = "wzp-bench"
 path = "src/bench_cli.rs"

crates/wzp-client/src/analyzer.rs

@@ -0,0 +1,952 @@
+//! WarzonePhone Protocol Analyzer — passive call quality observer.
+//!
+//! Joins a relay room as a passive participant (no media sent) and displays
+//! real-time per-participant quality metrics in a terminal UI.
+//!
+//! Usage:
+//!   wzp-analyzer 127.0.0.1:4433 --room test
+//!   wzp-analyzer 1.2.3.4:4433 --room test --capture session.wzp
+//!   wzp-analyzer 1.2.3.4:4433 --room test --no-tui --duration 60
+
+use std::io::Write;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use clap::Parser;
+use tracing::info;
+
+use wzp_proto::{CodecId, MediaPacket, MediaTransport};
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+/// WarzonePhone Protocol Analyzer — passive call quality observer
+#[derive(Parser)]
+#[command(name = "wzp-analyzer", version)]
+struct Args {
+    /// Relay address (host:port) — required for live mode, ignored with --replay
+    relay: Option<String>,
+
+    /// Room name to observe — required for live mode, ignored with --replay
+    #[arg(short, long)]
+    room: Option<String>,
+
+    /// Auth token for relay
+    #[arg(long)]
+    token: Option<String>,
+
+    /// Identity seed (64-char hex)
+    #[arg(long)]
+    seed: Option<String>,
+
+    /// Capture packets to file
+    #[arg(long)]
+    capture: Option<String>,
+
+    /// Auto-stop after N seconds
+    #[arg(long)]
+    duration: Option<u64>,
+
+    /// Disable TUI (print stats to stdout instead)
+    #[arg(long)]
+    no_tui: bool,
+
+    /// Replay a captured .wzp file (offline analysis)
+    #[arg(long)]
+    replay: Option<String>,
+
+    /// Generate HTML report (from live session or replay)
+    #[arg(long)]
+    html: Option<String>,
+
+    /// Session key hex for decrypting payloads (enables audio decode)
+    // TODO(#17): Audio decode requires session key + nonce context.
+    // In SFU mode, payloads are E2E encrypted. Decoding requires
+    // either: (a) session key from both endpoints, or (b) running
+    // the analyzer as a trusted participant with its own key exchange.
+    // For now, header-only analysis provides loss%, jitter, codec stats.
+    #[arg(long)]
+    key: Option<String>,
+}
+
+// ---------------------------------------------------------------------------
+// Per-participant statistics
+// ---------------------------------------------------------------------------
+
+struct ParticipantStats {
+    /// Stream identifier (index, assigned when we detect a new seq stream)
+    stream_id: usize,
+    /// Display name from RoomUpdate (if available)
+    alias: Option<String>,
+    /// Current codec
+    codec: CodecId,
+    /// Total packets received
+    packets: u64,
+    /// Detected lost packets (sequence gaps)
+    lost: u64,
+    /// Last seen sequence number
+    last_seq: u16,
+    /// Whether we've seen the first packet (for gap detection)
+    seq_initialized: bool,
+    /// EWMA jitter in ms
+    jitter_ms: f64,
+    /// Last packet arrival time
+    last_arrival: Option<Instant>,
+    /// Codec changes observed
+    codec_switches: u32,
+    /// First packet time
+    first_seen: Instant,
+    /// Last packet time
+    last_seen: Instant,
+}
+
+impl ParticipantStats {
+    fn new(id: usize, codec: CodecId) -> Self {
+        let now = Instant::now();
+        Self {
+            stream_id: id,
+            alias: None,
+            codec,
+            packets: 0,
+            lost: 0,
+            last_seq: 0,
+            seq_initialized: false,
+            jitter_ms: 0.0,
+            last_arrival: None,
+            codec_switches: 0,
+            first_seen: now,
+            last_seen: now,
+        }
+    }
+
+    fn ingest(&mut self, pkt: &MediaPacket, now: Instant) {
+        self.packets += 1;
+        self.last_seen = now;
+
+        // Codec switch detection
+        if pkt.header.codec_id != self.codec {
+            self.codec_switches += 1;
+            self.codec = pkt.header.codec_id;
+        }
+
+        // Loss detection from sequence gaps
+        if self.seq_initialized {
+            let expected = self.last_seq.wrapping_add(1);
+            let gap = pkt.header.seq.wrapping_sub(expected);
+            if gap > 0 && gap < 100 {
+                self.lost += gap as u64;
+            }
+        }
+        self.last_seq = pkt.header.seq;
+        self.seq_initialized = true;
+
+        // Jitter (inter-arrival time variance, EWMA)
+        if let Some(last) = self.last_arrival {
+            let interval_ms = now.duration_since(last).as_secs_f64() * 1000.0;
+            let expected_ms = pkt.header.codec_id.frame_duration_ms() as f64;
+            let diff = (interval_ms - expected_ms).abs();
+            self.jitter_ms = 0.1 * diff + 0.9 * self.jitter_ms;
+        }
+        self.last_arrival = Some(now);
+    }
+
+    fn loss_percent(&self) -> f64 {
+        let total = self.packets + self.lost;
+        if total == 0 {
+            0.0
+        } else {
+            (self.lost as f64 / total as f64) * 100.0
+        }
+    }
+
+    fn duration(&self) -> Duration {
+        self.last_seen.duration_since(self.first_seen)
+    }
+
+    fn display_name(&self) -> String {
+        self.alias
+            .as_deref()
+            .map(String::from)
+            .unwrap_or_else(|| format!("Stream {}", self.stream_id))
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Participant identification by sequence stream
+// ---------------------------------------------------------------------------
+
+/// Find the participant whose sequence counter is close to `seq`, or create a
+/// new one.  Each sender has an independent wrapping u16 counter, so we can
+/// distinguish streams by proximity of consecutive sequence numbers.
+fn find_or_create_participant(
+    participants: &mut Vec<ParticipantStats>,
+    seq: u16,
+    codec: CodecId,
+) -> usize {
+    for (i, p) in participants.iter().enumerate() {
+        if p.seq_initialized {
+            let delta = seq.wrapping_sub(p.last_seq);
+            if delta > 0 && delta < 50 {
+                return i;
+            }
+        }
+    }
+    // New stream detected
+    let id = participants.len();
+    participants.push(ParticipantStats::new(id, codec));
+    id
+}
+
+// ---------------------------------------------------------------------------
+// Capture writer (binary packet log for later replay)
+// ---------------------------------------------------------------------------
+
+struct CaptureWriter {
+    file: std::io::BufWriter<std::fs::File>,
+    start: Instant,
+}
+
+impl CaptureWriter {
+    fn new(path: &str, room: &str, relay: &str) -> anyhow::Result<Self> {
+        let file = std::fs::File::create(path)?;
+        let mut writer = std::io::BufWriter::new(file);
+        // Magic + version
+        writer.write_all(b"WZP\x01")?;
+        let header = serde_json::json!({
+            "room": room,
+            "relay": relay,
+            "start_time": chrono::Utc::now().to_rfc3339(),
+            "version": 1,
+        });
+        let header_bytes = serde_json::to_vec(&header)?;
+        writer.write_all(&(header_bytes.len() as u32).to_le_bytes())?;
+        writer.write_all(&header_bytes)?;
+        Ok(Self {
+            file: writer,
+            start: Instant::now(),
+        })
+    }
+
+    fn write_packet(&mut self, pkt: &MediaPacket, now: Instant) -> anyhow::Result<()> {
+        let elapsed_us = now.duration_since(self.start).as_micros() as u64;
+        self.file.write_all(&elapsed_us.to_le_bytes())?;
+        let raw = pkt.to_bytes();
+        self.file.write_all(&(raw.len() as u32).to_le_bytes())?;
+        self.file.write_all(&raw)?;
+        Ok(())
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Capture reader (for replay mode)
+// ---------------------------------------------------------------------------
+
+struct CaptureReader {
+    reader: std::io::BufReader<std::fs::File>,
+    header: serde_json::Value,
+}
+
+impl CaptureReader {
+    fn open(path: &str) -> anyhow::Result<Self> {
+        use std::io::Read;
+        let file = std::fs::File::open(path)?;
+        let mut reader = std::io::BufReader::new(file);
+
+        // Read magic
+        let mut magic = [0u8; 4];
+        reader.read_exact(&mut magic)?;
+        anyhow::ensure!(&magic == b"WZP\x01", "not a WZP capture file");
+
+        // Read header
+        let mut len_buf = [0u8; 4];
+        reader.read_exact(&mut len_buf)?;
+        let header_len = u32::from_le_bytes(len_buf) as usize;
+        let mut header_bytes = vec![0u8; header_len];
+        reader.read_exact(&mut header_bytes)?;
+        let header: serde_json::Value = serde_json::from_slice(&header_bytes)?;
+
+        Ok(Self { reader, header })
+    }
+
+    fn next_packet(&mut self) -> anyhow::Result<Option<(u64, MediaPacket)>> {
+        use std::io::Read;
+        // Read timestamp
+        let mut ts_buf = [0u8; 8];
+        match self.reader.read_exact(&mut ts_buf) {
+            Ok(()) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => return Ok(None),
+            Err(e) => return Err(e.into()),
+        }
+        let timestamp_us = u64::from_le_bytes(ts_buf);
+
+        // Read packet
+        let mut len_buf = [0u8; 4];
+        self.reader.read_exact(&mut len_buf)?;
+        let pkt_len = u32::from_le_bytes(len_buf) as usize;
+        let mut pkt_bytes = vec![0u8; pkt_len];
+        self.reader.read_exact(&mut pkt_bytes)?;
+
+        let pkt = MediaPacket::from_bytes(bytes::Bytes::from(pkt_bytes))
+            .ok_or_else(|| anyhow::anyhow!("malformed packet in capture"))?;
+
+        Ok(Some((timestamp_us, pkt)))
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Timeline entry (for HTML report generation)
+// ---------------------------------------------------------------------------
+
+struct TimelineEntry {
+    timestamp_us: u64,
+    stream_id: usize,
+    #[allow(dead_code)]
+    codec: CodecId,
+    #[allow(dead_code)]
+    seq: u16,
+    #[allow(dead_code)]
+    payload_len: usize,
+    loss_pct: f64,
+    jitter_ms: f64,
+}
+
+// ---------------------------------------------------------------------------
+// Replay mode (#15)
+// ---------------------------------------------------------------------------
+
+async fn run_replay(path: &str, args: &Args) -> anyhow::Result<()> {
+    let mut reader = CaptureReader::open(path)?;
+    eprintln!(
+        "Replaying: {} (room: {})",
+        path,
+        reader
+            .header
+            .get("room")
+            .and_then(|v| v.as_str())
+            .unwrap_or("?")
+    );
+
+    let mut participants: Vec<ParticipantStats> = Vec::new();
+    let mut total_packets: u64 = 0;
+    let start = Instant::now();
+    let mut timeline: Vec<TimelineEntry> = Vec::new();
+
+    // Decrypt session from --key (optional)
+    let mut decrypt_session: Option<wzp_crypto::ChaChaSession> = args.key.as_ref().and_then(|hex| {
+        if hex.len() != 64 { return None; }
+        let mut key = [0u8; 32];
+        for (i, chunk) in hex.as_bytes().chunks(2).enumerate() {
+            let s = std::str::from_utf8(chunk).unwrap_or("00");
+            key[i] = u8::from_str_radix(s, 16).unwrap_or(0);
+        }
+        Some(wzp_crypto::ChaChaSession::new(key))
+    });
+    let mut decrypt_ok: u64 = 0;
+    let mut decrypt_fail: u64 = 0;
+
+    while let Some((ts_us, pkt)) = reader.next_packet()? {
+        let now = Instant::now();
+        let idx = find_or_create_participant(&mut participants, pkt.header.seq, pkt.header.codec_id);
+        participants[idx].ingest(&pkt, now);
+        total_packets += 1;
+
+        // Attempt decryption if key provided
+        if let Some(ref mut session) = decrypt_session {
+            use wzp_proto::CryptoSession;
+            let header_bytes = pkt.header.to_bytes();
+            let mut plaintext = Vec::new();
+            match session.decrypt(&header_bytes, &pkt.payload, &mut plaintext) {
+                Ok(()) => {
+                    decrypt_ok += 1;
+                    if decrypt_ok <= 5 || decrypt_ok % 100 == 0 {
+                        eprintln!(
+                            "  decrypt ok: seq={} codec={:?} payload={}B → plaintext={}B",
+                            pkt.header.seq, pkt.header.codec_id,
+                            pkt.payload.len(), plaintext.len()
+                        );
+                    }
+                }
+                Err(_) => {
+                    decrypt_fail += 1;
+                    if decrypt_fail <= 3 {
+                        eprintln!(
+                            "  decrypt FAIL: seq={} (key mismatch, wrong direction, or rekey boundary)",
+                            pkt.header.seq
+                        );
+                    }
+                }
+            }
+        }
+
+        // Record for HTML timeline
+        timeline.push(TimelineEntry {
+            timestamp_us: ts_us,
+            stream_id: idx,
+            codec: pkt.header.codec_id,
+            seq: pkt.header.seq,
+            payload_len: pkt.payload.len(),
+            loss_pct: participants[idx].loss_percent(),
+            jitter_ms: participants[idx].jitter_ms,
+        });
+    }
+
+    if decrypt_session.is_some() {
+        eprintln!(
+            "Decrypt stats: {} ok, {} failed (total {})",
+            decrypt_ok, decrypt_fail, total_packets
+        );
+    }
+
+    print_summary(&participants, total_packets, start.elapsed());
+
+    // Generate HTML if requested
+    if let Some(html_path) = &args.html {
+        generate_html_report(html_path, &participants, &timeline, total_packets, &reader.header)?;
+        eprintln!("HTML report: {}", html_path);
+    }
+
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// HTML report generation (#16)
+// ---------------------------------------------------------------------------
+
+fn generate_html_report(
+    path: &str,
+    participants: &[ParticipantStats],
+    timeline: &[TimelineEntry],
+    total_packets: u64,
+    capture_header: &serde_json::Value,
+) -> anyhow::Result<()> {
+    use std::io::Write as _;
+    let mut f = std::fs::File::create(path)?;
+
+    let room = capture_header
+        .get("room")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown");
+    let start_time = capture_header
+        .get("start_time")
+        .and_then(|v| v.as_str())
+        .unwrap_or("?");
+
+    // Build per-stream loss/jitter timeline data for Chart.js
+    // Sample every 1 second (group timeline entries by second)
+    let max_ts = timeline.last().map(|e| e.timestamp_us).unwrap_or(0);
+    let duration_secs = (max_ts / 1_000_000) + 1;
+
+    let mut loss_data: std::collections::HashMap<usize, Vec<f64>> =
+        std::collections::HashMap::new();
+    let mut jitter_data: std::collections::HashMap<usize, Vec<f64>> =
+        std::collections::HashMap::new();
+
+    for stream_id in 0..participants.len() {
+        loss_data.insert(stream_id, vec![0.0; duration_secs as usize]);
+        jitter_data.insert(stream_id, vec![0.0; duration_secs as usize]);
+    }
+
+    for entry in timeline {
+        let sec = (entry.timestamp_us / 1_000_000) as usize;
+        if sec < duration_secs as usize {
+            if let Some(losses) = loss_data.get_mut(&entry.stream_id) {
+                losses[sec] = entry.loss_pct;
+            }
+            if let Some(jitters) = jitter_data.get_mut(&entry.stream_id) {
+                jitters[sec] = entry.jitter_ms;
+            }
+        }
+    }
+
+    let colors = [
+        "#e74c3c", "#3498db", "#2ecc71", "#f39c12", "#9b59b6", "#1abc9c",
+    ];
+
+    // Build dataset JSON for charts
+    let mut loss_datasets = String::new();
+    let mut jitter_datasets = String::new();
+    for (i, p) in participants.iter().enumerate() {
+        let name = p.display_name();
+        let color = colors[i % colors.len()];
+        let loss_vals = loss_data
+            .get(&i)
+            .map(|v| format!("{:?}", v))
+            .unwrap_or_default();
+        let jitter_vals = jitter_data
+            .get(&i)
+            .map(|v| format!("{:?}", v))
+            .unwrap_or_default();
+
+        loss_datasets.push_str(&format!(
+            "{{ label: '{}', data: {}, borderColor: '{}', fill: false }},\n",
+            name, loss_vals, color
+        ));
+        jitter_datasets.push_str(&format!(
+            "{{ label: '{}', data: {}, borderColor: '{}', fill: false }},\n",
+            name, jitter_vals, color
+        ));
+    }
+
+    let labels: Vec<String> = (0..duration_secs).map(|s| format!("{}s", s)).collect();
+    let labels_json = format!("{:?}", labels);
+
+    // Summary table rows
+    let mut summary_rows = String::new();
+    for p in participants {
+        summary_rows.push_str(&format!(
+            "<tr><td>{}</td><td>{:?}</td><td>{}</td><td>{:.1}%</td><td>{:.0}ms</td><td>{}</td></tr>\n",
+            p.display_name(),
+            p.codec,
+            p.packets,
+            p.loss_percent(),
+            p.jitter_ms,
+            p.codec_switches
+        ));
+    }
+
+    write!(
+        f,
+        r#"<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8">
+<title>WZP Call Report — {room}</title>
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4"></script>
+<style>
+  body {{ font-family: -apple-system, sans-serif; max-width: 1200px; margin: 0 auto; padding: 20px; background: #1a1a2e; color: #e0e0e0; }}
+  h1,h2 {{ color: #4a9eff; }}
+  table {{ border-collapse: collapse; width: 100%; margin: 20px 0; }}
+  th,td {{ border: 1px solid #333; padding: 8px 12px; text-align: left; }}
+  th {{ background: #16213e; }}
+  tr:nth-child(even) {{ background: #1a1a3e; }}
+  .chart-container {{ background: #16213e; border-radius: 8px; padding: 16px; margin: 20px 0; }}
+  canvas {{ max-height: 300px; }}
+  .meta {{ color: #888; font-size: 0.9em; }}
+</style>
+</head><body>
+<h1>WZP Call Quality Report</h1>
+<p class="meta">Room: <b>{room}</b> | Start: {start_time} | Packets: {total_packets} | Duration: {duration_secs}s</p>
+
+<h2>Participant Summary</h2>
+<table>
+<tr><th>Name</th><th>Codec</th><th>Packets</th><th>Loss</th><th>Jitter</th><th>Codec Switches</th></tr>
+{summary_rows}
+</table>
+
+<h2>Packet Loss Over Time</h2>
+<div class="chart-container"><canvas id="lossChart"></canvas></div>
+
+<h2>Jitter Over Time</h2>
+<div class="chart-container"><canvas id="jitterChart"></canvas></div>
+
+<script>
+const labels = {labels_json};
+new Chart(document.getElementById('lossChart'), {{
+  type: 'line',
+  data: {{ labels, datasets: [{loss_datasets}] }},
+  options: {{ responsive: true, scales: {{ y: {{ beginAtZero: true, title: {{ display: true, text: 'Loss %' }} }} }} }}
+}});
+new Chart(document.getElementById('jitterChart'), {{
+  type: 'line',
+  data: {{ labels, datasets: [{jitter_datasets}] }},
+  options: {{ responsive: true, scales: {{ y: {{ beginAtZero: true, title: {{ display: true, text: 'Jitter (ms)' }} }} }} }}
+}});
+</script>
+</body></html>"#
+    )?;
+
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// No-TUI mode (print stats to stdout periodically)
+// ---------------------------------------------------------------------------
+
+async fn run_no_tui(
+    transport: &wzp_transport::QuinnTransport,
+    participants: &mut Vec<ParticipantStats>,
+    total_packets: &mut u64,
+    deadline: Option<Instant>,
+    mut capture_writer: Option<&mut CaptureWriter>,
+) -> anyhow::Result<()> {
+    let mut print_timer = Instant::now();
+    loop {
+        if let Some(dl) = deadline {
+            if Instant::now() > dl {
+                break;
+            }
+        }
+        match tokio::time::timeout(Duration::from_millis(100), transport.recv_media()).await {
+            Ok(Ok(Some(pkt))) => {
+                let now = Instant::now();
+                let idx =
+                    find_or_create_participant(participants, pkt.header.seq, pkt.header.codec_id);
+                participants[idx].ingest(&pkt, now);
+                *total_packets += 1;
+                if let Some(ref mut w) = capture_writer {
+                    w.write_packet(&pkt, now)?;
+                }
+            }
+            Ok(Ok(None)) => break,   // connection closed
+            Ok(Err(e)) => {
+                tracing::warn!("recv error: {e}");
+                break;
+            }
+            Err(_) => {}              // timeout, loop again
+        }
+        if print_timer.elapsed() >= Duration::from_secs(2) {
+            print_stats(participants, *total_packets);
+            print_timer = Instant::now();
+        }
+    }
+    Ok(())
+}
+
+fn print_stats(participants: &[ParticipantStats], total: u64) {
+    eprintln!("--- {} participants | {} total packets ---", participants.len(), total);
+    for p in participants {
+        eprintln!(
+            "  {}: {} pkts, {:.1}% loss, {:.0}ms jitter, {:?}, {:.0}s",
+            p.display_name(),
+            p.packets,
+            p.loss_percent(),
+            p.jitter_ms,
+            p.codec,
+            p.duration().as_secs_f64(),
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// TUI mode (ratatui + crossterm)
+// ---------------------------------------------------------------------------
+
+async fn run_tui(
+    transport: &wzp_transport::QuinnTransport,
+    participants: &mut Vec<ParticipantStats>,
+    total_packets: &mut u64,
+    start_time: Instant,
+    deadline: Option<Instant>,
+    mut capture_writer: Option<&mut CaptureWriter>,
+) -> anyhow::Result<()> {
+    crossterm::terminal::enable_raw_mode()?;
+    let mut stdout = std::io::stdout();
+    crossterm::execute!(stdout, crossterm::terminal::EnterAlternateScreen)?;
+    let backend = ratatui::backend::CrosstermBackend::new(stdout);
+    let mut terminal = ratatui::Terminal::new(backend)?;
+
+    let mut redraw_timer = Instant::now();
+
+    let result: anyhow::Result<()> = async {
+        loop {
+            // Check for quit key (q or Ctrl+C)
+            if crossterm::event::poll(Duration::from_millis(0))? {
+                if let crossterm::event::Event::Key(key) = crossterm::event::read()? {
+                    use crossterm::event::{KeyCode, KeyModifiers};
+                    if key.code == KeyCode::Char('q')
+                        || (key.code == KeyCode::Char('c')
+                            && key.modifiers.contains(KeyModifiers::CONTROL))
+                    {
+                        break;
+                    }
+                }
+            }
+
+            if let Some(dl) = deadline {
+                if Instant::now() > dl {
+                    break;
+                }
+            }
+
+            // Receive packets (non-blocking with short timeout)
+            match tokio::time::timeout(Duration::from_millis(20), transport.recv_media()).await {
+                Ok(Ok(Some(pkt))) => {
+                    let now = Instant::now();
+                    let idx = find_or_create_participant(
+                        participants,
+                        pkt.header.seq,
+                        pkt.header.codec_id,
+                    );
+                    participants[idx].ingest(&pkt, now);
+                    *total_packets += 1;
+                    if let Some(ref mut w) = capture_writer {
+                        w.write_packet(&pkt, now)?;
+                    }
+                }
+                Ok(Ok(None)) => break,
+                Ok(Err(e)) => {
+                    tracing::warn!("recv error: {e}");
+                    break;
+                }
+                Err(_) => {}
+            }
+
+            // Redraw TUI at ~10 FPS
+            if redraw_timer.elapsed() >= Duration::from_millis(100) {
+                terminal.draw(|f| draw_ui(f, participants, *total_packets, start_time))?;
+                redraw_timer = Instant::now();
+            }
+        }
+        Ok(())
+    }
+    .await;
+
+    // Always restore terminal, even on error
+    crossterm::terminal::disable_raw_mode()?;
+    crossterm::execute!(
+        std::io::stdout(),
+        crossterm::terminal::LeaveAlternateScreen
+    )?;
+
+    result
+}
+
+fn draw_ui(
+    f: &mut ratatui::Frame,
+    participants: &[ParticipantStats],
+    total_packets: u64,
+    start_time: Instant,
+) {
+    use ratatui::layout::{Constraint, Direction, Layout};
+    use ratatui::style::{Color, Modifier, Style};
+    use ratatui::widgets::{Block, Borders, Paragraph, Row, Table};
+
+    let elapsed = start_time.elapsed();
+    let elapsed_str = format!(
+        "{:02}:{:02}:{:02}",
+        elapsed.as_secs() / 3600,
+        (elapsed.as_secs() % 3600) / 60,
+        elapsed.as_secs() % 60
+    );
+
+    let chunks = Layout::default()
+        .direction(Direction::Vertical)
+        .constraints([
+            Constraint::Length(3), // header
+            Constraint::Min(5),   // participant table
+            Constraint::Length(3), // footer
+        ])
+        .split(f.area());
+
+    // Header
+    let header = Paragraph::new(format!(
+        " WZP Analyzer | {} participants | {} packets | {}",
+        participants.len(),
+        total_packets,
+        elapsed_str
+    ))
+    .block(Block::default().borders(Borders::ALL).title(" Protocol Analyzer "));
+    f.render_widget(header, chunks[0]);
+
+    // Participant table
+    let header_row = Row::new(vec![
+        "#", "Name", "Codec", "Packets", "Loss%", "Jitter", "Switches", "Duration",
+    ])
+    .style(Style::default().add_modifier(Modifier::BOLD));
+
+    let rows: Vec<Row> = participants
+        .iter()
+        .map(|p| {
+            let loss_color = if p.loss_percent() > 5.0 {
+                Color::Red
+            } else if p.loss_percent() > 1.0 {
+                Color::Yellow
+            } else {
+                Color::Green
+            };
+
+            Row::new(vec![
+                format!("{}", p.stream_id),
+                p.display_name(),
+                format!("{:?}", p.codec),
+                format!("{}", p.packets),
+                format!("{:.1}%", p.loss_percent()),
+                format!("{:.0}ms", p.jitter_ms),
+                format!("{}", p.codec_switches),
+                format!("{:.0}s", p.duration().as_secs_f64()),
+            ])
+            .style(Style::default().fg(loss_color))
+        })
+        .collect();
+
+    let widths = [
+        Constraint::Length(3),  // #
+        Constraint::Length(20), // Name
+        Constraint::Length(12), // Codec
+        Constraint::Length(10), // Packets
+        Constraint::Length(8),  // Loss%
+        Constraint::Length(10), // Jitter
+        Constraint::Length(10), // Switches
+        Constraint::Length(10), // Duration
+    ];
+
+    let table = Table::new(rows, widths)
+        .header(header_row)
+        .block(Block::default().borders(Borders::ALL).title(" Participants "));
+    f.render_widget(table, chunks[1]);
+
+    // Footer
+    let footer =
+        Paragraph::new(" Press 'q' to quit ").block(Block::default().borders(Borders::ALL));
+    f.render_widget(footer, chunks[2]);
+}
+
+// ---------------------------------------------------------------------------
+// Summary (printed on exit)
+// ---------------------------------------------------------------------------
+
+fn print_summary(participants: &[ParticipantStats], total: u64, elapsed: Duration) {
+    eprintln!("\n=== Session Summary ===");
+    eprintln!(
+        "Duration: {:.1}s | Total packets: {} | Participants: {}",
+        elapsed.as_secs_f64(),
+        total,
+        participants.len()
+    );
+    for p in participants {
+        eprintln!(
+            "  {}: {} pkts, {:.1}% loss, {:.0}ms jitter, {:?}, {} codec switches",
+            p.display_name(),
+            p.packets,
+            p.loss_percent(),
+            p.jitter_ms,
+            p.codec,
+            p.codec_switches,
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// main
+// ---------------------------------------------------------------------------
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let args = Args::parse();
+
+    // Only init tracing subscriber in no-tui mode (it would corrupt the TUI otherwise)
+    if args.no_tui || args.replay.is_some() {
+        tracing_subscriber::fmt().init();
+    }
+
+    let _crypto_session: Option<std::sync::Mutex<wzp_crypto::ChaChaSession>> =
+        if let Some(ref key_hex) = args.key {
+            if key_hex.len() != 64 {
+                eprintln!("Error: --key must be 64 hex characters (32 bytes). Got {} chars.", key_hex.len());
+                std::process::exit(1);
+            }
+            let mut key_bytes = [0u8; 32];
+            for (i, chunk) in key_hex.as_bytes().chunks(2).enumerate() {
+                let hex_str = std::str::from_utf8(chunk).unwrap_or("00");
+                key_bytes[i] = u8::from_str_radix(hex_str, 16).unwrap_or(0);
+            }
+            eprintln!("Encrypted payload decoding enabled (key loaded).");
+            Some(std::sync::Mutex::new(
+                wzp_crypto::ChaChaSession::new(key_bytes),
+            ))
+        } else {
+            None
+        };
+
+    // Replay mode: offline analysis of a .wzp capture file
+    if let Some(ref replay_path) = args.replay {
+        return run_replay(replay_path, &args).await;
+    }
+
+    // Live mode requires relay and room
+    let relay = args
+        .relay
+        .as_deref()
+        .ok_or_else(|| anyhow::anyhow!("relay address required for live mode (use --replay for offline)"))?;
+    let room = args
+        .room
+        .as_deref()
+        .ok_or_else(|| anyhow::anyhow!("--room required for live mode (use --replay for offline)"))?;
+
+    // TLS crypto provider
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    // Identity seed
+    let seed = match &args.seed {
+        Some(hex) => {
+            let s = wzp_crypto::Seed::from_hex(hex).map_err(|e| anyhow::anyhow!(e))?;
+            info!(fingerprint = %s.derive_identity().public_identity().fingerprint, "identity from --seed");
+            s
+        }
+        None => {
+            let s = wzp_crypto::Seed::generate();
+            info!(fingerprint = %s.derive_identity().public_identity().fingerprint, "generated ephemeral identity");
+            s
+        }
+    };
+
+    // Connect to relay
+    let relay_addr: std::net::SocketAddr = relay.parse()?;
+    let bind_addr: std::net::SocketAddr = if relay_addr.is_ipv6() {
+        "[::]:0".parse()?
+    } else {
+        "0.0.0.0:0".parse()?
+    };
+    let endpoint = wzp_transport::create_endpoint(bind_addr, None)?;
+    let client_config = wzp_transport::client_config();
+    let conn = wzp_transport::connect(&endpoint, relay_addr, room, client_config).await?;
+    let transport = Arc::new(wzp_transport::QuinnTransport::new(conn));
+
+    // Crypto handshake
+    let _crypto_session =
+        wzp_client::handshake::perform_handshake(&*transport, &seed.0, Some("analyzer")).await?;
+
+    // Auth if token provided
+    if let Some(ref token) = args.token {
+        let auth = wzp_proto::SignalMessage::AuthToken {
+            token: token.clone(),
+        };
+        transport.send_signal(&auth).await?;
+    }
+
+    // Capture file (optional)
+    let mut capture_writer = args
+        .capture
+        .as_ref()
+        .map(|path| CaptureWriter::new(path, room, relay))
+        .transpose()?;
+
+    // Duration timeout
+    let deadline = args
+        .duration
+        .map(|s| Instant::now() + Duration::from_secs(s));
+
+    // State
+    let mut participants: Vec<ParticipantStats> = Vec::new();
+    let mut total_packets: u64 = 0;
+    let start_time = Instant::now();
+
+    if args.no_tui {
+        run_no_tui(
+            &transport,
+            &mut participants,
+            &mut total_packets,
+            deadline,
+            capture_writer.as_mut(),
+        )
+        .await?;
+    } else {
+        run_tui(
+            &transport,
+            &mut participants,
+            &mut total_packets,
+            start_time,
+            deadline,
+            capture_writer.as_mut(),
+        )
+        .await?;
+    }
+
+    // Print summary
+    print_summary(&participants, total_packets, start_time.elapsed());
+
+    // Clean close
+    transport.close().await?;
+
+    Ok(())
+}

crates/wzp-client/src/birthday.rs

@@ -0,0 +1,350 @@
+//! Birthday attack for hard NAT traversal.
+//!
+//! When both peers are behind symmetric NATs with random port
+//! allocation, standard hole-punching fails because neither side
+//! can predict the other's external port. This module implements
+//! the birthday-paradox approach:
+//!
+//! 1. **Acceptor** opens N sockets, STUN-probes each to learn
+//!    their external ports, reports them to the Dialer.
+//! 2. **Dialer** sprays QUIC connect attempts to the Acceptor's
+//!    reported ports + random ports on the Acceptor's IP.
+//! 3. Birthday paradox: with N=64 ports and M=256 probes across
+//!    65536 ports, collision probability is high.
+//!
+//! In practice, the Acceptor's STUN-probed ports are known
+//! exactly (not random), so the Dialer targets them first —
+//! making this more like "spray-and-pray with a hit list" than
+//! a pure birthday attack.
+
+use std::net::{Ipv4Addr, SocketAddr};
+use std::time::{Duration, Instant};
+
+use crate::stun;
+
+/// Configuration for the birthday attack.
+#[derive(Debug, Clone)]
+pub struct BirthdayConfig {
+    /// Number of sockets the Acceptor opens (default: 32).
+    /// Each socket gets STUN-probed to learn its external port.
+    /// More = higher chance of collision, but more resource usage.
+    pub acceptor_ports: u16,
+    /// Number of QUIC connect attempts the Dialer makes (default: 128).
+    /// Spread across the Acceptor's known ports + random ports.
+    pub dialer_probes: u16,
+    /// Rate limit: ms between consecutive probes (default: 20ms = 50/s).
+    pub probe_interval_ms: u16,
+    /// Overall timeout for the birthday attack phase.
+    pub timeout: Duration,
+    /// STUN config for probing external ports.
+    pub stun_config: stun::StunConfig,
+}
+
+impl Default for BirthdayConfig {
+    fn default() -> Self {
+        Self {
+            acceptor_ports: 32,
+            dialer_probes: 128,
+            probe_interval_ms: 20,
+            timeout: Duration::from_secs(8),
+            stun_config: stun::StunConfig {
+                servers: vec!["stun.l.google.com:19302".into()],
+                timeout: Duration::from_secs(2),
+            },
+        }
+    }
+}
+
+/// Result of the Acceptor's port-opening phase.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct AcceptorPorts {
+    /// External IP (from STUN).
+    pub external_ip: Option<Ipv4Addr>,
+    /// List of (local_port, external_port) for each opened socket.
+    pub ports: Vec<PortMapping>,
+    /// How many sockets we attempted to open.
+    pub attempted: u16,
+    /// How many STUN probes succeeded.
+    pub succeeded: u16,
+}
+
+/// A single socket's local↔external port mapping.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct PortMapping {
+    pub local_port: u16,
+    pub external_port: u16,
+}
+
+/// Open N sockets and STUN-probe each to discover external ports.
+///
+/// Returns the set of known external ports that the Dialer should
+/// target. Each socket stays open (bound) so the NAT mapping
+/// remains active until the returned `PortGuard` is dropped.
+///
+/// The sockets are returned so the caller can keep them alive
+/// during the attack. Dropping them closes the NAT pinholes.
+pub async fn open_acceptor_ports(
+    config: &BirthdayConfig,
+) -> (AcceptorPorts, Vec<tokio::net::UdpSocket>) {
+    let mut sockets = Vec::new();
+    let mut mappings = Vec::new();
+    let mut external_ip: Option<Ipv4Addr> = None;
+    let mut succeeded: u16 = 0;
+
+    let stun_server = match config.stun_config.servers.first() {
+        Some(s) => match stun::resolve_stun_server(s).await {
+            Ok(a) => Some(a),
+            Err(_) => None,
+        },
+        None => None,
+    };
+
+    for _ in 0..config.acceptor_ports {
+        // Bind to random port
+        let sock = match tokio::net::UdpSocket::bind("0.0.0.0:0").await {
+            Ok(s) => s,
+            Err(_) => continue,
+        };
+        let local_port = match sock.local_addr() {
+            Ok(a) => a.port(),
+            Err(_) => continue,
+        };
+
+        // STUN probe to learn external port
+        if let Some(stun_addr) = stun_server {
+            match stun::stun_reflect(&sock, stun_addr, config.stun_config.timeout).await {
+                Ok(ext_addr) => {
+                    if external_ip.is_none() {
+                        if let std::net::IpAddr::V4(ip) = ext_addr.ip() {
+                            external_ip = Some(ip);
+                        }
+                    }
+                    mappings.push(PortMapping {
+                        local_port,
+                        external_port: ext_addr.port(),
+                    });
+                    succeeded += 1;
+                }
+                Err(e) => {
+                    tracing::debug!(local_port, error = %e, "birthday: STUN probe failed for socket");
+                }
+            }
+        }
+
+        sockets.push(sock);
+    }
+
+    tracing::info!(
+        attempted = config.acceptor_ports,
+        succeeded,
+        external_ip = ?external_ip,
+        "birthday: acceptor ports opened"
+    );
+
+    let result = AcceptorPorts {
+        external_ip,
+        ports: mappings,
+        attempted: config.acceptor_ports,
+        succeeded,
+    };
+
+    (result, sockets)
+}
+
+/// Generate the list of target addresses for the Dialer to spray.
+///
+/// Priority order:
+/// 1. Acceptor's known external ports (from STUN probes) — highest hit rate
+/// 2. Random ports on the Acceptor's IP — birthday paradox fill
+pub fn generate_dialer_targets(
+    acceptor_ip: Ipv4Addr,
+    known_ports: &[u16],
+    total_probes: u16,
+) -> Vec<SocketAddr> {
+    let mut targets = Vec::with_capacity(total_probes as usize);
+
+    // First: all known ports (guaranteed targets)
+    for &port in known_ports {
+        targets.push(SocketAddr::new(
+            std::net::IpAddr::V4(acceptor_ip),
+            port,
+        ));
+    }
+
+    // Fill remaining with random ports (birthday attack)
+    let remaining = total_probes.saturating_sub(known_ports.len() as u16);
+    if remaining > 0 {
+        use rand::Rng;
+        let mut rng = rand::thread_rng();
+        for _ in 0..remaining {
+            let port = rng.gen_range(1024..=65535u16);
+            let addr = SocketAddr::new(
+                std::net::IpAddr::V4(acceptor_ip),
+                port,
+            );
+            if !targets.contains(&addr) {
+                targets.push(addr);
+            }
+        }
+    }
+
+    targets
+}
+
+/// Run the Dialer side of the birthday attack.
+///
+/// Sprays QUIC connection attempts at the target addresses.
+/// Returns the first successful connection, or None on timeout.
+pub async fn spray_dialer(
+    endpoint: &wzp_transport::Endpoint,
+    targets: &[SocketAddr],
+    call_sni: &str,
+    probe_interval: Duration,
+    timeout: Duration,
+) -> Option<wzp_transport::QuinnTransport> {
+    let start = Instant::now();
+    let mut set = tokio::task::JoinSet::new();
+
+    tracing::info!(
+        target_count = targets.len(),
+        interval_ms = probe_interval.as_millis(),
+        timeout_s = timeout.as_secs(),
+        "birthday: dialer starting spray"
+    );
+
+    // Spray connects with rate limiting
+    for (idx, &target) in targets.iter().enumerate() {
+        if start.elapsed() >= timeout {
+            break;
+        }
+
+        let ep = endpoint.clone();
+        let sni = call_sni.to_string();
+        let client_cfg = wzp_transport::client_config();
+        set.spawn(async move {
+            let result = wzp_transport::connect(&ep, target, &sni, client_cfg).await;
+            (idx, target, result)
+        });
+
+        // Rate limit — don't blast the NAT
+        if idx < targets.len() - 1 {
+            tokio::time::sleep(probe_interval).await;
+        }
+    }
+
+    tracing::info!(
+        spawned = set.len(),
+        elapsed_ms = start.elapsed().as_millis(),
+        "birthday: all probes spawned, waiting for first success"
+    );
+
+    // Wait for first success or all failures
+    let deadline = start + timeout;
+    while let Some(join_res) = tokio::select! {
+        r = set.join_next() => r,
+        _ = tokio::time::sleep_until(tokio::time::Instant::from_std(deadline)) => None,
+    } {
+        match join_res {
+            Ok((idx, target, Ok(conn))) => {
+                tracing::info!(
+                    idx,
+                    %target,
+                    remote = %conn.remote_address(),
+                    elapsed_ms = start.elapsed().as_millis(),
+                    "birthday: HIT! QUIC handshake succeeded"
+                );
+                set.abort_all();
+                return Some(wzp_transport::QuinnTransport::new(conn));
+            }
+            Ok((idx, target, Err(e))) => {
+                tracing::debug!(
+                    idx,
+                    %target,
+                    error = %e,
+                    "birthday: probe failed"
+                );
+            }
+            Err(_) => {}
+        }
+    }
+
+    tracing::info!(
+        elapsed_ms = start.elapsed().as_millis(),
+        "birthday: all probes failed or timed out"
+    );
+    None
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generate_targets_known_ports_first() {
+        let ip = Ipv4Addr::new(203, 0, 113, 5);
+        let known = vec![10000, 10001, 10002];
+        let targets = generate_dialer_targets(ip, &known, 10);
+
+        // Known ports should be first
+        assert_eq!(targets[0].port(), 10000);
+        assert_eq!(targets[1].port(), 10001);
+        assert_eq!(targets[2].port(), 10002);
+        // Rest are random
+        assert!(targets.len() <= 10);
+        // All target the right IP
+        assert!(targets.iter().all(|a| a.ip() == std::net::IpAddr::V4(ip)));
+    }
+
+    #[test]
+    fn generate_targets_no_known_all_random() {
+        let ip = Ipv4Addr::new(10, 0, 0, 1);
+        let targets = generate_dialer_targets(ip, &[], 50);
+        assert!(!targets.is_empty());
+        assert!(targets.len() <= 50);
+        // All ports in valid range
+        assert!(targets.iter().all(|a| a.port() >= 1024));
+    }
+
+    #[test]
+    fn generate_targets_more_known_than_total() {
+        let ip = Ipv4Addr::new(10, 0, 0, 1);
+        let known: Vec<u16> = (10000..10100).collect();
+        let targets = generate_dialer_targets(ip, &known, 50);
+        // All 100 known ports included even though total=50
+        assert_eq!(targets.len(), 100);
+    }
+
+    #[test]
+    fn generate_targets_dedup() {
+        let ip = Ipv4Addr::new(10, 0, 0, 1);
+        let targets = generate_dialer_targets(ip, &[], 100);
+        // No duplicates
+        let mut sorted = targets.clone();
+        sorted.sort();
+        sorted.dedup();
+        assert_eq!(sorted.len(), targets.len());
+    }
+
+    #[test]
+    fn default_config() {
+        let cfg = BirthdayConfig::default();
+        assert_eq!(cfg.acceptor_ports, 32);
+        assert_eq!(cfg.dialer_probes, 128);
+        assert!(cfg.timeout.as_secs() > 0);
+    }
+
+    #[test]
+    fn acceptor_ports_serializes() {
+        let result = AcceptorPorts {
+            external_ip: Some(Ipv4Addr::new(203, 0, 113, 5)),
+            ports: vec![PortMapping { local_port: 12345, external_port: 54321 }],
+            attempted: 32,
+            succeeded: 1,
+        };
+        let json = serde_json::to_string(&result).unwrap();
+        assert!(json.contains("54321"));
+        assert!(json.contains("203.0.113.5"));
+    }
+}

crates/wzp-client/src/call.rs

@@ -234,6 +234,8 @@ pub struct CallEncoder {
     mini_frames_enabled: bool,
     /// Frames encoded since the last full header was emitted.
     frames_since_full: u32,
+    /// Pending quality report to attach to the next source packet.
+    pending_quality_report: Option<QualityReport>,
 }
 
 impl CallEncoder {
@@ -264,6 +266,7 @@ impl CallEncoder {
             mini_context: MiniFrameContext::default(),
             mini_frames_enabled: config.mini_frames_enabled,
             frames_since_full: 0,
+            pending_quality_report: None,
         }
     }
 
@@ -367,7 +370,7 @@ impl CallEncoder {
                 version: 0,
                 is_repair: false,
                 codec_id: self.profile.codec,
-                has_quality_report: false,
+                has_quality_report: self.pending_quality_report.is_some(),
                 fec_ratio_encoded,
                 seq: self.seq,
                 timestamp: self.timestamp_ms,
@@ -377,7 +380,7 @@ impl CallEncoder {
                 csrc_count: 0,
             },
             payload: Bytes::from(encoded.clone()),
-            quality_report: None,
+            quality_report: self.pending_quality_report.take(),
         };
 
         self.seq = self.seq.wrapping_add(1);
@@ -445,6 +448,22 @@ impl CallEncoder {
         self.aec.feed_farend(farend);
     }
 
+    /// Apply DRED tuning output to the encoder.
+    ///
+    /// Called by the send loop after `DredTuner::update()` returns `Some`.
+    /// No-op when the active codec is Codec2 (DRED is Opus-only).
+    pub fn apply_dred_tuning(&mut self, tuning: wzp_proto::DredTuning) {
+        self.audio_enc.set_dred_duration(tuning.dred_frames);
+        self.audio_enc.set_expected_loss(tuning.expected_loss_pct);
+    }
+
+    /// Queue a quality report for attachment to the next source packet.
+    /// Used by the send task to embed locally-observed path quality so
+    /// the peer can drive adaptive quality switching.
+    pub fn set_pending_quality_report(&mut self, report: QualityReport) {
+        self.pending_quality_report = Some(report);
+    }
+
     /// Enable or disable acoustic echo cancellation.
     pub fn set_aec_enabled(&mut self, enabled: bool) {
         self.aec.set_enabled(enabled);
@@ -1442,4 +1461,155 @@ mod tests {
             "frames_suppressed should be > 0"
         );
     }
+
+    // ---- DredTuner integration tests ----
+
+    /// End-to-end test: DredTuner reacts to simulated network degradation
+    /// and adjusts the encoder's DRED parameters via `apply_dred_tuning`.
+    #[test]
+    fn dred_tuner_adjusts_encoder_on_loss() {
+        use wzp_proto::DredTuner;
+
+        let mut enc = CallEncoder::new(&CallConfig {
+            profile: QualityProfile::GOOD,
+            suppression_enabled: false,
+            ..Default::default()
+        });
+        let mut tuner = DredTuner::new(QualityProfile::GOOD.codec);
+
+        // Baseline: good network → baseline DRED (20 frames = 200 ms).
+        let baseline = tuner.current();
+        assert_eq!(baseline.dred_frames, 20);
+
+        // Warm up the tuner — first few updates may return Some as the
+        // EWMA initializes and expected_loss settles from the initial 15%.
+        for _ in 0..10 {
+            tuner.update(0.0, 50, 5);
+        }
+        // After settling, the tuning should be at baseline.
+        assert_eq!(tuner.current().dred_frames, 20);
+
+        // Simulate network degradation: 30% loss, 300ms RTT.
+        // The tuner should increase DRED frames above baseline.
+        let tuning = tuner.update(30.0, 300, 15);
+        assert!(tuning.is_some(), "loss spike should trigger tuning change");
+        let t = tuning.unwrap();
+        assert!(
+            t.dred_frames > 20,
+            "30% loss should increase DRED above baseline 20, got {}",
+            t.dred_frames
+        );
+
+        // Apply to encoder — should not panic.
+        enc.apply_dred_tuning(t);
+
+        // Verify the encoder still works after tuning.
+        let pcm = voice_frame_20ms(0);
+        let packets = enc.encode_frame(&pcm).unwrap();
+        assert!(!packets.is_empty(), "encoder must still produce packets after DRED tuning");
+    }
+
+    /// DredTuner jitter spike triggers pre-emptive DRED boost to ceiling.
+    #[test]
+    fn dred_tuner_spike_boosts_to_ceiling() {
+        use wzp_proto::DredTuner;
+
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // Establish low-jitter baseline.
+        for _ in 0..20 {
+            tuner.update(0.0, 50, 5);
+        }
+        assert!(!tuner.spike_boost_active());
+
+        // Jitter spikes to 40ms (8x baseline of ~5ms).
+        let tuning = tuner.update(0.0, 50, 40);
+        assert!(tuner.spike_boost_active(), "jitter spike should activate boost");
+        assert!(tuning.is_some());
+        // Ceiling for Opus24k is 50 frames = 500 ms.
+        assert_eq!(
+            tuning.unwrap().dred_frames, 50,
+            "spike should push to ceiling"
+        );
+    }
+
+    /// DredTuner is a no-op for Codec2 profiles.
+    #[test]
+    fn dred_tuner_noop_for_codec2() {
+        use wzp_proto::DredTuner;
+
+        let mut tuner = DredTuner::new(CodecId::Codec2_1200);
+
+        // Even extreme conditions produce no tuning output.
+        assert!(tuner.update(50.0, 800, 100).is_none());
+        assert_eq!(tuner.current().dred_frames, 0);
+    }
+
+    /// DredTuner + CallEncoder: full cycle through profile switch.
+    #[test]
+    fn dred_tuner_handles_profile_switch() {
+        use wzp_proto::DredTuner;
+
+        let mut enc = CallEncoder::new(&CallConfig {
+            profile: QualityProfile::GOOD,
+            suppression_enabled: false,
+            ..Default::default()
+        });
+        let mut tuner = DredTuner::new(QualityProfile::GOOD.codec);
+
+        // Apply initial tuning on good network.
+        if let Some(t) = tuner.update(0.0, 50, 5) {
+            enc.apply_dred_tuning(t);
+        }
+
+        // Switch to degraded profile.
+        enc.set_profile(QualityProfile::DEGRADED).unwrap();
+        tuner.set_codec(QualityProfile::DEGRADED.codec);
+
+        // Opus6k baseline is 50 frames (500 ms), ceiling is 104 (1040 ms).
+        let baseline = tuner.current();
+        // After set_codec, the cached tuning should reflect old state;
+        // a fresh update gives the new codec's mapping.
+        let tuning = tuner.update(20.0, 200, 10);
+        assert!(tuning.is_some());
+        let t = tuning.unwrap();
+        assert!(
+            t.dred_frames >= 50,
+            "Opus6k with 20% loss should be at least baseline 50, got {}",
+            t.dred_frames
+        );
+
+        enc.apply_dred_tuning(t);
+
+        // Encode a 40ms frame (Opus6k uses 40ms frames = 1920 samples).
+        let pcm: Vec<i16> = (0..1920)
+            .map(|i| ((i as f32 * 0.1).sin() * 10_000.0) as i16)
+            .collect();
+        let packets = enc.encode_frame(&pcm).unwrap();
+        assert!(!packets.is_empty());
+    }
+
+    #[test]
+    fn encoder_attaches_quality_report() {
+        let mut enc = CallEncoder::new(&CallConfig {
+            profile: QualityProfile::GOOD,
+            suppression_enabled: false,
+            ..Default::default()
+        });
+
+        // Set a quality report
+        enc.set_pending_quality_report(QualityReport::from_path_stats(5.0, 80, 10));
+
+        // Encode a frame — should have quality_report attached
+        let pcm = voice_frame_20ms(0);
+        let packets = enc.encode_frame(&pcm).unwrap();
+        assert!(!packets.is_empty());
+        assert!(packets[0].header.has_quality_report, "first packet should have quality report");
+        assert!(packets[0].quality_report.is_some());
+
+        // Next frame should NOT have quality_report (it was consumed)
+        let packets2 = enc.encode_frame(&voice_frame_20ms(960)).unwrap();
+        assert!(!packets2[0].header.has_quality_report, "second packet should not have quality report");
+        assert!(packets2[0].quality_report.is_none());
+    }
 }

crates/wzp-client/src/cli.rs

@@ -52,6 +52,8 @@ struct CliArgs {
     signal: bool,
     /// Place a direct call to a fingerprint (requires --signal).
     call_target: Option<String>,
+    /// Run network diagnostic (STUN, port mapping, relay latencies).
+    netcheck: bool,
 }
 
 impl CliArgs {
@@ -97,6 +99,7 @@ fn parse_args() -> CliArgs {
     let mut relay_str = None;
     let mut signal = false;
     let mut call_target = None;
+    let mut netcheck = false;
 
     let mut i = 1;
     while i < args.len() {
@@ -182,6 +185,7 @@ fn parse_args() -> CliArgs {
                 );
             }
             "--sweep" => sweep = true,
+            "--netcheck" => { netcheck = true; }
             "--version-check" => { version_check = true; }
             "--help" | "-h" => {
                 eprintln!("Usage: wzp-client [options] [relay-addr]");
@@ -238,6 +242,7 @@ fn parse_args() -> CliArgs {
         version_check,
         signal,
         call_target,
+        netcheck,
     }
 }
 
@@ -256,6 +261,23 @@ async fn main() -> anyhow::Result<()> {
         return Ok(());
     }
 
+    // --netcheck: run network diagnostic and exit
+    if cli.netcheck {
+        let config = wzp_client::netcheck::NetcheckConfig {
+            stun_config: wzp_client::stun::StunConfig::default(),
+            relays: vec![
+                ("relay".into(), cli.relay_addr),
+            ],
+            timeout: std::time::Duration::from_secs(5),
+            test_portmap: true,
+            test_ipv6: true,
+            local_port: 0,
+        };
+        let report = wzp_client::netcheck::run_netcheck(&config).await;
+        print!("{}", wzp_client::netcheck::format_report(&report));
+        return Ok(());
+    }
+
     // --version-check: query relay version over QUIC and exit
     if cli.version_check {
         let client_config = wzp_transport::client_config();
@@ -424,6 +446,7 @@ async fn run_silence(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::R
     info!(total_source, total_repair, total_bytes, "done — closing");
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
+        call_id: None,
     };
     transport.send_signal(&hangup).await.ok();
     transport.close().await?;
@@ -575,6 +598,7 @@ async fn run_file_mode(
     // Send Hangup signal so the relay knows we're done
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
+        call_id: None,
     };
     transport.send_signal(&hangup).await.ok();
 
@@ -747,7 +771,7 @@ async fn run_signal_mode(
         Some(SignalMessage::RegisterPresenceAck { success: true, .. }) => {
             info!(fingerprint = %fp, "registered on relay — waiting for calls");
         }
-        Some(SignalMessage::RegisterPresenceAck { success: false, error }) => {
+        Some(SignalMessage::RegisterPresenceAck { success: false, error, .. }) => {
             anyhow::bail!("registration failed: {}", error.unwrap_or_default());
         }
         other => {
@@ -770,6 +794,12 @@ async fn run_signal_mode(
             ephemeral_pub: [0u8; 32], // Phase 1: not used for key exchange
             signature: vec![],
             supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
+            // CLI client doesn't attempt hole-punching; always
+            // relay-path.
+            caller_reflexive_addr: None,
+            caller_local_addrs: Vec::new(),
+            caller_mapped_addr: None,
+            caller_build_version: None,
         }).await?;
     }
 
@@ -799,12 +829,18 @@ async fn run_signal_mode(
                         ephemeral_pub: None,
                         signature: None,
                         chosen_profile: Some(wzp_proto::QualityProfile::GOOD),
+                        // CLI auto-accept uses generic (privacy) mode,
+                        // so callee addr stays hidden from the caller.
+                        callee_reflexive_addr: None,
+                        callee_local_addrs: Vec::new(),
+                        callee_mapped_addr: None,
+                        callee_build_version: None,
                     }).await;
                 }
                 SignalMessage::DirectCallAnswer { call_id, accept_mode, .. } => {
                     info!(call_id = %call_id, mode = ?accept_mode, "call answered");
                 }
-                SignalMessage::CallSetup { call_id, room, relay_addr: setup_relay } => {
+                SignalMessage::CallSetup { call_id, room, relay_addr: setup_relay, peer_direct_addr: _, peer_local_addrs: _, peer_mapped_addr: _ } => {
                     info!(call_id = %call_id, room = %room, relay = %setup_relay, "call setup — connecting to media room");
 
                     // Connect to the media room
@@ -855,6 +891,7 @@ async fn run_signal_mode(
                                                 info!("hanging up...");
                                                 let _ = signal_transport.send_signal(&SignalMessage::Hangup {
                                                     reason: wzp_proto::HangupReason::Normal,
+                                                    call_id: None,
                                                 }).await;
                                                 break;
                                             }
@@ -871,7 +908,7 @@ async fn run_signal_mode(
                         Err(e) => error!("media connect failed: {e}"),
                     }
                 }
-                SignalMessage::Hangup { reason } => {
+                SignalMessage::Hangup { reason, .. } => {
                     info!(reason = ?reason, "call ended by remote");
                 }
                 SignalMessage::Pong { .. } => {}

crates/wzp-client/src/dual_path.rs

@@ -0,0 +1,960 @@
+//! Phase 3.5 — dual-path QUIC connect race for P2P hole-punching.
+//!
+//! When both peers advertised reflex addrs in the
+//! DirectCallOffer/Answer flow, the relay cross-wires them into
+//! `CallSetup.peer_direct_addr`. This module races a direct QUIC
+//! handshake against the existing relay dial and returns whichever
+//! completes first — with automatic drop of the loser via
+//! `tokio::select!`.
+//!
+//! Role determination is deterministic and symmetric
+//! (`wzp_client::reflect::determine_role`): whichever peer has the
+//! lexicographically smaller reflex addr becomes the **Acceptor**
+//! (listens on a server-capable endpoint), the other becomes the
+//! **Dialer** (dials the peer's addr). Because the rule is
+//! identical on both sides, the Acceptor's inbound QUIC session
+//! and the Dialer's outbound are the SAME connection — no
+//! negotiation needed, no two-conns-per-call confusion.
+//!
+//! Timeout policy:
+//! - Direct path: 2s from the start of `race`. Cone-NAT hole-punch
+//!   typically completes in < 500ms on a LAN; 2s gives us tolerance
+//!   for a single QUIC Initial retry on unreliable networks.
+//! - Relay path: 10s (existing behavior elsewhere in the codebase).
+//! - Overall: `tokio::select!` returns as soon as either succeeds.
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::reflect::Role;
+use wzp_transport::QuinnTransport;
+
+/// Which path won the race. Used by the `connect` command for
+/// logging + (in the future) metrics.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum WinningPath {
+    Direct,
+    Relay,
+}
+
+/// Diagnostic info for a single candidate dial attempt.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct CandidateDiag {
+    pub index: usize,
+    pub addr: String,
+    pub result: String,  // "ok", "skipped:ipv6", "error:..."
+    pub elapsed_ms: Option<u32>,
+}
+
+/// Phase 6: the race now returns BOTH transports (when available)
+/// so the connect command can negotiate with the peer before
+/// committing. The negotiation decides which transport to use
+/// based on whether BOTH sides report `direct_ok = true`.
+pub struct RaceResult {
+    /// The direct P2P transport, if the direct path completed.
+    /// `None` if the direct dial/accept failed or timed out.
+    pub direct_transport: Option<Arc<QuinnTransport>>,
+    /// The relay transport, if the relay dial completed.
+    /// `None` if the relay dial failed (shouldn't happen in
+    /// practice since relay is always reachable).
+    pub relay_transport: Option<Arc<QuinnTransport>>,
+    /// Which future completed first in the local race.
+    /// Informational — the actual path used is decided by the
+    /// Phase 6 negotiation after both sides exchange reports.
+    pub local_winner: WinningPath,
+    /// Per-candidate diagnostic info for debugging.
+    pub candidate_diags: Vec<CandidateDiag>,
+}
+
+/// Attempt a direct QUIC connection to the peer in parallel with
+/// the relay dial and return the winning `QuinnTransport`.
+///
+/// `role` selects the direction of the direct attempt:
+/// - `Role::Acceptor` creates a server-capable endpoint and waits
+///   for the peer to dial in.
+/// - `Role::Dialer` creates a client-only endpoint and dials
+///   `peer_direct_addr`.
+///
+/// The relay path is always attempted in parallel as a fallback so
+/// the race ALWAYS produces a working transport unless both paths
+/// genuinely fail (network partition). Returns
+/// `Err(anyhow::anyhow!(...))` if both paths fail within the
+/// timeout.
+/// Phase 5.5 candidate bundle — full ICE-ish candidate list for
+/// the peer. The race tries them all in parallel alongside the
+/// relay path. At minimum this should contain the peer's
+/// server-reflexive address; `local_addrs` carries LAN host
+/// candidates gathered from their physical interfaces.
+///
+/// Empty is valid: the D-role has nothing to dial and the race
+/// reduces to "relay only" + (if A-role) accepting on the
+/// shared endpoint.
+#[derive(Debug, Clone, Default)]
+pub struct PeerCandidates {
+    /// Peer's server-reflexive address (Phase 3). `None` if the
+    /// peer didn't advertise one.
+    pub reflexive: Option<SocketAddr>,
+    /// Peer's LAN host addresses (Phase 5.5). Tried first on
+    /// same-LAN pairs — direct dials to these bypass the NAT
+    /// entirely.
+    pub local: Vec<SocketAddr>,
+    /// Phase 8 (Tailscale-inspired): peer's port-mapped external
+    /// address from NAT-PMP/PCP/UPnP. When the router supports
+    /// port mapping, this gives a stable external address even
+    /// behind symmetric NATs.
+    pub mapped: Option<SocketAddr>,
+}
+
+impl PeerCandidates {
+    /// Flatten into the list of addrs the D-role should dial.
+    /// Order: LAN host candidates first (fastest when they
+    /// work), then port-mapped (stable even behind symmetric
+    /// NATs), then reflexive (covers the non-LAN case).
+    pub fn dial_order(&self) -> Vec<SocketAddr> {
+        let mut out = Vec::with_capacity(self.local.len() + 2);
+        out.extend(self.local.iter().copied());
+        // Port-mapped address goes before reflexive — it's
+        // more reliable on symmetric NATs where the reflexive
+        // addr might not match what the peer actually sees.
+        if let Some(a) = self.mapped {
+            if !out.contains(&a) {
+                out.push(a);
+            }
+        }
+        if let Some(a) = self.reflexive {
+            if !out.contains(&a) {
+                out.push(a);
+            }
+        }
+        out
+    }
+
+    /// Smart dial order: filters out candidates that can't possibly
+    /// work given our own reflexive address.
+    ///
+    /// - **LAN candidates**: only included if peer's public IP
+    ///   matches ours (same network). Private IPs are unreachable
+    ///   cross-network.
+    /// - **IPv6 candidates**: stripped entirely (Phase 7 disabled).
+    /// - **Reflexive + mapped**: always included.
+    pub fn smart_dial_order(&self, own_reflexive: Option<&SocketAddr>) -> Vec<SocketAddr> {
+        let own_public_ip = own_reflexive.map(|a| a.ip());
+        let peer_public_ip = self.reflexive.map(|a| a.ip());
+        let same_network = match (own_public_ip, peer_public_ip) {
+            (Some(a), Some(b)) => a == b,
+            _ => false,
+        };
+
+        let mut out = Vec::with_capacity(self.local.len() + 2);
+
+        // LAN candidates only when on the same network.
+        if same_network {
+            for addr in &self.local {
+                if !addr.is_ipv6() {
+                    out.push(*addr);
+                }
+            }
+        }
+
+        // Port-mapped (always useful — it's a public addr).
+        if let Some(a) = self.mapped {
+            if !a.is_ipv6() && !out.contains(&a) {
+                out.push(a);
+            }
+        }
+
+        // Reflexive (always useful — it's the peer's public addr).
+        if let Some(a) = self.reflexive {
+            if !a.is_ipv6() && !out.contains(&a) {
+                out.push(a);
+            }
+        }
+
+        out
+    }
+
+    /// Is there anything for the D-role to dial? If not, the
+    /// race reduces to relay-only.
+    pub fn is_empty(&self) -> bool {
+        self.reflexive.is_none() && self.local.is_empty() && self.mapped.is_none()
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn race(
+    role: Role,
+    peer_candidates: PeerCandidates,
+    relay_addr: SocketAddr,
+    room_sni: String,
+    call_sni: String,
+    // Our own reflexive address — used to filter LAN candidates
+    // that can't work cross-network.
+    own_reflexive: Option<SocketAddr>,
+    // Phase 5: when `Some`, reuse this endpoint for BOTH the
+    // direct-path branch AND the relay dial. Pass the signal
+    // endpoint. The endpoint MUST be server-capable (created
+    // with a server config) for the A-role accept branch to
+    // work.
+    //
+    // When `None`, falls back to fresh endpoints per role.
+    // Used by tests.
+    shared_endpoint: Option<wzp_transport::Endpoint>,
+    // Phase 7: dedicated IPv6 endpoint with IPV6_V6ONLY=1.
+    // When `Some`, A-role accepts on both v4+v6, D-role routes
+    // each candidate to its matching-AF endpoint. When `None`,
+    // IPv6 candidates are skipped (IPv4-only, pre-Phase-7).
+    ipv6_endpoint: Option<wzp_transport::Endpoint>,
+) -> anyhow::Result<RaceResult> {
+    // Rustls provider must be installed before any quinn endpoint
+    // is created. Install attempt is idempotent.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    // Shared diagnostic collector for per-candidate results.
+    let diags_collector: Arc<std::sync::Mutex<Vec<CandidateDiag>>> =
+        Arc::new(std::sync::Mutex::new(Vec::new()));
+
+    // Build the direct-path endpoint + future based on role.
+    //
+    // A-role: one accept future on the shared endpoint. The
+    //   first incoming QUIC connection wins — we don't care
+    //   which peer candidate the dialer used to reach us.
+    //
+    // D-role: N parallel dial futures, one per peer candidate
+    //   (all LAN host addrs + the reflex addr), consolidated
+    //   into a single direct_fut via FuturesUnordered-style
+    //   "first OK wins" semantics. The first successful dial
+    //   becomes the direct path; the losers are dropped (quinn
+    //   will abort the in-flight handshakes via the dropped
+    //   Connecting futures).
+    //
+    // Either way, direct_fut resolves to a single QuinnTransport
+    // (or an error) and is raced against the relay_fut by the
+    // outer tokio::select!.
+    let direct_ep: wzp_transport::Endpoint;
+    let direct_fut: std::pin::Pin<
+        Box<dyn std::future::Future<Output = anyhow::Result<QuinnTransport>> + Send>,
+    >;
+
+    match role {
+        Role::Acceptor => {
+            let ep = match shared_endpoint.clone() {
+                Some(ep) => {
+                    tracing::info!(
+                        local_addr = ?ep.local_addr().ok(),
+                        "dual_path: A-role reusing shared endpoint for accept"
+                    );
+                    ep
+                }
+                None => {
+                    let (sc, _cert_der) = wzp_transport::server_config();
+                    // 0.0.0.0:0 = IPv4 socket. [::]:0 dual-stack was
+                    // tried but breaks on Android devices where
+                    // IPV6_V6ONLY=1 (default on some kernels) —
+                    // IPv4 candidates silently fail. IPv6 host
+                    // candidates are skipped for now; they need a
+                    // dedicated IPv6 socket alongside the v4 one
+                    // (like WebRTC's dual-socket approach).
+                    let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
+                    let fresh = wzp_transport::create_endpoint(bind, Some(sc))?;
+                    tracing::info!(
+                        local_addr = ?fresh.local_addr().ok(),
+                        "dual_path: A-role fresh endpoint up, awaiting peer dial"
+                    );
+                    fresh
+                }
+            };
+            let ep_for_fut = ep.clone();
+            // Phase 7: IPv6 accept temporarily disabled (same reason
+            // as dial — IPv6 connections die on datagram send).
+            // Accept on IPv4 shared endpoint only.
+            let _v6_ep_unused = ipv6_endpoint.clone();
+            // Collect peer addrs for NAT tickle (Acceptor-side).
+            let tickle_addrs: Vec<SocketAddr> = peer_candidates
+                .smart_dial_order(own_reflexive.as_ref())
+                .into_iter()
+                .filter(|a| !a.ip().is_loopback() && !a.ip().is_unspecified())
+                .collect();
+            direct_fut = Box::pin(async move {
+                // NAT tickle: send a small UDP packet to each of the
+                // Dialer's candidate addresses FROM our shared endpoint.
+                // This opens our NAT's pinhole for return traffic from
+                // those IPs — critical for address-restricted NATs that
+                // only allow inbound from IPs they've seen outbound
+                // traffic to. Without this, the Dialer's QUIC Initial
+                // gets dropped by our NAT.
+                if !tickle_addrs.is_empty() {
+                    if let Ok(local_addr) = ep_for_fut.local_addr() {
+                        // Send a tickle to each peer candidate address
+                        // to open our NAT for return traffic from that IP.
+                        //
+                        // We use a socket2 socket with SO_REUSEADDR +
+                        // SO_REUSEPORT on the SAME port as the quinn
+                        // endpoint. This is necessary because quinn
+                        // already holds the port — a plain bind() would
+                        // fail with EADDRINUSE.
+                        let tickle_result: Result<(), String> = (|| {
+                            use std::net::UdpSocket as StdUdpSocket;
+                            let sock = socket2::Socket::new(
+                                socket2::Domain::IPV4,
+                                socket2::Type::DGRAM,
+                                Some(socket2::Protocol::UDP),
+                            ).map_err(|e| format!("socket: {e}"))?;
+                            sock.set_reuse_address(true).map_err(|e| format!("reuseaddr: {e}"))?;
+                            // macOS/BSD/Linux also need SO_REUSEPORT
+                            #[cfg(any(target_os = "macos", target_os = "linux", target_os = "android"))]
+                            {
+                                // socket2 exposes set_reuse_port on unix
+                                unsafe {
+                                    let optval: libc::c_int = 1;
+                                    libc::setsockopt(
+                                        std::os::unix::io::AsRawFd::as_raw_fd(&sock),
+                                        libc::SOL_SOCKET,
+                                        libc::SO_REUSEPORT,
+                                        &optval as *const _ as *const libc::c_void,
+                                        std::mem::size_of::<libc::c_int>() as libc::socklen_t,
+                                    );
+                                }
+                            }
+                            sock.set_nonblocking(true).map_err(|e| format!("nonblock: {e}"))?;
+                            let bind_addr: SocketAddr = SocketAddr::new(
+                                std::net::IpAddr::V4(std::net::Ipv4Addr::UNSPECIFIED),
+                                local_addr.port(),
+                            );
+                            sock.bind(&bind_addr.into()).map_err(|e| format!("bind :{}: {e}", local_addr.port()))?;
+                            let std_sock: StdUdpSocket = sock.into();
+                            for addr in &tickle_addrs {
+                                let _ = std_sock.send_to(&[0u8; 1], addr);
+                                tracing::info!(
+                                    %addr,
+                                    local_port = local_addr.port(),
+                                    "dual_path: A-role sent NAT tickle"
+                                );
+                            }
+                            Ok(())
+                        })();
+                        if let Err(e) = tickle_result {
+                            tracing::warn!(error = %e, "dual_path: A-role NAT tickle failed");
+                        }
+                    }
+                }
+
+                // Accept loop: retry if we get a stale/closed
+                // connection from a previous call. Max 3 retries
+                // to avoid spinning until the race timeout.
+                const MAX_STALE: usize = 3;
+                let mut stale_count: usize = 0;
+                loop {
+                    let conn = wzp_transport::accept(&ep_for_fut)
+                        .await
+                        .map_err(|e| anyhow::anyhow!("direct accept: {e}"))?;
+
+                    if let Some(reason) = conn.close_reason() {
+                        // Explicitly close so the peer gets a
+                        // close frame instead of idle timeout.
+                        conn.close(0u32.into(), b"stale");
+                        stale_count += 1;
+                        tracing::warn!(
+                            remote = %conn.remote_address(),
+                            stable_id = conn.stable_id(),
+                            stale_count,
+                            ?reason,
+                            "dual_path: A-role skipping stale connection"
+                        );
+                        if stale_count >= MAX_STALE {
+                            return Err(anyhow::anyhow!(
+                                "A-role: {stale_count} stale connections, aborting"
+                            ));
+                        }
+                        continue;
+                    }
+
+                    let has_dgram = conn.max_datagram_size().is_some();
+                    tracing::info!(
+                        remote = %conn.remote_address(),
+                        stable_id = conn.stable_id(),
+                        has_dgram,
+                        "dual_path: A-role accepted direct connection"
+                    );
+
+                    break Ok(QuinnTransport::new(conn));
+                }
+            });
+            direct_ep = ep;
+        }
+        Role::Dialer => {
+            let ep = match shared_endpoint.clone() {
+                Some(ep) => {
+                    tracing::info!(
+                        local_addr = ?ep.local_addr().ok(),
+                        candidates = ?peer_candidates.dial_order(),
+                        "dual_path: D-role reusing shared endpoint to dial peer candidates"
+                    );
+                    ep
+                }
+                None => {
+                    // 0.0.0.0:0 = IPv4 socket. [::]:0 dual-stack was
+                    // tried but breaks on Android devices where
+                    // IPV6_V6ONLY=1 (default on some kernels) —
+                    // IPv4 candidates silently fail. IPv6 host
+                    // candidates are skipped for now; they need a
+                    // dedicated IPv6 socket alongside the v4 one
+                    // (like WebRTC's dual-socket approach).
+                    let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
+                    let fresh = wzp_transport::create_endpoint(bind, None)?;
+                    tracing::info!(
+                        local_addr = ?fresh.local_addr().ok(),
+                        candidates = ?peer_candidates.dial_order(),
+                        "dual_path: D-role fresh endpoint up, dialing peer candidates"
+                    );
+                    fresh
+                }
+            };
+            let ep_for_fut = ep.clone();
+            let _v6_ep_for_dial = ipv6_endpoint.clone();
+            let dial_order = peer_candidates.smart_dial_order(own_reflexive.as_ref());
+            let sni = call_sni.clone();
+            let diags = diags_collector.clone();
+            direct_fut = Box::pin(async move {
+                if dial_order.is_empty() {
+                    // No candidates — the race reduces to
+                    // relay-only. Surface a stable error so the
+                    // outer select falls through to relay_fut
+                    // without a spurious "direct failed" warning.
+                    // Use a pending future that never resolves so
+                    // the select's "other side wins" branch is
+                    // the natural outcome.
+                    std::future::pending::<anyhow::Result<QuinnTransport>>().await
+                } else {
+                    // Fan out N parallel dials via JoinSet. First
+                    // `Ok` wins; `Err` from a single candidate is
+                    // not fatal — we wait for the others. Only
+                    // when ALL have failed do we return Err.
+                    let mut set = tokio::task::JoinSet::new();
+                    for (idx, candidate) in dial_order.iter().enumerate() {
+                        // Phase 7: route each candidate to the
+                        // endpoint matching its address family.
+                        let candidate = *candidate;
+                        // Phase 7: IPv6 dials temporarily disabled.
+                        // IPv6 QUIC handshakes succeed but the
+                        // connection dies immediately on datagram
+                        // send ("connection lost"). Root cause is
+                        // likely router-level IPv6 UDP filtering.
+                        // Re-enable once IPv6 datagram delivery is
+                        // verified on target networks.
+                        if candidate.is_ipv6() {
+                            tracing::info!(
+                                %candidate,
+                                candidate_idx = idx,
+                                "dual_path: skipping IPv6 candidate (disabled)"
+                            );
+                            if let Ok(mut d) = diags.lock() {
+                                d.push(CandidateDiag {
+                                    index: idx,
+                                    addr: candidate.to_string(),
+                                    result: "skipped:ipv6".into(),
+                                    elapsed_ms: None,
+                                });
+                            }
+                            continue;
+                        }
+                        let ep = ep_for_fut.clone();
+                        let client_cfg = wzp_transport::client_config();
+                        let sni = sni.clone();
+                        let diags_inner = diags.clone();
+                        set.spawn(async move {
+                            let start = std::time::Instant::now();
+                            tracing::info!(
+                                %candidate,
+                                candidate_idx = idx,
+                                "dual_path: dialing candidate"
+                            );
+                            let result = wzp_transport::connect(
+                                &ep,
+                                candidate,
+                                &sni,
+                                client_cfg,
+                            )
+                            .await;
+                            let elapsed = start.elapsed().as_millis() as u32;
+                            let diag_result = match &result {
+                                Ok(_) => "ok".to_string(),
+                                Err(e) => format!("error:{e}"),
+                            };
+                            if let Ok(mut d) = diags_inner.lock() {
+                                d.push(CandidateDiag {
+                                    index: idx,
+                                    addr: candidate.to_string(),
+                                    result: diag_result,
+                                    elapsed_ms: Some(elapsed),
+                                });
+                            }
+                            (idx, candidate, result)
+                        });
+                    }
+                    let mut last_err: Option<String> = None;
+                    while let Some(join_res) = set.join_next().await {
+                        let (idx, candidate, dial_res) = match join_res {
+                            Ok(t) => t,
+                            Err(e) => {
+                                last_err = Some(format!("join {e}"));
+                                continue;
+                            }
+                        };
+                        match dial_res {
+                            Ok(conn) => {
+                                tracing::info!(
+                                    %candidate,
+                                    candidate_idx = idx,
+                                    remote = %conn.remote_address(),
+                                    stable_id = conn.stable_id(),
+                                    "dual_path: direct dial succeeded on candidate"
+                                );
+                                // Abort the remaining in-flight
+                                // dials so they don't complete
+                                // and leak QUIC sessions.
+                                set.abort_all();
+                                return Ok(QuinnTransport::new(conn));
+                            }
+                            Err(e) => {
+                                tracing::info!(
+                                    %candidate,
+                                    candidate_idx = idx,
+                                    error = %e,
+                                    "dual_path: direct dial failed, trying others"
+                                );
+                                last_err = Some(format!("candidate {candidate}: {e}"));
+                            }
+                        }
+                    }
+                    Err(anyhow::anyhow!(
+                        "all {} direct candidates failed; last: {}",
+                        dial_order.len(),
+                        last_err.unwrap_or_else(|| "n/a".into())
+                    ))
+                }
+            });
+            direct_ep = ep;
+        }
+    }
+
+    // Relay path: classic dial to the relay's media room. Phase 5:
+    // reuse the shared endpoint here too so MikroTik-style NATs
+    // keep a stable external port across all flows from this
+    // client. Falls back to a fresh endpoint when not shared.
+    let relay_ep = match shared_endpoint.clone() {
+        Some(ep) => ep,
+        None => {
+            let relay_bind: SocketAddr = "[::]:0".parse().unwrap();
+            wzp_transport::create_endpoint(relay_bind, None)?
+        }
+    };
+    let relay_ep_for_fut = relay_ep.clone();
+    let relay_client_cfg = wzp_transport::client_config();
+    let relay_sni = room_sni.clone();
+    // Phase 5.5 direct-path head-start: hold the relay dial for
+    // 500ms before attempting it. On same-LAN cone-NAT pairs the
+    // direct dial finishes in ~30-100ms, so giving direct a 500ms
+    // head start means direct reliably wins when it's going to
+    // work at all. The worst case adds 500ms to the fall-back-
+    // to-relay scenario, which is imperceptible for users on
+    // setups where direct isn't available anyway.
+    //
+    // Prior behavior (immediate race) caused the relay to win
+    // ~105ms races on a MikroTik LAN because:
+    //   - Acceptor role's direct_fut = accept() can only fire
+    //     when the peer has completed its outbound LAN dial
+    //   - Dialer role's parallel LAN dials need the peer's
+    //     CallSetup processed + the race started on the other
+    //     side before they can reach us
+    //   - Meanwhile relay_fut is a plain dial that completes in
+    //     whatever the client→relay RTT is (often <100ms)
+    //
+    // The 500ms head start is the minimum that empirically makes
+    // same-LAN direct reliably beat relay, without penalizing
+    // users who genuinely need the relay path.
+    const DIRECT_HEAD_START: Duration = Duration::from_millis(500);
+    let relay_fut = async move {
+        tokio::time::sleep(DIRECT_HEAD_START).await;
+        let conn =
+            wzp_transport::connect(&relay_ep_for_fut, relay_addr, &relay_sni, relay_client_cfg)
+                .await
+                .map_err(|e| anyhow::anyhow!("relay dial: {e}"))?;
+        Ok::<_, anyhow::Error>(QuinnTransport::new(conn))
+    };
+
+    // Phase 6: run both paths concurrently via tokio::spawn and
+    // collect BOTH results. The old tokio::select! approach dropped
+    // the loser, which meant the connect command couldn't negotiate
+    // with the peer — it had to commit to whichever path won locally.
+    //
+    // Now we spawn both as tasks, wait for the first to complete
+    // (that determines `local_winner`), then give the loser a short
+    // grace period to also complete. The connect command gets a
+    // RaceResult with both transports (when available) and uses the
+    // Phase 6 MediaPathReport exchange to decide which one to
+    // actually use for media.
+    let smart_order = peer_candidates.smart_dial_order(own_reflexive.as_ref());
+    tracing::info!(
+        ?role,
+        raw_candidates = ?peer_candidates.dial_order(),
+        filtered_candidates = ?smart_order,
+        ?own_reflexive,
+        %relay_addr,
+        "dual_path: racing direct vs relay"
+    );
+
+    let mut direct_task = tokio::spawn(
+        tokio::time::timeout(Duration::from_secs(4), direct_fut),
+    );
+    let mut relay_task = tokio::spawn(async move {
+        // Keep the 500ms head start so direct has a chance
+        tokio::time::sleep(Duration::from_millis(500)).await;
+        tokio::time::timeout(Duration::from_secs(5), relay_fut).await
+    });
+
+    // Wait for the first one to complete. This tells us the
+    // local_winner — but we DON'T commit to it yet. Phase 6
+    // negotiation decides the actual path.
+    let (mut direct_result, mut relay_result): (
+        Option<anyhow::Result<QuinnTransport>>,
+        Option<anyhow::Result<QuinnTransport>>,
+    ) = (None, None);
+
+    let local_winner;
+
+    tokio::select! {
+        biased;
+        d = &mut direct_task => {
+            match d {
+                Ok(Ok(Ok(t))) => {
+                    tracing::info!("dual_path: direct completed first");
+                    direct_result = Some(Ok(t));
+                    local_winner = WinningPath::Direct;
+                }
+                Ok(Ok(Err(e))) => {
+                    tracing::warn!(error = %e, "dual_path: direct failed");
+                    direct_result = Some(Err(anyhow::anyhow!("{e}")));
+                    local_winner = WinningPath::Relay; // direct failed → relay is our only hope
+                }
+                Ok(Err(_)) => {
+                    tracing::warn!("dual_path: direct timed out (4s)");
+                    direct_result = Some(Err(anyhow::anyhow!("direct timeout")));
+                    local_winner = WinningPath::Relay;
+                    // Record timeout diag for candidates that were
+                    // still in-flight when the timeout fired.
+                    if let Ok(mut d) = diags_collector.lock() {
+                        let recorded_indices: std::collections::HashSet<usize> =
+                            d.iter().map(|diag| diag.index).collect();
+                        for (idx, addr) in smart_order.iter().enumerate() {
+                            if !recorded_indices.contains(&idx) {
+                                d.push(CandidateDiag {
+                                    index: idx,
+                                    addr: addr.to_string(),
+                                    result: "timeout:4s".into(),
+                                    elapsed_ms: Some(4000),
+                                });
+                            }
+                        }
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(error = %e, "dual_path: direct task panicked");
+                    direct_result = Some(Err(anyhow::anyhow!("direct task panic")));
+                    local_winner = WinningPath::Relay;
+                }
+            }
+        }
+        r = &mut relay_task => {
+            match r {
+                Ok(Ok(Ok(t))) => {
+                    tracing::info!("dual_path: relay completed first");
+                    relay_result = Some(Ok(t));
+                    local_winner = WinningPath::Relay;
+                }
+                Ok(Ok(Err(e))) => {
+                    tracing::warn!(error = %e, "dual_path: relay failed");
+                    relay_result = Some(Err(anyhow::anyhow!("{e}")));
+                    local_winner = WinningPath::Direct;
+                }
+                Ok(Err(_)) => {
+                    tracing::warn!("dual_path: relay timed out");
+                    relay_result = Some(Err(anyhow::anyhow!("relay timeout")));
+                    local_winner = WinningPath::Direct;
+                }
+                Err(e) => {
+                    relay_result = Some(Err(anyhow::anyhow!("relay task panic: {e}")));
+                    local_winner = WinningPath::Direct;
+                }
+            }
+        }
+    }
+
+    // Give the loser a short grace period (1s) to also complete.
+    // If it does, we have both transports for Phase 6 negotiation.
+    // If it doesn't, we still proceed with just the winner.
+    if direct_result.is_none() {
+        match tokio::time::timeout(Duration::from_secs(1), direct_task).await {
+            Ok(Ok(Ok(Ok(t)))) => { direct_result = Some(Ok(t)); }
+            Ok(Ok(Ok(Err(e)))) => { direct_result = Some(Err(anyhow::anyhow!("{e}"))); }
+            _ => {
+                direct_result = Some(Err(anyhow::anyhow!("direct: no result in grace period")));
+                // Fill timeout diags for candidates that never reported.
+                if let Ok(mut d) = diags_collector.lock() {
+                    let recorded: std::collections::HashSet<usize> =
+                        d.iter().map(|diag| diag.index).collect();
+                    for (idx, addr) in smart_order.iter().enumerate() {
+                        if !recorded.contains(&idx) {
+                            d.push(CandidateDiag {
+                                index: idx,
+                                addr: addr.to_string(),
+                                result: "timeout:grace".into(),
+                                elapsed_ms: None,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+    if relay_result.is_none() {
+        match tokio::time::timeout(Duration::from_secs(1), relay_task).await {
+            Ok(Ok(Ok(Ok(t)))) => { relay_result = Some(Ok(t)); }
+            Ok(Ok(Ok(Err(e)))) => { relay_result = Some(Err(anyhow::anyhow!("{e}"))); }
+            _ => { relay_result = Some(Err(anyhow::anyhow!("relay: no result in grace period"))); }
+        }
+    }
+
+    let direct_ok = direct_result.as_ref().map(|r| r.is_ok()).unwrap_or(false);
+    let relay_ok = relay_result.as_ref().map(|r| r.is_ok()).unwrap_or(false);
+
+    tracing::info!(
+        ?local_winner,
+        direct_ok,
+        relay_ok,
+        "dual_path: race finished, both results collected for Phase 6 negotiation"
+    );
+
+    if !direct_ok && !relay_ok {
+        return Err(anyhow::anyhow!("both paths failed: no media transport available"));
+    }
+
+    let _ = (direct_ep, relay_ep, ipv6_endpoint);
+
+    let candidate_diags = diags_collector.lock()
+        .map(|d| d.clone())
+        .unwrap_or_default();
+
+    Ok(RaceResult {
+        direct_transport: direct_result
+            .and_then(|r| r.ok())
+            .map(|t| Arc::new(t)),
+        relay_transport: relay_result
+            .and_then(|r| r.ok())
+            .map(|t| Arc::new(t)),
+        local_winner,
+        candidate_diags,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn peer_candidates_dial_order_all_types() {
+        let candidates = PeerCandidates {
+            reflexive: Some("203.0.113.5:4433".parse().unwrap()),
+            local: vec![
+                "192.168.1.10:4433".parse().unwrap(),
+                "10.0.0.5:4433".parse().unwrap(),
+            ],
+            mapped: Some("198.51.100.42:12345".parse().unwrap()),
+        };
+
+        let order = candidates.dial_order();
+        // Order: local first, then mapped, then reflexive
+        assert_eq!(order.len(), 4);
+        assert_eq!(order[0], "192.168.1.10:4433".parse::<SocketAddr>().unwrap());
+        assert_eq!(order[1], "10.0.0.5:4433".parse::<SocketAddr>().unwrap());
+        assert_eq!(order[2], "198.51.100.42:12345".parse::<SocketAddr>().unwrap());
+        assert_eq!(order[3], "203.0.113.5:4433".parse::<SocketAddr>().unwrap());
+    }
+
+    #[test]
+    fn peer_candidates_dial_order_no_mapped() {
+        let candidates = PeerCandidates {
+            reflexive: Some("203.0.113.5:4433".parse().unwrap()),
+            local: vec!["192.168.1.10:4433".parse().unwrap()],
+            mapped: None,
+        };
+
+        let order = candidates.dial_order();
+        assert_eq!(order.len(), 2);
+        assert_eq!(order[0], "192.168.1.10:4433".parse::<SocketAddr>().unwrap());
+        assert_eq!(order[1], "203.0.113.5:4433".parse::<SocketAddr>().unwrap());
+    }
+
+    #[test]
+    fn peer_candidates_dial_order_only_mapped() {
+        let candidates = PeerCandidates {
+            reflexive: None,
+            local: vec![],
+            mapped: Some("198.51.100.42:12345".parse().unwrap()),
+        };
+
+        let order = candidates.dial_order();
+        assert_eq!(order.len(), 1);
+        assert_eq!(order[0], "198.51.100.42:12345".parse::<SocketAddr>().unwrap());
+    }
+
+    #[test]
+    fn peer_candidates_dial_order_dedup_mapped_equals_reflexive() {
+        let addr: SocketAddr = "203.0.113.5:4433".parse().unwrap();
+        let candidates = PeerCandidates {
+            reflexive: Some(addr),
+            local: vec![],
+            mapped: Some(addr), // same as reflexive
+        };
+
+        let order = candidates.dial_order();
+        // Should be deduped to 1
+        assert_eq!(order.len(), 1);
+        assert_eq!(order[0], addr);
+    }
+
+    #[test]
+    fn peer_candidates_dial_order_dedup_mapped_in_local() {
+        let addr: SocketAddr = "192.168.1.10:4433".parse().unwrap();
+        let candidates = PeerCandidates {
+            reflexive: None,
+            local: vec![addr],
+            mapped: Some(addr), // same as a local addr
+        };
+
+        let order = candidates.dial_order();
+        assert_eq!(order.len(), 1);
+        assert_eq!(order[0], addr);
+    }
+
+    #[test]
+    fn peer_candidates_is_empty() {
+        let empty = PeerCandidates::default();
+        assert!(empty.is_empty());
+
+        let with_reflexive = PeerCandidates {
+            reflexive: Some("1.2.3.4:5".parse().unwrap()),
+            ..Default::default()
+        };
+        assert!(!with_reflexive.is_empty());
+
+        let with_local = PeerCandidates {
+            local: vec!["10.0.0.1:5".parse().unwrap()],
+            ..Default::default()
+        };
+        assert!(!with_local.is_empty());
+
+        let with_mapped = PeerCandidates {
+            mapped: Some("1.2.3.4:5".parse().unwrap()),
+            ..Default::default()
+        };
+        assert!(!with_mapped.is_empty());
+    }
+
+    #[test]
+    fn peer_candidates_empty_dial_order() {
+        let empty = PeerCandidates::default();
+        assert!(empty.dial_order().is_empty());
+    }
+
+    #[test]
+    fn winning_path_debug() {
+        // Just verify Debug impl doesn't panic
+        let _ = format!("{:?}", WinningPath::Direct);
+        let _ = format!("{:?}", WinningPath::Relay);
+    }
+
+    // ── smart_dial_order tests ─────────────────────────────────
+
+    #[test]
+    fn smart_dial_order_same_network_includes_lan() {
+        let candidates = PeerCandidates {
+            reflexive: Some("203.0.113.5:4433".parse().unwrap()),
+            local: vec![
+                "192.168.1.10:4433".parse().unwrap(),
+                "10.0.0.5:4433".parse().unwrap(),
+            ],
+            mapped: None,
+        };
+        let own: SocketAddr = "203.0.113.5:12345".parse().unwrap();
+        let order = candidates.smart_dial_order(Some(&own));
+        // Same public IP → LAN candidates included
+        assert!(order.contains(&"192.168.1.10:4433".parse().unwrap()));
+        assert!(order.contains(&"10.0.0.5:4433".parse().unwrap()));
+        assert!(order.contains(&"203.0.113.5:4433".parse().unwrap()));
+    }
+
+    #[test]
+    fn smart_dial_order_different_network_strips_lan() {
+        let candidates = PeerCandidates {
+            reflexive: Some("150.228.49.65:4433".parse().unwrap()),
+            local: vec![
+                "172.16.81.126:4433".parse().unwrap(),
+                "10.0.0.5:4433".parse().unwrap(),
+            ],
+            mapped: None,
+        };
+        // Different public IP → LAN candidates stripped
+        let own: SocketAddr = "185.115.4.212:12345".parse().unwrap();
+        let order = candidates.smart_dial_order(Some(&own));
+        assert!(!order.contains(&"172.16.81.126:4433".parse().unwrap()));
+        assert!(!order.contains(&"10.0.0.5:4433".parse().unwrap()));
+        // Reflexive still included
+        assert!(order.contains(&"150.228.49.65:4433".parse().unwrap()));
+    }
+
+    #[test]
+    fn smart_dial_order_strips_ipv6() {
+        let candidates = PeerCandidates {
+            reflexive: Some("150.228.49.65:4433".parse().unwrap()),
+            local: vec![
+                "[2a0d:3344:692c::1]:4433".parse().unwrap(),
+                "172.16.81.126:4433".parse().unwrap(),
+            ],
+            mapped: None,
+        };
+        // Same network, but IPv6 should be stripped
+        let own: SocketAddr = "150.228.49.65:5555".parse().unwrap();
+        let order = candidates.smart_dial_order(Some(&own));
+        assert!(!order.iter().any(|a| a.is_ipv6()));
+        assert!(order.contains(&"172.16.81.126:4433".parse().unwrap()));
+    }
+
+    #[test]
+    fn smart_dial_order_no_own_reflexive_strips_lan() {
+        let candidates = PeerCandidates {
+            reflexive: Some("150.228.49.65:4433".parse().unwrap()),
+            local: vec!["172.16.81.126:4433".parse().unwrap()],
+            mapped: Some("198.51.100.42:12345".parse().unwrap()),
+        };
+        // No own reflexive → can't determine same network → strip LAN
+        let order = candidates.smart_dial_order(None);
+        assert!(!order.contains(&"172.16.81.126:4433".parse().unwrap()));
+        assert!(order.contains(&"198.51.100.42:12345".parse().unwrap()));
+        assert!(order.contains(&"150.228.49.65:4433".parse().unwrap()));
+    }
+
+    #[test]
+    fn smart_dial_order_mapped_always_included() {
+        let candidates = PeerCandidates {
+            reflexive: Some("150.228.49.65:4433".parse().unwrap()),
+            local: vec![],
+            mapped: Some("198.51.100.42:12345".parse().unwrap()),
+        };
+        let own: SocketAddr = "185.115.4.212:12345".parse().unwrap();
+        let order = candidates.smart_dial_order(Some(&own));
+        assert_eq!(order.len(), 2); // mapped + reflexive
+        assert!(order.contains(&"198.51.100.42:12345".parse().unwrap()));
+        assert!(order.contains(&"150.228.49.65:4433".parse().unwrap()));
+    }
+}

crates/wzp-client/src/featherchat.rs

@@ -126,6 +126,20 @@ pub fn signal_to_call_type(signal: &SignalMessage) -> CallSignalType {
         // an answer. "Offer" is the generic catch-all.
         SignalMessage::Reflect
         | SignalMessage::ReflectResponse { .. } => CallSignalType::Offer, // control-plane
+        // Phase 4 cross-relay forwarding envelope — strictly a
+        // relay-to-relay message, never rides the featherChat
+        // bridge. Catch-all mapping for completeness.
+        SignalMessage::FederatedSignalForward { .. } => CallSignalType::Offer,
+        SignalMessage::MediaPathReport { .. } => CallSignalType::Offer, // control-plane
+        SignalMessage::CandidateUpdate { .. } => CallSignalType::IceCandidate, // mid-call re-gather
+        SignalMessage::HardNatProbe { .. } => CallSignalType::IceCandidate, // hard NAT coordination
+        SignalMessage::HardNatBirthdayStart { .. } => CallSignalType::IceCandidate, // birthday attack
+        SignalMessage::UpgradeProposal { .. }
+        | SignalMessage::UpgradeResponse { .. }
+        | SignalMessage::UpgradeConfirm { .. }
+        | SignalMessage::QualityCapability { .. } => CallSignalType::Offer, // quality negotiation
+        SignalMessage::PresenceList { .. } => CallSignalType::Offer, // lobby presence
+        SignalMessage::QualityDirective { .. } => CallSignalType::Offer, // relay-initiated
     }
 }
 
@@ -165,6 +179,7 @@ mod tests {
 
         let hangup = SignalMessage::Hangup {
             reason: wzp_proto::HangupReason::Normal,
+            call_id: None,
         };
         assert!(matches!(signal_to_call_type(&hangup), CallSignalType::Hangup));
 

crates/wzp-client/src/ice_agent.rs

@@ -0,0 +1,444 @@
+//! Phase 8 (Tailscale-inspired): ICE agent for candidate lifecycle
+//! management and mid-call re-gathering.
+//!
+//! The `IceAgent` owns the state of all candidate discovery
+//! mechanisms (STUN, port mapping, host candidates) and provides:
+//!
+//! - `gather()`: initial candidate gathering during call setup
+//! - `re_gather()`: triggered on network change, produces a
+//!   `CandidateUpdate` to send to the peer
+//! - `apply_peer_update()`: processes peer's candidate updates
+//!
+//! This is NOT a full ICE agent (RFC 8445). It's the Tailscale-style
+//! "gather all candidates, race them all in parallel, pick the
+//! winner" approach, adapted for QUIC transport.
+
+use std::net::SocketAddr;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::time::Duration;
+
+use wzp_proto::SignalMessage;
+
+use crate::dual_path::PeerCandidates;
+use crate::portmap;
+use crate::reflect;
+use crate::stun;
+
+/// All candidates gathered for the local side.
+#[derive(Debug, Clone)]
+pub struct CandidateSet {
+    /// STUN-discovered server-reflexive address.
+    pub reflexive: Option<SocketAddr>,
+    /// LAN host candidates from local interfaces.
+    pub local: Vec<SocketAddr>,
+    /// Port-mapped address from NAT-PMP/PCP/UPnP.
+    pub mapped: Option<SocketAddr>,
+    /// Generation counter (monotonically increasing per call).
+    pub generation: u32,
+}
+
+/// Configuration for the ICE agent.
+#[derive(Debug, Clone)]
+pub struct IceAgentConfig {
+    /// STUN servers to use for reflexive discovery.
+    pub stun_config: stun::StunConfig,
+    /// Whether to attempt port mapping.
+    pub enable_portmap: bool,
+    /// Timeout for each discovery mechanism.
+    pub gather_timeout: Duration,
+    /// The QUIC endpoint's local port (for host candidate pairing).
+    pub local_v4_port: u16,
+    /// Optional IPv6 port.
+    pub local_v6_port: Option<u16>,
+}
+
+impl Default for IceAgentConfig {
+    fn default() -> Self {
+        Self {
+            stun_config: stun::StunConfig::default(),
+            enable_portmap: true,
+            gather_timeout: Duration::from_secs(3),
+            local_v4_port: 0,
+            local_v6_port: None,
+        }
+    }
+}
+
+/// ICE agent managing candidate lifecycle.
+pub struct IceAgent {
+    config: IceAgentConfig,
+    generation: AtomicU32,
+    call_id: String,
+    /// Last-seen peer generation (to filter stale updates).
+    peer_generation: AtomicU32,
+}
+
+impl IceAgent {
+    pub fn new(call_id: String, config: IceAgentConfig) -> Self {
+        Self {
+            config,
+            generation: AtomicU32::new(0),
+            call_id,
+            peer_generation: AtomicU32::new(0),
+        }
+    }
+
+    /// Initial candidate gathering. Runs all discovery mechanisms
+    /// in parallel and returns the full candidate set.
+    pub async fn gather(&self) -> CandidateSet {
+        let generation = self.generation.fetch_add(1, Ordering::Relaxed);
+
+        // Run STUN + port mapping + host candidates in parallel.
+        let stun_fut = stun::discover_reflexive(&self.config.stun_config);
+        let portmap_fut = async {
+            if self.config.enable_portmap && self.config.local_v4_port > 0 {
+                portmap::acquire_port_mapping(self.config.local_v4_port, None)
+                    .await
+                    .ok()
+            } else {
+                None
+            }
+        };
+
+        let (stun_result, portmap_result) = tokio::join!(
+            tokio::time::timeout(self.config.gather_timeout, stun_fut),
+            tokio::time::timeout(self.config.gather_timeout, portmap_fut),
+        );
+
+        let reflexive = stun_result.ok().and_then(|r| r.ok());
+        let mapped = portmap_result
+            .ok()
+            .flatten()
+            .map(|m| m.external_addr);
+        let local = reflect::local_host_candidates(
+            self.config.local_v4_port,
+            self.config.local_v6_port,
+        );
+
+        tracing::info!(
+            generation,
+            reflexive = ?reflexive,
+            mapped = ?mapped,
+            local_count = local.len(),
+            "ice_agent: gathered candidates"
+        );
+
+        CandidateSet {
+            reflexive,
+            local,
+            mapped,
+            generation,
+        }
+    }
+
+    /// Re-gather candidates after a network change. Increments the
+    /// generation counter and returns a `CandidateUpdate` signal
+    /// message to send to the peer.
+    pub async fn re_gather(&self) -> (CandidateSet, SignalMessage) {
+        let candidates = self.gather().await;
+
+        let update = SignalMessage::CandidateUpdate {
+            call_id: self.call_id.clone(),
+            reflexive_addr: candidates.reflexive.map(|a| a.to_string()),
+            local_addrs: candidates.local.iter().map(|a| a.to_string()).collect(),
+            mapped_addr: candidates.mapped.map(|a| a.to_string()),
+            generation: candidates.generation,
+        };
+
+        (candidates, update)
+    }
+
+    /// Process a peer's candidate update. Returns `Some(PeerCandidates)`
+    /// if the update is newer than the last-seen generation, `None`
+    /// if it's stale.
+    pub fn apply_peer_update(
+        &self,
+        update: &SignalMessage,
+    ) -> Option<PeerCandidates> {
+        let (reflexive_addr, local_addrs, mapped_addr, generation) = match update {
+            SignalMessage::CandidateUpdate {
+                reflexive_addr,
+                local_addrs,
+                mapped_addr,
+                generation,
+                ..
+            } => (reflexive_addr, local_addrs, mapped_addr, *generation),
+            _ => return None,
+        };
+
+        // Only accept if newer than last-seen generation.
+        let prev = self.peer_generation.fetch_max(generation, Ordering::AcqRel);
+        if generation <= prev {
+            tracing::debug!(
+                generation,
+                prev,
+                "ice_agent: ignoring stale CandidateUpdate"
+            );
+            return None;
+        }
+
+        let reflexive = reflexive_addr
+            .as_deref()
+            .and_then(|s| s.parse().ok());
+        let local: Vec<SocketAddr> = local_addrs
+            .iter()
+            .filter_map(|s| s.parse().ok())
+            .collect();
+        let mapped = mapped_addr
+            .as_deref()
+            .and_then(|s| s.parse().ok());
+
+        tracing::info!(
+            generation,
+            reflexive = ?reflexive,
+            mapped = ?mapped,
+            local_count = local.len(),
+            "ice_agent: applied peer candidate update"
+        );
+
+        Some(PeerCandidates {
+            reflexive,
+            local,
+            mapped,
+        })
+    }
+
+    /// Get the current generation counter.
+    pub fn generation(&self) -> u32 {
+        self.generation.load(Ordering::Relaxed)
+    }
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn apply_peer_update_rejects_stale() {
+        let agent = IceAgent::new("test-call".into(), IceAgentConfig::default());
+
+        // First update (gen=1) should succeed.
+        let update1 = SignalMessage::CandidateUpdate {
+            call_id: "test-call".into(),
+            reflexive_addr: Some("203.0.113.5:4433".into()),
+            local_addrs: vec!["192.168.1.10:4433".into()],
+            mapped_addr: None,
+            generation: 1,
+        };
+        let result = agent.apply_peer_update(&update1);
+        assert!(result.is_some());
+        let candidates = result.unwrap();
+        assert_eq!(
+            candidates.reflexive,
+            Some("203.0.113.5:4433".parse().unwrap())
+        );
+        assert_eq!(candidates.local.len(), 1);
+
+        // Same generation (gen=1) should be rejected.
+        let update1b = SignalMessage::CandidateUpdate {
+            call_id: "test-call".into(),
+            reflexive_addr: Some("198.51.100.9:4433".into()),
+            local_addrs: vec![],
+            mapped_addr: None,
+            generation: 1,
+        };
+        assert!(agent.apply_peer_update(&update1b).is_none());
+
+        // Older generation (gen=0) should be rejected.
+        let update0 = SignalMessage::CandidateUpdate {
+            call_id: "test-call".into(),
+            reflexive_addr: Some("10.0.0.1:4433".into()),
+            local_addrs: vec![],
+            mapped_addr: None,
+            generation: 0,
+        };
+        assert!(agent.apply_peer_update(&update0).is_none());
+
+        // Newer generation (gen=2) should succeed.
+        let update2 = SignalMessage::CandidateUpdate {
+            call_id: "test-call".into(),
+            reflexive_addr: Some("198.51.100.9:5555".into()),
+            local_addrs: vec![],
+            mapped_addr: Some("203.0.113.5:12345".into()),
+            generation: 2,
+        };
+        let result = agent.apply_peer_update(&update2);
+        assert!(result.is_some());
+        let candidates = result.unwrap();
+        assert_eq!(
+            candidates.reflexive,
+            Some("198.51.100.9:5555".parse().unwrap())
+        );
+        assert_eq!(
+            candidates.mapped,
+            Some("203.0.113.5:12345".parse().unwrap())
+        );
+    }
+
+    #[test]
+    fn apply_wrong_signal_returns_none() {
+        let agent = IceAgent::new("test-call".into(), IceAgentConfig::default());
+        let wrong = SignalMessage::Reflect;
+        assert!(agent.apply_peer_update(&wrong).is_none());
+    }
+
+    #[test]
+    fn generation_increments() {
+        let agent = IceAgent::new("test".into(), IceAgentConfig::default());
+        assert_eq!(agent.generation(), 0);
+        // Simulate what gather() does internally
+        let g1 = agent.generation.fetch_add(1, Ordering::Relaxed);
+        assert_eq!(g1, 0);
+        assert_eq!(agent.generation(), 1);
+        let g2 = agent.generation.fetch_add(1, Ordering::Relaxed);
+        assert_eq!(g2, 1);
+        assert_eq!(agent.generation(), 2);
+    }
+
+    #[test]
+    fn apply_peer_update_parses_all_fields() {
+        let agent = IceAgent::new("test-call".into(), IceAgentConfig::default());
+
+        let update = SignalMessage::CandidateUpdate {
+            call_id: "test-call".into(),
+            reflexive_addr: Some("203.0.113.5:4433".into()),
+            local_addrs: vec![
+                "192.168.1.10:4433".into(),
+                "10.0.0.5:4433".into(),
+            ],
+            mapped_addr: Some("198.51.100.42:12345".into()),
+            generation: 1,
+        };
+
+        let candidates = agent.apply_peer_update(&update).unwrap();
+        assert_eq!(
+            candidates.reflexive,
+            Some("203.0.113.5:4433".parse().unwrap())
+        );
+        assert_eq!(candidates.local.len(), 2);
+        assert_eq!(
+            candidates.local[0],
+            "192.168.1.10:4433".parse::<SocketAddr>().unwrap()
+        );
+        assert_eq!(
+            candidates.mapped,
+            Some("198.51.100.42:12345".parse().unwrap())
+        );
+    }
+
+    #[test]
+    fn apply_peer_update_handles_empty_fields() {
+        let agent = IceAgent::new("test".into(), IceAgentConfig::default());
+
+        let update = SignalMessage::CandidateUpdate {
+            call_id: "test".into(),
+            reflexive_addr: None,
+            local_addrs: vec![],
+            mapped_addr: None,
+            generation: 1,
+        };
+
+        let candidates = agent.apply_peer_update(&update).unwrap();
+        assert!(candidates.reflexive.is_none());
+        assert!(candidates.local.is_empty());
+        assert!(candidates.mapped.is_none());
+    }
+
+    #[test]
+    fn apply_peer_update_skips_unparseable_addrs() {
+        let agent = IceAgent::new("test".into(), IceAgentConfig::default());
+
+        let update = SignalMessage::CandidateUpdate {
+            call_id: "test".into(),
+            reflexive_addr: Some("not-an-addr".into()),
+            local_addrs: vec![
+                "192.168.1.10:4433".into(),
+                "garbage".into(),
+                "10.0.0.5:4433".into(),
+            ],
+            mapped_addr: Some("also-bad".into()),
+            generation: 1,
+        };
+
+        let candidates = agent.apply_peer_update(&update).unwrap();
+        assert!(candidates.reflexive.is_none()); // unparseable
+        assert_eq!(candidates.local.len(), 2); // garbage filtered
+        assert!(candidates.mapped.is_none()); // unparseable
+    }
+
+    #[test]
+    fn default_config_values() {
+        let cfg = IceAgentConfig::default();
+        assert!(cfg.enable_portmap);
+        assert!(cfg.gather_timeout.as_secs() > 0);
+        assert!(!cfg.stun_config.servers.is_empty());
+        assert_eq!(cfg.local_v4_port, 0);
+        assert!(cfg.local_v6_port.is_none());
+    }
+
+    #[tokio::test]
+    async fn gather_returns_candidates_even_with_no_stun() {
+        // With default config (port 0 = no portmap, STUN will timeout
+        // quickly on loopback), gather should still return host candidates.
+        let agent = IceAgent::new("test".into(), IceAgentConfig {
+            stun_config: stun::StunConfig {
+                servers: vec![], // no servers = quick failure
+                timeout: Duration::from_millis(100),
+            },
+            enable_portmap: false,
+            gather_timeout: Duration::from_millis(200),
+            local_v4_port: 12345,
+            local_v6_port: None,
+        });
+
+        let candidates = agent.gather().await;
+        assert_eq!(candidates.generation, 0);
+        // Reflexive should be None (no STUN servers)
+        assert!(candidates.reflexive.is_none());
+        // Mapped should be None (portmap disabled)
+        assert!(candidates.mapped.is_none());
+        // Local candidates depend on the machine's interfaces
+        // but gather() should not panic.
+    }
+
+    #[tokio::test]
+    async fn re_gather_produces_signal_message() {
+        let agent = IceAgent::new("call-42".into(), IceAgentConfig {
+            stun_config: stun::StunConfig {
+                servers: vec![],
+                timeout: Duration::from_millis(50),
+            },
+            enable_portmap: false,
+            gather_timeout: Duration::from_millis(100),
+            local_v4_port: 4433,
+            local_v6_port: None,
+        });
+
+        let (candidates, signal) = agent.re_gather().await;
+        assert_eq!(candidates.generation, 0);
+
+        match signal {
+            SignalMessage::CandidateUpdate {
+                call_id,
+                generation,
+                ..
+            } => {
+                assert_eq!(call_id, "call-42");
+                assert_eq!(generation, 0);
+            }
+            _ => panic!("expected CandidateUpdate"),
+        }
+
+        // Second re_gather increments generation
+        let (candidates2, signal2) = agent.re_gather().await;
+        assert_eq!(candidates2.generation, 1);
+        match signal2 {
+            SignalMessage::CandidateUpdate { generation, .. } => {
+                assert_eq!(generation, 1);
+            }
+            _ => panic!("expected CandidateUpdate"),
+        }
+    }
+}

crates/wzp-client/src/lib.rs

@@ -32,7 +32,15 @@ pub mod drift_test;
 pub mod echo_test;
 pub mod featherchat;
 pub mod handshake;
+pub mod dual_path;
 pub mod metrics;
+pub mod birthday;
+pub mod ice_agent;
+pub mod netcheck;
+pub mod portmap;
+pub mod reflect;
+pub mod relay_map;
+pub mod stun;
 pub mod sweep;
 
 // AudioPlayback: three possible backends depending on feature flags.

crates/wzp-client/src/netcheck.rs

@@ -0,0 +1,524 @@
+//! Phase 8 (Tailscale-inspired): Comprehensive network diagnostic.
+//!
+//! Probes STUN servers, relay infrastructure, port mapping
+//! capabilities, IPv6 reachability, and NAT hairpinning in parallel
+//! to produce a `NetcheckReport` that captures the client's network
+//! environment at a point in time.
+//!
+//! Used for:
+//! - Troubleshooting connectivity issues
+//! - Automatic relay selection (Phase 5)
+//! - Pre-call NAT assessment
+//! - Quality prediction
+
+use std::net::SocketAddr;
+use std::time::{Duration, Instant};
+
+use serde::Serialize;
+
+use crate::portmap::{self, PortMapProtocol};
+use crate::reflect::{self, NatType};
+use crate::stun::{self, StunConfig};
+
+/// Complete network diagnostic report.
+#[derive(Debug, Clone, Serialize)]
+pub struct NetcheckReport {
+    /// NAT type classification (from combined STUN + relay probes).
+    pub nat_type: NatType,
+    /// Server-reflexive address (consensus from probes).
+    pub reflexive_addr: Option<String>,
+    /// Whether IPv4 connectivity is available.
+    pub ipv4_reachable: bool,
+    /// Whether IPv6 connectivity is available.
+    pub ipv6_reachable: bool,
+    /// Whether the NAT supports hairpinning (loopback to own
+    /// reflexive address).
+    pub hairpin_works: Option<bool>,
+    /// Which port mapping protocol is available (if any).
+    pub port_mapping: Option<PortMapProtocol>,
+    /// Per-relay latency measurements.
+    pub relay_latencies: Vec<RelayLatency>,
+    /// Preferred relay (lowest latency).
+    pub preferred_relay: Option<String>,
+    /// STUN latency to first responding server (ms).
+    pub stun_latency_ms: Option<u32>,
+    /// Whether UPnP is available on the gateway.
+    pub upnp_available: bool,
+    /// Whether PCP is available on the gateway.
+    pub pcp_available: bool,
+    /// Whether NAT-PMP is available on the gateway.
+    pub nat_pmp_available: bool,
+    /// Default gateway address.
+    pub gateway: Option<String>,
+    /// Total time taken for the diagnostic (ms).
+    pub duration_ms: u32,
+    /// Individual STUN probe results.
+    pub stun_probes: Vec<reflect::NatProbeResult>,
+    /// NAT port allocation pattern (sequential vs random).
+    pub port_allocation: Option<stun::PortAllocation>,
+}
+
+/// Latency to a specific relay.
+#[derive(Debug, Clone, Serialize)]
+pub struct RelayLatency {
+    pub name: String,
+    pub addr: String,
+    pub rtt_ms: Option<u32>,
+    pub error: Option<String>,
+}
+
+/// Configuration for the netcheck run.
+#[derive(Debug, Clone)]
+pub struct NetcheckConfig {
+    /// STUN servers to probe.
+    pub stun_config: StunConfig,
+    /// Relay servers to probe (name, address pairs).
+    pub relays: Vec<(String, SocketAddr)>,
+    /// Per-probe timeout.
+    pub timeout: Duration,
+    /// Whether to test port mapping.
+    pub test_portmap: bool,
+    /// Whether to test IPv6.
+    pub test_ipv6: bool,
+    /// Local port for port mapping test (0 = skip).
+    pub local_port: u16,
+}
+
+impl Default for NetcheckConfig {
+    fn default() -> Self {
+        Self {
+            stun_config: StunConfig::default(),
+            relays: Vec::new(),
+            timeout: Duration::from_secs(5),
+            test_portmap: true,
+            test_ipv6: true,
+            local_port: 0,
+        }
+    }
+}
+
+/// Run a comprehensive network diagnostic.
+///
+/// Probes run in parallel for speed — the total time is bounded
+/// by the slowest individual probe, not the sum.
+pub async fn run_netcheck(config: &NetcheckConfig) -> NetcheckReport {
+    let start = Instant::now();
+
+    // Run all probes in parallel.
+    let stun_fut = stun::probe_stun_servers(&config.stun_config);
+    let relay_fut = probe_relays(&config.relays, config.timeout);
+    let portmap_fut = probe_portmap(config.test_portmap, config.local_port);
+    let gateway_fut = portmap::default_gateway();
+    let ipv6_fut = test_ipv6(config.test_ipv6, config.timeout);
+    let port_alloc_fut = stun::detect_port_allocation(&config.stun_config);
+
+    let (stun_probes, relay_latencies, portmap_result, gateway_result, ipv6_reachable, port_alloc_result) =
+        tokio::join!(stun_fut, relay_fut, portmap_fut, gateway_result_fut(gateway_fut), ipv6_fut, port_alloc_fut);
+
+    // Classify NAT from STUN probes.
+    let (nat_type, consensus_addr) = reflect::classify_nat(&stun_probes);
+
+    // Determine STUN latency (first successful probe).
+    let stun_latency_ms = stun_probes
+        .iter()
+        .filter_map(|p| p.latency_ms)
+        .min();
+
+    // IPv4 reachable if any STUN probe succeeded.
+    let ipv4_reachable = stun_probes
+        .iter()
+        .any(|p| p.observed_addr.is_some());
+
+    // Preferred relay = lowest RTT.
+    let preferred_relay = relay_latencies
+        .iter()
+        .filter_map(|r| r.rtt_ms.map(|rtt| (r.name.clone(), rtt)))
+        .min_by_key(|(_, rtt)| *rtt)
+        .map(|(name, _)| name);
+
+    // Port mapping availability.
+    let (port_mapping, nat_pmp_available, pcp_available, upnp_available) = match portmap_result {
+        Some(mapping) => {
+            let proto = mapping.protocol;
+            (
+                Some(proto),
+                proto == PortMapProtocol::NatPmp,
+                proto == PortMapProtocol::Pcp,
+                proto == PortMapProtocol::UPnP,
+            )
+        }
+        None => (None, false, false, false),
+    };
+
+    let gateway = match gateway_result {
+        Ok(gw) => Some(gw.to_string()),
+        Err(_) => None,
+    };
+
+    NetcheckReport {
+        nat_type,
+        reflexive_addr: consensus_addr,
+        ipv4_reachable,
+        ipv6_reachable,
+        hairpin_works: None, // TODO: implement hairpin test
+        port_mapping,
+        relay_latencies,
+        preferred_relay,
+        stun_latency_ms,
+        upnp_available,
+        pcp_available,
+        nat_pmp_available,
+        gateway,
+        duration_ms: start.elapsed().as_millis() as u32,
+        stun_probes,
+        port_allocation: Some(port_alloc_result.allocation),
+    }
+}
+
+/// Probe relay latencies via reflect.
+async fn probe_relays(
+    relays: &[(String, SocketAddr)],
+    timeout: Duration,
+) -> Vec<RelayLatency> {
+    if relays.is_empty() {
+        return Vec::new();
+    }
+
+    let timeout_ms = timeout.as_millis() as u64;
+    let mut set = tokio::task::JoinSet::new();
+
+    for (name, addr) in relays {
+        let name = name.clone();
+        let addr = *addr;
+        set.spawn(async move {
+            let start = Instant::now();
+            match reflect::probe_reflect_addr(addr, timeout_ms, None).await {
+                Ok((_observed, _latency)) => RelayLatency {
+                    name,
+                    addr: addr.to_string(),
+                    rtt_ms: Some(start.elapsed().as_millis() as u32),
+                    error: None,
+                },
+                Err(e) => RelayLatency {
+                    name,
+                    addr: addr.to_string(),
+                    rtt_ms: None,
+                    error: Some(e),
+                },
+            }
+        });
+    }
+
+    let mut results = Vec::with_capacity(relays.len());
+    while let Some(join_result) = set.join_next().await {
+        match join_result {
+            Ok(r) => results.push(r),
+            Err(_) => {}
+        }
+    }
+
+    // Sort by RTT (lowest first).
+    results.sort_by_key(|r| r.rtt_ms.unwrap_or(u32::MAX));
+    results
+}
+
+/// Attempt port mapping and return the mapping if successful.
+async fn probe_portmap(
+    enabled: bool,
+    local_port: u16,
+) -> Option<portmap::PortMapping> {
+    if !enabled || local_port == 0 {
+        return None;
+    }
+    portmap::acquire_port_mapping(local_port, None).await.ok()
+}
+
+/// Wrap the gateway future to handle the Result.
+async fn gateway_result_fut(
+    fut: impl std::future::Future<Output = Result<std::net::Ipv4Addr, portmap::PortMapError>>,
+) -> Result<std::net::Ipv4Addr, portmap::PortMapError> {
+    fut.await
+}
+
+/// Test IPv6 connectivity by attempting to bind and send on an IPv6 socket.
+async fn test_ipv6(enabled: bool, timeout: Duration) -> bool {
+    if !enabled {
+        return false;
+    }
+
+    // Try to resolve and connect to an IPv6 STUN server.
+    let result = tokio::time::timeout(timeout, async {
+        let sock = tokio::net::UdpSocket::bind("[::]:0").await.ok()?;
+        // Try Google's IPv6 STUN — if DNS resolves to an AAAA record
+        // and we can send a packet, IPv6 is working.
+        let addr = stun::resolve_stun_server("stun.l.google.com:19302").await.ok()?;
+        if addr.is_ipv6() {
+            sock.send_to(&[0u8; 1], addr).await.ok()?;
+            Some(true)
+        } else {
+            // Server resolved to IPv4 — try binding to [::] at least
+            Some(false)
+        }
+    })
+    .await;
+
+    match result {
+        Ok(Some(true)) => true,
+        _ => {
+            // Fallback: can we at least bind an IPv6 socket?
+            tokio::net::UdpSocket::bind("[::]:0").await.is_ok()
+        }
+    }
+}
+
+/// Format a netcheck report as a human-readable string.
+pub fn format_report(report: &NetcheckReport) -> String {
+    let mut out = String::new();
+
+    out.push_str(&format!("=== WarzonePhone Netcheck ===\n\n"));
+    out.push_str(&format!(
+        "NAT Type:       {:?}\n",
+        report.nat_type
+    ));
+    out.push_str(&format!(
+        "Reflexive Addr: {}\n",
+        report.reflexive_addr.as_deref().unwrap_or("(unknown)")
+    ));
+    out.push_str(&format!(
+        "IPv4:           {}\n",
+        if report.ipv4_reachable { "yes" } else { "no" }
+    ));
+    out.push_str(&format!(
+        "IPv6:           {}\n",
+        if report.ipv6_reachable { "yes" } else { "no" }
+    ));
+    out.push_str(&format!(
+        "Gateway:        {}\n",
+        report.gateway.as_deref().unwrap_or("(unknown)")
+    ));
+
+    if let Some(ref alloc) = report.port_allocation {
+        out.push_str(&format!(
+            "Port Alloc:     {alloc}\n"
+        ));
+    }
+
+    out.push_str(&format!("\n--- Port Mapping ---\n"));
+    out.push_str(&format!(
+        "NAT-PMP: {}  PCP: {}  UPnP: {}\n",
+        if report.nat_pmp_available { "yes" } else { "no" },
+        if report.pcp_available { "yes" } else { "no" },
+        if report.upnp_available { "yes" } else { "no" },
+    ));
+    if let Some(proto) = &report.port_mapping {
+        out.push_str(&format!("Active mapping: {:?}\n", proto));
+    }
+
+    if !report.stun_probes.is_empty() {
+        out.push_str(&format!("\n--- STUN Probes ---\n"));
+        for p in &report.stun_probes {
+            out.push_str(&format!(
+                "  {} → {} ({}ms){}\n",
+                p.relay_name,
+                p.observed_addr.as_deref().unwrap_or("failed"),
+                p.latency_ms.map(|ms| ms.to_string()).unwrap_or_else(|| "-".into()),
+                p.error.as_ref().map(|e| format!(" [{e}]")).unwrap_or_default(),
+            ));
+        }
+    }
+
+    if !report.relay_latencies.is_empty() {
+        out.push_str(&format!("\n--- Relay Latencies ---\n"));
+        for r in &report.relay_latencies {
+            out.push_str(&format!(
+                "  {} ({}) → {}ms{}\n",
+                r.name,
+                r.addr,
+                r.rtt_ms.map(|ms| ms.to_string()).unwrap_or_else(|| "-".into()),
+                r.error.as_ref().map(|e| format!(" [{e}]")).unwrap_or_default(),
+            ));
+        }
+        if let Some(ref pref) = report.preferred_relay {
+            out.push_str(&format!("  Preferred: {pref}\n"));
+        }
+    }
+
+    out.push_str(&format!("\nCompleted in {}ms\n", report.duration_ms));
+    out
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_config_has_stun_servers() {
+        let config = NetcheckConfig::default();
+        assert!(!config.stun_config.servers.is_empty());
+    }
+
+    #[test]
+    fn format_report_produces_output() {
+        let report = NetcheckReport {
+            nat_type: NatType::Cone,
+            reflexive_addr: Some("203.0.113.5:4433".into()),
+            ipv4_reachable: true,
+            ipv6_reachable: false,
+            hairpin_works: None,
+            port_mapping: None,
+            relay_latencies: vec![RelayLatency {
+                name: "relay-1".into(),
+                addr: "10.0.0.1:4433".into(),
+                rtt_ms: Some(25),
+                error: None,
+            }],
+            preferred_relay: Some("relay-1".into()),
+            stun_latency_ms: Some(15),
+            upnp_available: false,
+            pcp_available: false,
+            nat_pmp_available: false,
+            gateway: Some("192.168.1.1".into()),
+            duration_ms: 1500,
+            stun_probes: vec![],
+            port_allocation: None,
+        };
+
+        let text = format_report(&report);
+        assert!(text.contains("Cone"));
+        assert!(text.contains("203.0.113.5:4433"));
+        assert!(text.contains("relay-1"));
+        assert!(text.contains("1500ms"));
+    }
+
+    #[test]
+    fn report_serializes_to_json() {
+        let report = NetcheckReport {
+            nat_type: NatType::Cone,
+            reflexive_addr: Some("203.0.113.5:4433".into()),
+            ipv4_reachable: true,
+            ipv6_reachable: false,
+            hairpin_works: None,
+            port_mapping: Some(PortMapProtocol::NatPmp),
+            relay_latencies: vec![],
+            preferred_relay: None,
+            stun_latency_ms: Some(25),
+            upnp_available: false,
+            pcp_available: false,
+            nat_pmp_available: true,
+            gateway: Some("192.168.1.1".into()),
+            duration_ms: 500,
+            stun_probes: vec![],
+            port_allocation: Some(stun::PortAllocation::Sequential { delta: 1 }),
+        };
+        let json = serde_json::to_string(&report).unwrap();
+        assert!(json.contains("Cone"));
+        assert!(json.contains("203.0.113.5:4433"));
+        assert!(json.contains("NatPmp"));
+
+        // Roundtrip
+        let decoded: serde_json::Value = serde_json::from_str(&json).unwrap();
+        assert_eq!(decoded["ipv4_reachable"], true);
+        assert_eq!(decoded["ipv6_reachable"], false);
+        assert_eq!(decoded["stun_latency_ms"], 25);
+    }
+
+    #[test]
+    fn relay_latency_serializes() {
+        let lat = RelayLatency {
+            name: "eu-west".into(),
+            addr: "10.0.0.1:4433".into(),
+            rtt_ms: Some(42),
+            error: None,
+        };
+        let json = serde_json::to_string(&lat).unwrap();
+        assert!(json.contains("eu-west"));
+        assert!(json.contains("42"));
+    }
+
+    #[test]
+    fn format_report_empty_relays() {
+        let report = NetcheckReport {
+            nat_type: NatType::Unknown,
+            reflexive_addr: None,
+            ipv4_reachable: false,
+            ipv6_reachable: false,
+            hairpin_works: None,
+            port_mapping: None,
+            relay_latencies: vec![],
+            preferred_relay: None,
+            stun_latency_ms: None,
+            upnp_available: false,
+            pcp_available: false,
+            nat_pmp_available: false,
+            gateway: None,
+            duration_ms: 100,
+            stun_probes: vec![],
+            port_allocation: None,
+        };
+        let text = format_report(&report);
+        assert!(text.contains("Unknown"));
+        assert!(text.contains("(unknown)")); // reflexive addr
+        assert!(text.contains("100ms"));
+    }
+
+    #[test]
+    fn format_report_with_stun_probes() {
+        let report = NetcheckReport {
+            nat_type: NatType::SymmetricPort,
+            reflexive_addr: None,
+            ipv4_reachable: true,
+            ipv6_reachable: true,
+            hairpin_works: Some(false),
+            port_mapping: Some(PortMapProtocol::UPnP),
+            relay_latencies: vec![
+                RelayLatency {
+                    name: "us-east".into(),
+                    addr: "10.0.0.1:4433".into(),
+                    rtt_ms: Some(15),
+                    error: None,
+                },
+                RelayLatency {
+                    name: "eu-west".into(),
+                    addr: "10.0.0.2:4433".into(),
+                    rtt_ms: None,
+                    error: Some("timeout".into()),
+                },
+            ],
+            preferred_relay: Some("us-east".into()),
+            stun_latency_ms: Some(20),
+            upnp_available: true,
+            pcp_available: false,
+            nat_pmp_available: false,
+            gateway: Some("192.168.0.1".into()),
+            duration_ms: 3000,
+            stun_probes: vec![reflect::NatProbeResult {
+                relay_name: "stun:google".into(),
+                relay_addr: "74.125.250.129:19302".into(),
+                observed_addr: Some("203.0.113.5:12345".into()),
+                latency_ms: Some(20),
+                error: None,
+            }],
+            port_allocation: Some(stun::PortAllocation::Random),
+        };
+        let text = format_report(&report);
+        assert!(text.contains("SymmetricPort"));
+        assert!(text.contains("us-east"));
+        assert!(text.contains("eu-west"));
+        assert!(text.contains("Preferred: us-east"));
+        assert!(text.contains("UPnP: yes"));
+        assert!(text.contains("stun:google"));
+        assert!(text.contains("3000ms"));
+    }
+
+    /// Integration test: run actual netcheck (requires network).
+    #[tokio::test]
+    #[ignore]
+    async fn integration_netcheck() {
+        let config = NetcheckConfig::default();
+        let report = run_netcheck(&config).await;
+        println!("{}", format_report(&report));
+        assert!(report.duration_ms > 0);
+    }
+}

crates/wzp-client/src/reflect.rs

@@ -0,0 +1,713 @@
+//! Multi-relay NAT reflection ("STUN for QUIC" — Phase 2).
+//!
+//! Phase 1 (`SignalMessage::Reflect` / `ReflectResponse`) lets a
+//! client ask a single relay "what source address do you see for
+//! me?". Phase 2 queries N relays in parallel and classifies the
+//! results into a NAT type so the future P2P hole-punching path
+//! can decide whether a direct QUIC handshake is viable:
+//!
+//! - All relays return the same `(ip, port)` → **Cone NAT**.
+//!   Endpoint-independent mapping, P2P hole-punching viable,
+//!   `consensus_addr` is the one address to advertise.
+//! - Same ip, different ports → **Symmetric port-dependent NAT**.
+//!   The mapping changes per destination, so the advertised addr
+//!   wouldn't match what a peer actually sees; fall back to
+//!   relay-mediated path.
+//! - Different ips → multi-homed / anycast / broken DNS, treat as
+//!   `Multiple` and do not attempt P2P.
+//! - 0 or 1 successful probes → `Unknown`, not enough data.
+//!
+//! A probe is a throwaway QUIC signal connection: open endpoint,
+//! connect, RegisterPresence (with a zero identity — the relay
+//! accepts this exactly like the main signaling path does), send
+//! Reflect, read ReflectResponse, close. Each probe gets its own
+//! ephemeral quinn::Endpoint so the OS assigns a fresh source port
+//! per relay — if we shared one endpoint across probes, a
+//! symmetric NAT in front of the client would map every probe to
+//! the same port and we couldn't detect it.
+
+use std::net::SocketAddr;
+use std::time::{Duration, Instant};
+
+use serde::Serialize;
+use wzp_proto::{MediaTransport, SignalMessage};
+use wzp_transport::{client_config, create_endpoint, QuinnTransport};
+
+/// Result of one probe against one relay. Always returned so the
+/// UI can render per-relay status even when some fail.
+#[derive(Debug, Clone, Serialize)]
+pub struct NatProbeResult {
+    pub relay_name: String,
+    pub relay_addr: String,
+    /// `Some` on successful probe, `None` on failure.
+    pub observed_addr: Option<String>,
+    /// End-to-end wall-clock from connect start to ReflectResponse
+    /// received, in milliseconds. `Some` only on success.
+    pub latency_ms: Option<u32>,
+    /// Human-readable error on failure.
+    pub error: Option<String>,
+}
+
+/// Aggregated classification over N `NatProbeResult`s.
+#[derive(Debug, Clone, Serialize)]
+pub struct NatDetection {
+    pub probes: Vec<NatProbeResult>,
+    pub nat_type: NatType,
+    /// When `nat_type == Cone`, the one address all probes agreed
+    /// on. `None` for every other case.
+    pub consensus_addr: Option<String>,
+}
+
+/// NAT classification. See module doc for semantics.
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq)]
+pub enum NatType {
+    Cone,
+    SymmetricPort,
+    Multiple,
+    Unknown,
+}
+
+/// Probe a single relay with a QUIC connection.
+///
+/// # Endpoint reuse (Phase 5 — Nebula-style architecture)
+///
+/// If `existing_endpoint` is `Some`, the probe uses that socket
+/// instead of creating a fresh one. This is the desired mode in
+/// production: a port-preserving NAT (MikroTik masquerade, most
+/// consumer routers) gives a **stable** external port for the
+/// one socket, so the reflex addr observed by ANY relay is the
+/// SAME addr and matches what a peer would see on a direct dial.
+/// Pass the signal endpoint here.
+///
+/// If `None`, creates a fresh one-shot endpoint. Kept for:
+/// - tests that spin up isolated probes
+/// - the "I'm not registered yet" case where there's no signal
+///   endpoint to reuse
+///
+/// NOTE on NAT-type detection: the pre-Phase-5 behavior of
+/// forcing a fresh endpoint per probe was wrong — it made every
+/// port-preserving NAT look symmetric because the classifier saw
+/// a different external port for each fresh source port. With
+/// one shared socket, the classifier reflects the REAL NAT
+/// behavior.
+pub async fn probe_reflect_addr(
+    relay: SocketAddr,
+    timeout_ms: u64,
+    existing_endpoint: Option<wzp_transport::Endpoint>,
+) -> Result<(SocketAddr, u32), String> {
+    // Install rustls provider idempotently — a second install on the
+    // same thread is a no-op.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    let endpoint = match existing_endpoint {
+        Some(ep) => ep,
+        None => {
+            let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
+            create_endpoint(bind, None).map_err(|e| format!("endpoint: {e}"))?
+        }
+    };
+
+    let start = Instant::now();
+    let probe = async {
+        // Open the signal connection.
+        let conn =
+            wzp_transport::connect(&endpoint, relay, "_signal", client_config())
+                .await
+                .map_err(|e| format!("connect: {e}"))?;
+        let transport = QuinnTransport::new(conn);
+
+        // The relay signal handler waits for a RegisterPresence
+        // before entering its main dispatch loop (see
+        // wzp-relay/src/main.rs). So a transient probe has to
+        // register with a zero identity first — the relay accepts
+        // the empty-signature form exactly as the main signaling
+        // path does in desktop/src-tauri/src/lib.rs register_signal.
+        transport
+            .send_signal(&SignalMessage::RegisterPresence {
+                identity_pub: [0u8; 32],
+                signature: vec![],
+                alias: None,
+            })
+            .await
+            .map_err(|e| format!("send RegisterPresence: {e}"))?;
+        // Drain the RegisterPresenceAck so the response to our
+        // Reflect doesn't land on an unexpected stream order.
+        match transport.recv_signal().await {
+            Ok(Some(SignalMessage::RegisterPresenceAck { success: true, .. })) => {}
+            Ok(Some(other)) => {
+                return Err(format!(
+                    "unexpected pre-reflect signal: {:?}",
+                    std::mem::discriminant(&other)
+                ));
+            }
+            Ok(None) => return Err("connection closed before RegisterPresenceAck".into()),
+            Err(e) => return Err(format!("recv RegisterPresenceAck: {e}")),
+        }
+
+        // Send Reflect and await response.
+        transport
+            .send_signal(&SignalMessage::Reflect)
+            .await
+            .map_err(|e| format!("send Reflect: {e}"))?;
+
+        match transport.recv_signal().await {
+            Ok(Some(SignalMessage::ReflectResponse { observed_addr })) => {
+                let parsed: SocketAddr = observed_addr
+                    .parse()
+                    .map_err(|e| format!("parse observed_addr {observed_addr:?}: {e}"))?;
+                let latency_ms = start.elapsed().as_millis() as u32;
+
+                // Clean close so the relay's per-connection cleanup
+                // runs promptly and we don't leak file descriptors.
+                let _ = transport.close().await;
+
+                Ok((parsed, latency_ms))
+            }
+            Ok(Some(other)) => Err(format!(
+                "expected ReflectResponse, got {:?}",
+                std::mem::discriminant(&other)
+            )),
+            Ok(None) => Err("connection closed before ReflectResponse".into()),
+            Err(e) => Err(format!("recv ReflectResponse: {e}")),
+        }
+    };
+
+    let out = tokio::time::timeout(Duration::from_millis(timeout_ms), probe)
+        .await
+        .map_err(|_| format!("probe timeout ({timeout_ms}ms)"))??;
+
+    // `endpoint` is a quinn::Endpoint clone — an Arc under the
+    // hood. Letting it drop at end-of-scope is correct whether it
+    // was fresh (last ref → socket closes) or shared (ref count
+    // decrements, socket stays alive for the signal loop).
+    Ok(out)
+}
+
+/// Detect the client's NAT type by probing N relays in parallel and
+/// classifying the returned addresses. Never errors — failing
+/// probes surface via `NatProbeResult.error`; aggregate is always
+/// returned.
+///
+/// # Endpoint reuse (Phase 5)
+///
+/// If `shared_endpoint` is `Some`, every probe reuses it. This is
+/// the PRODUCTION behavior: all probes source from the same UDP
+/// port, so port-preserving NATs map them to the same external
+/// port, and the classifier reflects the real NAT type. Pass the
+/// signal endpoint.
+///
+/// If `None`, each probe creates its own fresh endpoint — useful
+/// in tests that don't have a signal endpoint, but produces
+/// spurious `SymmetricPort` classifications against NATs that
+/// would otherwise look cone-like.
+pub async fn detect_nat_type(
+    relays: Vec<(String, SocketAddr)>,
+    timeout_ms: u64,
+    shared_endpoint: Option<wzp_transport::Endpoint>,
+) -> NatDetection {
+    // Parallel probes via tokio::task::JoinSet so the wall-clock is
+    // bounded by the slowest probe, not the sum. JoinSet keeps the
+    // dep surface at just tokio — we already depend on it.
+    let mut set = tokio::task::JoinSet::new();
+    for (name, addr) in relays {
+        let ep = shared_endpoint.clone();
+        set.spawn(async move {
+            let result = probe_reflect_addr(addr, timeout_ms, ep).await;
+            (name, addr, result)
+        });
+    }
+
+    let mut probes = Vec::new();
+    while let Some(join_result) = set.join_next().await {
+        let (name, addr, result) = match join_result {
+            Ok(tuple) => tuple,
+            // Task panicked — surface as a synthetic failed probe so
+            // the aggregate still returns a reasonable shape. This
+            // shouldn't happen but we don't want one bad probe to
+            // poison the whole detection.
+            Err(join_err) => {
+                probes.push(NatProbeResult {
+                    relay_name: "<panicked>".into(),
+                    relay_addr: "unknown".into(),
+                    observed_addr: None,
+                    latency_ms: None,
+                    error: Some(format!("probe task panicked: {join_err}")),
+                });
+                continue;
+            }
+        };
+        probes.push(match result {
+            Ok((observed, latency_ms)) => NatProbeResult {
+                relay_name: name,
+                relay_addr: addr.to_string(),
+                observed_addr: Some(observed.to_string()),
+                latency_ms: Some(latency_ms),
+                error: None,
+            },
+            Err(e) => NatProbeResult {
+                relay_name: name,
+                relay_addr: addr.to_string(),
+                observed_addr: None,
+                latency_ms: None,
+                error: Some(e),
+            },
+        });
+    }
+
+    let (nat_type, consensus_addr) = classify_nat(&probes);
+    NatDetection {
+        probes,
+        nat_type,
+        consensus_addr,
+    }
+}
+
+/// Enumerate LAN-local host candidates this client is reachable
+/// on, paired with the given port (typically the signal
+/// endpoint's bound port so that incoming dials land on the same
+/// socket the advertised reflex addr points to).
+///
+/// Gathers BOTH IPv4 and IPv6 candidates:
+///
+/// - **IPv4**: RFC1918 private ranges (10/8, 172.16/12, 192.168/16)
+///   and CGNAT shared-transition (100.64/10). Public IPv4 is
+///   skipped because the reflex-addr path already covers it.
+///   Loopback and link-local (169.254/16) are skipped.
+///
+/// - **IPv6**: ALL global-unicast addresses (2000::/3 — the real
+///   routable IPv6 space) AND unique-local (fc00::/7). These
+///   are directly dialable from a peer on the same LAN, and on
+///   true dual-stack LANs (which most consumer ISPs now provide,
+///   including Starlink) IPv6 often gives a direct path even
+///   when IPv4 can't hairpin. Loopback (::1), unspecified (::),
+///   and link-local (fe80::/10) are skipped — link-local would
+///   require a scope ID to be useful and is basically never
+///   reachable across interface boundaries.
+///
+/// The port must come from the caller — typically
+/// `signal_endpoint.local_addr()?.port()`, so that the peer's
+/// dials to these addresses land on the same socket that's
+/// already listening (Phase 5 shared-endpoint architecture).
+///
+/// Safe to call from any thread; no I/O, no async. The `if-addrs`
+/// crate reads the kernel's interface table via a single
+/// getifaddrs(3) syscall.
+pub fn local_host_candidates(v4_port: u16, v6_port: Option<u16>) -> Vec<SocketAddr> {
+    let Ok(ifaces) = if_addrs::get_if_addrs() else {
+        return Vec::new();
+    };
+    let mut out = Vec::new();
+    for iface in ifaces {
+        if iface.is_loopback() {
+            continue;
+        }
+        match iface.ip() {
+            std::net::IpAddr::V4(v4) => {
+                if v4.is_link_local() {
+                    continue;
+                }
+                // Keep RFC1918 private ranges and CGNAT — those
+                // are the LAN-dialable addrs we actually want.
+                // Skip public v4 because the reflex addr already
+                // covers that path.
+                if v4.is_private() {
+                    out.push(SocketAddr::new(std::net::IpAddr::V4(v4), v4_port));
+                } else if v4.octets()[0] == 100 && (v4.octets()[1] & 0xc0) == 0x40 {
+                    // 100.64/10 CGNAT — rare but valid if two
+                    // phones are on the same CGNAT-hairpinned
+                    // carrier LAN (some hotspot setups).
+                    out.push(SocketAddr::new(std::net::IpAddr::V4(v4), v4_port));
+                }
+            }
+            std::net::IpAddr::V6(v6) => {
+                // Phase 7: IPv6 host candidates via dedicated
+                // IPv6 socket. When v6_port is None, no IPv6
+                // endpoint exists — skip silently.
+                let Some(port) = v6_port else { continue };
+                if v6.is_loopback() || v6.is_unspecified() {
+                    continue;
+                }
+                // fe80::/10 link-local — needs scope ID, not
+                // routable across interfaces.
+                if (v6.segments()[0] & 0xffc0) == 0xfe80 {
+                    continue;
+                }
+                // Accept global unicast (2000::/3) and
+                // unique-local (fc00::/7).
+                let first_seg = v6.segments()[0];
+                let is_global = (first_seg & 0xe000) == 0x2000;
+                let is_ula = (first_seg & 0xfe00) == 0xfc00;
+                if is_global || is_ula {
+                    out.push(SocketAddr::new(std::net::IpAddr::V6(v6), port));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// Role assignment for the Phase 3.5 dual-path QUIC race.
+///
+/// Both peers already know two strings at CallSetup time: their
+/// own server-reflexive address (queried via Phase 1 Reflect) and
+/// the peer's (carried in `CallSetup.peer_direct_addr`). To avoid
+/// a negotiation round-trip, both sides compare the two strings
+/// lexicographically and agree on a deterministic role:
+///
+/// - **Acceptor** — lexicographically smaller addr. Listens for
+///   an incoming direct connection from the peer. Does NOT dial.
+/// - **Dialer**   — lexicographically larger addr. Dials the
+///   peer's direct addr. Does NOT listen.
+///
+/// Both roles ALSO dial the relay in parallel as a fallback.
+/// Whichever future (direct or relay) completes first is used as
+/// the media transport. Because the role is deterministic and
+/// symmetric, both peers end up holding the same underlying QUIC
+/// session on the direct path — A's accepted conn and D's dialed
+/// conn are literally the same connection.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Role {
+    /// This peer listens for the direct incoming connection.
+    Acceptor,
+    /// This peer dials the peer's direct address.
+    Dialer,
+}
+
+/// Compute the deterministic role for this peer in the dual-path
+/// race. Returns `None` when no direct attempt is possible —
+/// either peer didn't advertise a reflex addr, or the two addrs
+/// are identical (same host on loopback / mis-advertised).
+///
+/// The caller should treat `None` as "skip direct, relay-only".
+pub fn determine_role(
+    own_reflex_addr: Option<&str>,
+    peer_reflex_addr: Option<&str>,
+) -> Option<Role> {
+    let (own, peer) = match (own_reflex_addr, peer_reflex_addr) {
+        (Some(o), Some(p)) => (o, p),
+        _ => return None,
+    };
+    match own.cmp(peer) {
+        std::cmp::Ordering::Less => Some(Role::Acceptor),
+        std::cmp::Ordering::Greater => Some(Role::Dialer),
+        // Equal addrs should never happen in production (both
+        // peers behind the same NAT mapping + same port would be
+        // a degenerate case). Guard against it so we don't infinite-
+        // loop waiting for a connection to ourselves.
+        std::cmp::Ordering::Equal => None,
+    }
+}
+
+/// Returns `true` if the address is in an RFC1918 / link-local /
+/// loopback range and therefore cannot possibly be a post-NAT
+/// reflex address from the public internet's point of view.
+///
+/// A probe against a relay ON THE SAME LAN as the client will
+/// naturally report the client's LAN IP back (because there's no
+/// NAT between them) — that observation is real but says nothing
+/// about the client's public-internet-facing NAT state. Mixing
+/// LAN reflex addrs with public-internet reflex addrs in
+/// `classify_nat` would always report `Multiple` (different IPs)
+/// and falsely warn about symmetric NAT. Filter them out before
+/// classifying.
+fn is_private_or_loopback(addr: &SocketAddr) -> bool {
+    match addr.ip() {
+        std::net::IpAddr::V4(v4) => {
+            let o = v4.octets();
+            v4.is_loopback()
+                || v4.is_private() // 10/8, 172.16/12, 192.168/16
+                || v4.is_link_local() // 169.254/16
+                || (o[0] == 100 && (o[1] & 0xc0) == 0x40) // 100.64/10 CGNAT shared
+        }
+        std::net::IpAddr::V6(v6) => {
+            v6.is_loopback() || v6.is_unspecified() || (v6.segments()[0] & 0xffc0) == 0xfe80 // fe80::/10 link-local
+        }
+    }
+}
+
+/// Pure-function NAT classifier — split out for unit testing
+/// without touching the network.
+///
+/// Only considers probes whose reflex addr is a **public-internet**
+/// address. LAN / private / loopback reflex addrs are dropped
+/// because they reflect the same-network path rather than the
+/// real NAT state. CGNAT (100.64/10) is also treated as private
+/// because the post-CGNAT address would be what we actually want
+/// to classify on — but CGNAT is unreachable from outside the
+/// carrier, so a relay seeing the CGNAT addr is on the same
+/// carrier network and again not useful for classification.
+pub fn classify_nat(probes: &[NatProbeResult]) -> (NatType, Option<String>) {
+    // First: parse every successful probe's observed addr.
+    let parsed: Vec<SocketAddr> = probes
+        .iter()
+        .filter_map(|p| p.observed_addr.as_deref().and_then(|s| s.parse().ok()))
+        .collect();
+
+    // Then: drop LAN / private / loopback reflex addrs. Those are
+    // legitimate observations by same-network relays, but they
+    // don't contribute to NAT-type classification because the
+    // client's real public-facing NAT mapping is not involved on
+    // that path. A relay on the same LAN always sees the client's
+    // LAN IP, regardless of whether the NAT beyond it is cone or
+    // symmetric.
+    let successes: Vec<SocketAddr> = parsed
+        .into_iter()
+        .filter(|a| !is_private_or_loopback(a))
+        .collect();
+
+    if successes.len() < 2 {
+        return (NatType::Unknown, None);
+    }
+
+    let first = successes[0];
+    let same_ip = successes.iter().all(|a| a.ip() == first.ip());
+    if !same_ip {
+        return (NatType::Multiple, None);
+    }
+
+    let same_port = successes.iter().all(|a| a.port() == first.port());
+    if same_port {
+        (NatType::Cone, Some(first.to_string()))
+    } else {
+        (NatType::SymmetricPort, None)
+    }
+}
+
+/// Enhanced NAT detection that combines relay-based reflection with
+/// public STUN server probes for more robust classification.
+///
+/// Runs both probe sets concurrently:
+/// 1. Relay probes via `detect_nat_type` (existing behavior)
+/// 2. Public STUN probes via `probe_stun_servers`
+///
+/// Merges all results and classifies. More probes = higher confidence
+/// in the NAT type classification. Falls back gracefully: if STUN
+/// servers are unreachable, relay probes still work (and vice versa).
+pub async fn detect_nat_type_with_stun(
+    relays: Vec<(String, SocketAddr)>,
+    timeout_ms: u64,
+    shared_endpoint: Option<wzp_transport::Endpoint>,
+    stun_config: &crate::stun::StunConfig,
+) -> NatDetection {
+    // Run relay probes and STUN probes concurrently.
+    let relay_fut = detect_nat_type(relays, timeout_ms, shared_endpoint);
+    let stun_fut = crate::stun::probe_stun_servers(stun_config);
+
+    let (relay_detection, stun_probes) = tokio::join!(relay_fut, stun_fut);
+
+    // Merge all probes and re-classify.
+    let mut all_probes = relay_detection.probes;
+    all_probes.extend(stun_probes);
+
+    let (nat_type, consensus_addr) = classify_nat(&all_probes);
+    NatDetection {
+        probes: all_probes,
+        nat_type,
+        consensus_addr,
+    }
+}
+
+// ── Unit tests for the pure classifier ───────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mk(addr: Option<&str>) -> NatProbeResult {
+        NatProbeResult {
+            relay_name: "test".into(),
+            relay_addr: "0.0.0.0:0".into(),
+            observed_addr: addr.map(|s| s.to_string()),
+            latency_ms: addr.map(|_| 10),
+            error: None,
+        }
+    }
+
+    #[test]
+    fn classify_empty_is_unknown() {
+        let (nt, addr) = classify_nat(&[]);
+        assert_eq!(nt, NatType::Unknown);
+        assert!(addr.is_none());
+    }
+
+    #[test]
+    fn classify_single_success_is_unknown() {
+        let probes = vec![mk(Some("192.0.2.1:4433"))];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Unknown);
+        assert!(addr.is_none());
+    }
+
+    #[test]
+    fn classify_two_identical_is_cone() {
+        let probes = vec![
+            mk(Some("192.0.2.1:4433")),
+            mk(Some("192.0.2.1:4433")),
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Cone);
+        assert_eq!(addr.as_deref(), Some("192.0.2.1:4433"));
+    }
+
+    #[test]
+    fn classify_same_ip_different_ports_is_symmetric() {
+        let probes = vec![
+            mk(Some("192.0.2.1:4433")),
+            mk(Some("192.0.2.1:51234")),
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::SymmetricPort);
+        assert!(addr.is_none());
+    }
+
+    #[test]
+    fn classify_different_ips_is_multiple() {
+        let probes = vec![
+            mk(Some("192.0.2.1:4433")),
+            mk(Some("198.51.100.9:4433")),
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Multiple);
+        assert!(addr.is_none());
+    }
+
+    #[test]
+    fn classify_drops_private_ip_probes() {
+        // One LAN probe + one public probe should behave like a
+        // single public probe — i.e. Unknown (not enough data to
+        // classify). This is the common real-world case: the user
+        // has a LAN relay + an internet relay configured, the LAN
+        // relay sees the LAN IP, the internet relay sees the WAN
+        // IP, and the old classifier would flag "Multiple" and
+        // falsely warn about symmetric NAT.
+        let probes = vec![
+            mk(Some("192.168.1.100:4433")), // LAN — must be dropped
+            mk(Some("203.0.113.5:4433")),   // public (TEST-NET-3)
+        ];
+        let (nt, _) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Unknown);
+    }
+
+    #[test]
+    fn classify_drops_loopback_probes() {
+        let probes = vec![
+            mk(Some("127.0.0.1:4433")),     // loopback — must be dropped
+            mk(Some("203.0.113.5:4433")),   // public
+            mk(Some("203.0.113.5:4433")),   // public, same addr
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        // Two public probes with identical addrs → Cone.
+        assert_eq!(nt, NatType::Cone);
+        assert_eq!(addr.as_deref(), Some("203.0.113.5:4433"));
+    }
+
+    #[test]
+    fn classify_drops_cgnat_probes() {
+        // 100.64.0.0/10 is the CGNAT shared-transition range.
+        // Filter treats it like RFC1918 — a relay that sees the
+        // client with a 100.64/10 addr is on the same CGNAT
+        // network and can't contribute to public NAT classification.
+        let probes = vec![
+            mk(Some("100.64.0.42:4433")),   // CGNAT — dropped
+            mk(Some("203.0.113.5:4433")),   // public
+            mk(Some("203.0.113.5:12345")),  // public, different port
+        ];
+        let (nt, _) = classify_nat(&probes);
+        // Two public probes same IP different port → SymmetricPort.
+        assert_eq!(nt, NatType::SymmetricPort);
+    }
+
+    #[test]
+    fn classify_two_lan_probes_is_unknown_not_cone() {
+        // Even if both probes come back from LAN relays, we can't
+        // say anything useful about the public NAT state. Unknown,
+        // not Cone.
+        let probes = vec![
+            mk(Some("192.168.1.100:4433")),
+            mk(Some("192.168.1.100:4433")),
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Unknown);
+        assert!(addr.is_none());
+    }
+
+    #[test]
+    fn classify_mix_of_success_and_failure() {
+        let probes = vec![
+            mk(Some("192.0.2.1:4433")),
+            mk(None), // failed probe
+            mk(Some("192.0.2.1:4433")),
+        ];
+        let (nt, addr) = classify_nat(&probes);
+        // Two successes both agree → Cone, ignore the failure row.
+        assert_eq!(nt, NatType::Cone);
+        assert_eq!(addr.as_deref(), Some("192.0.2.1:4433"));
+    }
+
+    #[test]
+    fn determine_role_smaller_is_acceptor() {
+        // Lexicographic: "192.0.2.1:4433" < "198.51.100.9:4433"
+        assert_eq!(
+            determine_role(Some("192.0.2.1:4433"), Some("198.51.100.9:4433")),
+            Some(Role::Acceptor)
+        );
+    }
+
+    #[test]
+    fn determine_role_larger_is_dialer() {
+        assert_eq!(
+            determine_role(Some("198.51.100.9:4433"), Some("192.0.2.1:4433")),
+            Some(Role::Dialer)
+        );
+    }
+
+    #[test]
+    fn determine_role_port_difference_matters() {
+        // Same ip, different ports — string compare still works
+        // because "4433" < "54321".
+        assert_eq!(
+            determine_role(Some("127.0.0.1:4433"), Some("127.0.0.1:54321")),
+            Some(Role::Acceptor)
+        );
+        assert_eq!(
+            determine_role(Some("127.0.0.1:54321"), Some("127.0.0.1:4433")),
+            Some(Role::Dialer)
+        );
+    }
+
+    #[test]
+    fn determine_role_equal_addrs_is_none() {
+        assert_eq!(
+            determine_role(Some("192.0.2.1:4433"), Some("192.0.2.1:4433")),
+            None
+        );
+    }
+
+    #[test]
+    fn determine_role_missing_side_is_none() {
+        assert_eq!(determine_role(None, Some("192.0.2.1:4433")), None);
+        assert_eq!(determine_role(Some("192.0.2.1:4433"), None), None);
+        assert_eq!(determine_role(None, None), None);
+    }
+
+    #[test]
+    fn determine_role_is_symmetric_across_peers() {
+        // Both peers compute roles independently; they must end
+        // up with opposite assignments (one Acceptor, one Dialer)
+        // so that each side ends up talking to the other.
+        let a = "192.0.2.1:4433";
+        let b = "198.51.100.9:4433";
+        let alice_role = determine_role(Some(a), Some(b));
+        let bob_role = determine_role(Some(b), Some(a));
+        assert_eq!(alice_role, Some(Role::Acceptor));
+        assert_eq!(bob_role, Some(Role::Dialer));
+    }
+
+    #[test]
+    fn classify_one_success_one_failure_is_unknown() {
+        let probes = vec![mk(Some("192.0.2.1:4433")), mk(None)];
+        let (nt, addr) = classify_nat(&probes);
+        assert_eq!(nt, NatType::Unknown);
+        assert!(addr.is_none());
+    }
+}

crates/wzp-client/src/relay_map.rs

@@ -0,0 +1,339 @@
+//! Phase 8 (Tailscale-inspired): Relay map for automatic relay
+//! selection based on latency.
+//!
+//! Maintains a sorted list of known relays with their measured
+//! latencies. Used during call setup to pick the lowest-latency
+//! relay, and by netcheck to report relay health.
+
+use std::net::SocketAddr;
+use std::time::{Duration, Instant};
+
+use serde::Serialize;
+
+/// A known relay endpoint with measured latency.
+#[derive(Debug, Clone, Serialize)]
+pub struct RelayEntry {
+    /// Human-readable name (e.g., "us-east", "eu-west").
+    pub name: String,
+    /// Relay address.
+    pub addr: SocketAddr,
+    /// Geographic region (from RegisterPresenceAck).
+    pub region: Option<String>,
+    /// Last measured RTT (ms).
+    pub rtt_ms: Option<u32>,
+    /// When the RTT was last measured.
+    #[serde(skip)]
+    pub last_probed: Option<Instant>,
+    /// Whether this relay is currently reachable.
+    pub reachable: bool,
+}
+
+/// Sorted relay map. Entries are ordered by RTT (lowest first).
+#[derive(Debug, Clone, Default)]
+pub struct RelayMap {
+    entries: Vec<RelayEntry>,
+}
+
+impl RelayMap {
+    pub fn new() -> Self {
+        Self {
+            entries: Vec::new(),
+        }
+    }
+
+    /// Add or update a relay entry.
+    pub fn upsert(&mut self, name: &str, addr: SocketAddr, region: Option<String>) {
+        if let Some(entry) = self.entries.iter_mut().find(|e| e.addr == addr) {
+            entry.name = name.to_string();
+            if region.is_some() {
+                entry.region = region;
+            }
+        } else {
+            self.entries.push(RelayEntry {
+                name: name.to_string(),
+                addr,
+                region,
+                rtt_ms: None,
+                last_probed: None,
+                reachable: false,
+            });
+        }
+    }
+
+    /// Update RTT measurement for a relay.
+    pub fn update_rtt(&mut self, addr: SocketAddr, rtt_ms: u32) {
+        if let Some(entry) = self.entries.iter_mut().find(|e| e.addr == addr) {
+            entry.rtt_ms = Some(rtt_ms);
+            entry.last_probed = Some(Instant::now());
+            entry.reachable = true;
+        }
+        self.sort();
+    }
+
+    /// Mark a relay as unreachable.
+    pub fn mark_unreachable(&mut self, addr: SocketAddr) {
+        if let Some(entry) = self.entries.iter_mut().find(|e| e.addr == addr) {
+            entry.reachable = false;
+            entry.last_probed = Some(Instant::now());
+        }
+        self.sort();
+    }
+
+    /// Get the preferred (lowest-latency, reachable) relay.
+    pub fn preferred(&self) -> Option<&RelayEntry> {
+        self.entries
+            .iter()
+            .find(|e| e.reachable && e.rtt_ms.is_some())
+    }
+
+    /// Get all entries, sorted by RTT.
+    pub fn entries(&self) -> &[RelayEntry] {
+        &self.entries
+    }
+
+    /// Populate from a `RegisterPresenceAck.available_relays` list.
+    /// Each entry is "name|addr" format.
+    pub fn populate_from_ack(&mut self, relays: &[String], relay_region: Option<&str>) {
+        for entry_str in relays {
+            if let Some((name, addr_str)) = entry_str.split_once('|') {
+                if let Ok(addr) = addr_str.parse::<SocketAddr>() {
+                    self.upsert(name, addr, None);
+                }
+            }
+        }
+        // If the ack included a region for the current relay, we
+        // could tag it — but we'd need to know which relay we're
+        // connected to. Left for the caller to handle.
+        let _ = relay_region;
+    }
+
+    /// Check if any entry has a stale probe (older than `max_age`).
+    pub fn needs_reprobe(&self, max_age: Duration) -> bool {
+        self.entries.iter().any(|e| {
+            match e.last_probed {
+                None => true,
+                Some(t) => t.elapsed() > max_age,
+            }
+        })
+    }
+
+    /// Get entries that need reprobing.
+    pub fn stale_entries(&self, max_age: Duration) -> Vec<(String, SocketAddr)> {
+        self.entries
+            .iter()
+            .filter(|e| match e.last_probed {
+                None => true,
+                Some(t) => t.elapsed() > max_age,
+            })
+            .map(|e| (e.name.clone(), e.addr))
+            .collect()
+    }
+
+    fn sort(&mut self) {
+        self.entries.sort_by_key(|e| {
+            if e.reachable {
+                e.rtt_ms.unwrap_or(u32::MAX)
+            } else {
+                u32::MAX
+            }
+        });
+    }
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn preferred_returns_lowest_rtt() {
+        let mut map = RelayMap::new();
+        let a1: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        let a2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+        let a3: SocketAddr = "10.0.0.3:4433".parse().unwrap();
+
+        map.upsert("slow", a1, None);
+        map.upsert("fast", a2, None);
+        map.upsert("mid", a3, None);
+
+        map.update_rtt(a1, 200);
+        map.update_rtt(a2, 15);
+        map.update_rtt(a3, 80);
+
+        let pref = map.preferred().unwrap();
+        assert_eq!(pref.addr, a2);
+        assert_eq!(pref.rtt_ms, Some(15));
+    }
+
+    #[test]
+    fn unreachable_not_preferred() {
+        let mut map = RelayMap::new();
+        let a1: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        let a2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+
+        map.upsert("fast-dead", a1, None);
+        map.upsert("slow-alive", a2, None);
+
+        map.update_rtt(a1, 5);
+        map.update_rtt(a2, 200);
+        map.mark_unreachable(a1);
+
+        let pref = map.preferred().unwrap();
+        assert_eq!(pref.addr, a2);
+    }
+
+    #[test]
+    fn populate_from_ack() {
+        let mut map = RelayMap::new();
+        map.populate_from_ack(
+            &[
+                "us-east|203.0.113.5:4433".into(),
+                "eu-west|198.51.100.9:4433".into(),
+            ],
+            Some("us-east"),
+        );
+        assert_eq!(map.entries().len(), 2);
+        assert_eq!(map.entries()[0].name, "us-east");
+        assert_eq!(map.entries()[1].name, "eu-west");
+    }
+
+    #[test]
+    fn upsert_updates_existing() {
+        let mut map = RelayMap::new();
+        let addr: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        map.upsert("old-name", addr, None);
+        map.upsert("new-name", addr, Some("us-west".into()));
+        assert_eq!(map.entries().len(), 1);
+        assert_eq!(map.entries()[0].name, "new-name");
+        assert_eq!(map.entries()[0].region, Some("us-west".into()));
+    }
+
+    #[test]
+    fn upsert_preserves_region_when_none() {
+        let mut map = RelayMap::new();
+        let addr: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        map.upsert("relay", addr, Some("eu-west".into()));
+        map.upsert("relay", addr, None); // region is None
+        // Should keep the original region
+        assert_eq!(map.entries()[0].region, Some("eu-west".into()));
+    }
+
+    #[test]
+    fn preferred_returns_none_on_empty() {
+        let map = RelayMap::new();
+        assert!(map.preferred().is_none());
+    }
+
+    #[test]
+    fn preferred_returns_none_when_all_unreachable() {
+        let mut map = RelayMap::new();
+        let addr: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        map.upsert("relay", addr, None);
+        // Not update_rtt'd, so reachable=false
+        assert!(map.preferred().is_none());
+    }
+
+    #[test]
+    fn needs_reprobe_empty_is_false() {
+        let map = RelayMap::new();
+        // No entries → nothing to reprobe
+        assert!(!map.needs_reprobe(Duration::from_secs(60)));
+    }
+
+    #[test]
+    fn needs_reprobe_never_probed() {
+        let mut map = RelayMap::new();
+        map.upsert("relay", "10.0.0.1:4433".parse().unwrap(), None);
+        assert!(map.needs_reprobe(Duration::from_secs(60)));
+    }
+
+    #[test]
+    fn needs_reprobe_fresh_is_false() {
+        let mut map = RelayMap::new();
+        let addr: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        map.upsert("relay", addr, None);
+        map.update_rtt(addr, 50);
+        // Just probed, so 60s max_age should not trigger
+        assert!(!map.needs_reprobe(Duration::from_secs(60)));
+    }
+
+    #[test]
+    fn stale_entries_returns_unprobed() {
+        let mut map = RelayMap::new();
+        let a1: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        let a2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+        map.upsert("probed", a1, None);
+        map.upsert("stale", a2, None);
+        map.update_rtt(a1, 50);
+
+        let stale = map.stale_entries(Duration::from_secs(60));
+        assert_eq!(stale.len(), 1);
+        assert_eq!(stale[0].1, a2);
+    }
+
+    #[test]
+    fn sort_stability_with_equal_rtt() {
+        let mut map = RelayMap::new();
+        let a1: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        let a2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+        map.upsert("first", a1, None);
+        map.upsert("second", a2, None);
+        map.update_rtt(a1, 50);
+        map.update_rtt(a2, 50);
+
+        // Both have same RTT — sort should be stable (insertion order)
+        assert_eq!(map.entries().len(), 2);
+        // Both are valid preferred relays
+        assert!(map.preferred().is_some());
+    }
+
+    #[test]
+    fn populate_from_ack_skips_malformed() {
+        let mut map = RelayMap::new();
+        map.populate_from_ack(
+            &[
+                "good|10.0.0.1:4433".into(),
+                "no-pipe-separator".into(),
+                "bad-addr|not-a-socket-addr".into(),
+                "also-good|10.0.0.2:4433".into(),
+            ],
+            None,
+        );
+        assert_eq!(map.entries().len(), 2);
+    }
+
+    #[test]
+    fn mark_unreachable_sorts_to_end() {
+        let mut map = RelayMap::new();
+        let a1: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+        let a2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+        map.upsert("fast", a1, None);
+        map.upsert("slow", a2, None);
+        map.update_rtt(a1, 10);
+        map.update_rtt(a2, 200);
+
+        assert_eq!(map.preferred().unwrap().addr, a1);
+
+        map.mark_unreachable(a1);
+        assert_eq!(map.preferred().unwrap().addr, a2);
+    }
+
+    #[test]
+    fn relay_entry_serializes() {
+        let entry = RelayEntry {
+            name: "test".into(),
+            addr: "10.0.0.1:4433".parse().unwrap(),
+            region: Some("us-east".into()),
+            rtt_ms: Some(42),
+            last_probed: Some(Instant::now()),
+            reachable: true,
+        };
+        let json = serde_json::to_string(&entry).unwrap();
+        assert!(json.contains("test"));
+        assert!(json.contains("us-east"));
+        assert!(json.contains("42"));
+        // last_probed is #[serde(skip)]
+        assert!(!json.contains("last_probed"));
+    }
+}

crates/wzp-client/tests/dual_path.rs

@@ -0,0 +1,222 @@
+//! Phase 3.5 integration tests for the dual-path QUIC race.
+//!
+//! The race takes a role (Acceptor or Dialer), a peer_direct_addr,
+//! a relay_addr, and two SNI strings, then returns whichever QUIC
+//! handshake completes first wrapped in a `QuinnTransport`. These
+//! tests validate that:
+//!
+//! 1. On loopback with two real clients playing A + D roles, the
+//!    direct path wins (fewer hops than relay).
+//! 2. When the direct peer is dead (nothing listening) but the
+//!    relay is up, the relay wins within the fallback window.
+//! 3. When both paths are dead, the race errors cleanly rather
+//!    than hanging forever.
+//!
+//! The "relay" in these tests is a minimal mock that just accepts
+//! an incoming QUIC connection and drops it — we don't need any
+//! protocol handling, just a TCP-ish listen-and-accept.
+
+use std::net::{Ipv4Addr, SocketAddr};
+use std::time::Duration;
+
+use wzp_client::dual_path::{race, PeerCandidates, WinningPath};
+use wzp_client::reflect::Role;
+use wzp_transport::{create_endpoint, server_config};
+
+/// Spin up a "relay-ish" mock server on loopback that accepts
+/// incoming QUIC connections and does nothing with them. Used to
+/// give the relay branch of the race a real target to dial.
+/// Returns the bound address + a join handle (kept alive to keep
+/// the endpoint up).
+async fn spawn_mock_relay() -> (SocketAddr, tokio::task::JoinHandle<()>) {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let (sc, _cert_der) = server_config();
+    let bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let ep = create_endpoint(bind, Some(sc)).expect("relay endpoint");
+    let addr = ep.local_addr().expect("local_addr");
+
+    let handle = tokio::spawn(async move {
+        // Accept loop — hold the connection alive for a short
+        // while so the race result isn't killed by the peer
+        // closing before the winning transport is returned.
+        while let Some(incoming) = ep.accept().await {
+            if let Ok(_conn) = incoming.await {
+                tokio::time::sleep(Duration::from_secs(5)).await;
+            }
+        }
+    });
+    (addr, handle)
+}
+
+// -----------------------------------------------------------------------
+// Test 1: direct path wins when both sides are up
+// -----------------------------------------------------------------------
+//
+// Spawn a mock relay, then set up a two-client test where one
+// client plays the Acceptor role and the other plays the Dialer
+// role. The Dialer's `peer_direct_addr` is the Acceptor's listen
+// address. Because the direct path is a single loopback hop and
+// the relay dial also terminates on loopback, both complete
+// essentially instantly — the `biased` tokio::select in race()
+// should pick direct.
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn dual_path_direct_wins_on_loopback() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
+
+    // Acceptor task: run race(Role::Acceptor, peer_addr_placeholder, ...).
+    // Since the acceptor doesn't dial, the peer_direct_addr arg is
+    // unused on the direct branch but we still pass a placeholder
+    // because the API takes one. Use a stub addr that would error
+    // if it were ever dialed — proving the Acceptor really doesn't
+    // reach it.
+    let unused_addr: SocketAddr = "127.0.0.1:2".parse().unwrap();
+
+    // We can't race both sides in the same task because each race
+    // call has its own direct endpoint that needs to talk to the
+    // OTHER side's endpoint. So spawn the Acceptor in a task and
+    // let it expose its listen addr via a oneshot back to the test,
+    // then run the Dialer in the test's main task.
+    //
+    // There's a chicken-and-egg issue: the Acceptor's listen addr
+    // is only known after race() creates its endpoint. To avoid
+    // reaching into race()'s internals, we instead play a slight
+    // trick: create the Acceptor's endpoint ourselves (outside
+    // race()) to learn its addr, spin up an accept loop on it
+    // ourselves, and pass THAT addr as the Dialer's peer addr.
+    // This tests the Dialer->Acceptor handshake end-to-end without
+    // running the full race() on both sides.
+
+    let (sc, _cert_der) = server_config();
+    let acceptor_bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let acceptor_ep = create_endpoint(acceptor_bind, Some(sc)).expect("acceptor ep");
+    let acceptor_listen_addr = acceptor_ep.local_addr().expect("acceptor addr");
+
+    // Drop the external acceptor after the test finishes, not
+    // before — spawn a dedicated accept task.
+    let acceptor_accept_task = tokio::spawn(async move {
+        // Accept one connection and hold it for a while so the
+        // Dialer side can complete its QUIC handshake.
+        if let Some(incoming) = acceptor_ep.accept().await {
+            if let Ok(_conn) = incoming.await {
+                tokio::time::sleep(Duration::from_secs(5)).await;
+            }
+        }
+    });
+
+    // Now run the Dialer in the race — peer_direct_addr = acceptor's
+    // listen addr. The relay is the mock from above. Direct path
+    // should win.
+    let result = race(
+        Role::Dialer,
+        PeerCandidates {
+            reflexive: Some(acceptor_listen_addr),
+            local: Vec::new(),
+            mapped: None,
+        },
+        relay_addr,
+        "test-room".into(),
+        "call-test".into(),
+        None, // own_reflexive: not needed in tests
+        None, // Phase 5: tests use fresh endpoints (no shared signal)
+        None, // Phase 7: no IPv6 endpoint in tests
+    )
+    .await
+    .expect("race must succeed");
+
+    assert!(result.direct_transport.is_some(), "direct transport should be available");
+    assert_eq!(result.local_winner, WinningPath::Direct, "direct should win on loopback");
+
+    // Cancel the acceptor accept task so the test finishes.
+    acceptor_accept_task.abort();
+    // Suppress unused-var warning for the placeholder.
+    let _ = unused_addr;
+}
+
+// -----------------------------------------------------------------------
+// Test 2: relay wins when the direct peer is dead
+// -----------------------------------------------------------------------
+//
+// Dialer role, peer_direct_addr = a port nothing is listening on,
+// relay is the working mock. Direct dial will sit waiting for a
+// QUIC handshake that never comes; the 2s direct timeout kicks in
+// and the relay path wins the fallback.
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn dual_path_relay_wins_when_direct_is_dead() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
+
+    // A port that nothing is listening on — dead direct target.
+    // Port 1 on loopback is almost never bound and UDP packets to
+    // it will be dropped silently, so the QUIC handshake times out.
+    let dead_peer: SocketAddr = "127.0.0.1:1".parse().unwrap();
+
+    let result = race(
+        Role::Dialer,
+        PeerCandidates {
+            reflexive: Some(dead_peer),
+            local: Vec::new(),
+            mapped: None,
+        },
+        relay_addr,
+        "test-room".into(),
+        "call-test".into(),
+        None, // own_reflexive: not needed in tests
+        None, // Phase 5: tests use fresh endpoints (no shared signal)
+        None, // Phase 7: no IPv6 endpoint in tests
+    )
+    .await
+    .expect("race must succeed via relay fallback");
+
+    assert!(result.relay_transport.is_some(), "relay transport should be available");
+    assert_eq!(
+        result.local_winner,
+        WinningPath::Relay,
+        "relay should win when direct dial has nowhere to land"
+    );
+}
+
+// -----------------------------------------------------------------------
+// Test 3: race errors cleanly when both paths are dead
+// -----------------------------------------------------------------------
+//
+// Dialer role, peer_direct_addr = dead, relay_addr = dead.
+// Expected: race returns an Err within ~7s (2s direct timeout +
+// 5s relay timeout fallback).
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn dual_path_errors_cleanly_when_both_paths_dead() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    let dead_peer: SocketAddr = "127.0.0.1:1".parse().unwrap();
+    let dead_relay: SocketAddr = "127.0.0.1:2".parse().unwrap();
+
+    let start = std::time::Instant::now();
+    let result = race(
+        Role::Dialer,
+        PeerCandidates {
+            reflexive: Some(dead_peer),
+            local: Vec::new(),
+            mapped: None,
+        },
+        dead_relay,
+        "test-room".into(),
+        "call-test".into(),
+        None, // own_reflexive: not needed in tests
+        None, // Phase 5: tests use fresh endpoints (no shared signal)
+        None, // Phase 7: no IPv6 endpoint in tests
+    )
+    .await;
+    let elapsed = start.elapsed();
+
+    assert!(result.is_err(), "both-dead must return Err");
+    // Upper bound: direct 2s timeout + relay 5s fallback + small
+    // slack for scheduling. If this blows, something is looping.
+    assert!(
+        elapsed < Duration::from_secs(10),
+        "race took too long to give up: {:?}",
+        elapsed
+    );
+}

crates/wzp-codec/src/adaptive.rs

@@ -116,6 +116,14 @@ impl AudioEncoder for AdaptiveEncoder {
     fn set_dtx(&mut self, enabled: bool) {
         self.opus.set_dtx(enabled);
     }
+
+    fn set_expected_loss(&mut self, loss_pct: u8) {
+        self.opus.set_expected_loss(loss_pct);
+    }
+
+    fn set_dred_duration(&mut self, frames: u8) {
+        self.opus.set_dred_duration(frames);
+    }
 }
 
 // ─── AdaptiveDecoder ─────────────────────────────────────────────────────────

crates/wzp-codec/src/opus_enc.rs

@@ -14,8 +14,9 @@
 //!   networks; short window keeps decoder CPU modest.
 //! - Normal tiers (Opus 16k/24k): 200 ms — balanced baseline covering common
 //!   VoIP loss patterns (20–150 ms bursts from wifi roam, transient congestion).
-//! - Degraded tier (Opus 6k): 500 ms — users on 6k are by definition on a
-//!   bad link; longer DRED buys maximum burst resilience where it matters.
+//! - Degraded tier (Opus 6k): 1040 ms — users on 6k are by definition on a
+//!   bad link; the maximum libopus DRED window buys the best burst resilience
+//!   where it matters. The RDO-VAE naturally degrades quality at longer offsets.
 //!
 //! # Why the 15% packet loss floor
 //!
@@ -78,8 +79,12 @@ pub fn dred_duration_for(codec: CodecId) -> u8 {
         CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 10,
         // Normal tiers — balanced baseline.
         CodecId::Opus16k | CodecId::Opus24k => 20,
-        // Degraded tier — maximum burst resilience.
-        CodecId::Opus6k => 50,
+        // Degraded tier — maximum burst resilience. 104 × 10 ms = 1040 ms,
+        // the highest value libopus 1.5 supports. Users on 6k are on a bad
+        // link by definition; the RDO-VAE naturally degrades quality at longer
+        // offsets, so the extra window costs only ~1-2 kbps additional overhead
+        // while buying substantially better burst resilience (up from 500 ms).
+        CodecId::Opus6k => 104,
         // Non-Opus (Codec2 / CN): DRED is N/A.
         CodecId::Codec2_1200 | CodecId::Codec2_3200 | CodecId::ComfortNoise => 0,
     }
@@ -334,6 +339,14 @@ impl AudioEncoder for OpusEncoder {
     fn set_dtx(&mut self, enabled: bool) {
         let _ = self.inner.set_dtx(enabled);
     }
+
+    fn set_expected_loss(&mut self, loss_pct: u8) {
+        OpusEncoder::set_expected_loss(self, loss_pct);
+    }
+
+    fn set_dred_duration(&mut self, frames: u8) {
+        OpusEncoder::set_dred_duration(self, frames);
+    }
 }
 
 #[cfg(test)]
@@ -389,8 +402,8 @@ mod tests {
     }
 
     #[test]
-    fn dred_duration_for_degraded_tier_is_500ms() {
-        assert_eq!(dred_duration_for(CodecId::Opus6k), 50);
+    fn dred_duration_for_degraded_tier_is_1040ms() {
+        assert_eq!(dred_duration_for(CodecId::Opus6k), 104);
     }
 
     #[test]

crates/wzp-crypto/src/handshake.rs

@@ -18,10 +18,14 @@ use crate::session::ChaChaSession;
 pub struct WarzoneKeyExchange {
     /// Ed25519 signing key (identity).
     signing_key: SigningKey,
-    /// X25519 static secret (derived from seed, used for identity encryption).
+    /// X25519 static secret derived from identity seed. Reserved for future
+    /// use in static-key federation authentication (not used in current
+    /// ephemeral-only handshake protocol).
     #[allow(dead_code)]
     x25519_static_secret: StaticSecret,
-    /// X25519 static public key.
+    /// X25519 static public key derived from identity seed. Reserved for
+    /// future use in static-key federation authentication (not used in
+    /// current ephemeral-only handshake protocol).
     #[allow(dead_code)]
     x25519_static_public: X25519PublicKey,
     /// Ephemeral X25519 secret for the current call (set by generate_ephemeral).

crates/wzp-crypto/tests/featherchat_compat.rs

@@ -199,6 +199,7 @@ fn wzp_answer_round_trips_through_fc_callsignal() {
 fn wzp_hangup_round_trips_through_fc_callsignal() {
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
+        call_id: None,
     };
 
     let payload = wzp_client::featherchat::encode_call_payload(&hangup, None, None);
@@ -302,6 +303,7 @@ fn all_signal_types_map_correctly() {
         (
             wzp_proto::SignalMessage::Hangup {
                 reason: wzp_proto::HangupReason::Normal,
+                call_id: None,
             },
             "Hangup",
         ),

crates/wzp-native/cpp/oboe_bridge.cpp

@@ -8,6 +8,8 @@
 #include <android/log.h>
 #include <cstring>
 #include <atomic>
+#include <chrono>
+#include <thread>
 
 #define LOG_TAG "wzp-oboe"
 #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)
@@ -254,14 +256,28 @@ int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
     oboe::AudioStreamBuilder captureBuilder;
     captureBuilder.setDirection(oboe::Direction::Input)
         ->setPerformanceMode(oboe::PerformanceMode::LowLatency)
-        ->setSharingMode(oboe::SharingMode::Exclusive)
+        ->setSharingMode(oboe::SharingMode::Shared)
         ->setFormat(oboe::AudioFormat::I16)
         ->setChannelCount(config->channel_count)
-        ->setSampleRate(config->sample_rate)
-        ->setFramesPerDataCallback(config->frames_per_burst)
-        ->setInputPreset(oboe::InputPreset::VoiceCommunication)
+        ->setSampleRateConversionQuality(oboe::SampleRateConversionQuality::Best)
         ->setDataCallback(&g_capture_cb);
 
+    if (config->bt_active) {
+        // BT SCO mode: do NOT set sample rate or input preset.
+        // Requesting 48kHz against a BT SCO device fails with
+        // "getInputProfile could not find profile". Letting the system
+        // choose the native rate (8/16kHz) and relying on Oboe's
+        // resampler (SampleRateConversionQuality::Best) to bridge
+        // to our 48kHz ring buffer is the only path that works.
+        // InputPreset::VoiceCommunication can also prevent BT SCO
+        // routing on some devices — skip it for BT.
+        LOGI("capture: BT mode — no sample rate or input preset set");
+    } else {
+        captureBuilder.setSampleRate(config->sample_rate)
+            ->setFramesPerDataCallback(config->frames_per_burst)
+            ->setInputPreset(oboe::InputPreset::VoiceCommunication);
+    }
+
     oboe::Result result = captureBuilder.openStream(g_capture_stream);
     if (result != oboe::Result::OK) {
         LOGE("Failed to open capture stream: %s", oboe::convertToText(result));
@@ -314,14 +330,23 @@ int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
     oboe::AudioStreamBuilder playoutBuilder;
     playoutBuilder.setDirection(oboe::Direction::Output)
         ->setPerformanceMode(oboe::PerformanceMode::LowLatency)
-        ->setSharingMode(oboe::SharingMode::Exclusive)
+        ->setSharingMode(oboe::SharingMode::Shared)
         ->setFormat(oboe::AudioFormat::I16)
         ->setChannelCount(config->channel_count)
-        ->setSampleRate(config->sample_rate)
-        ->setFramesPerDataCallback(config->frames_per_burst)
-        ->setUsage(oboe::Usage::VoiceCommunication)
+        ->setSampleRateConversionQuality(oboe::SampleRateConversionQuality::Best)
         ->setDataCallback(&g_playout_cb);
 
+    if (config->bt_active) {
+        LOGI("playout: BT mode — no sample rate set, using Usage::Media");
+        // Usage::Media instead of VoiceCommunication for BT output
+        // to avoid conflicts with the communication device routing.
+        playoutBuilder.setUsage(oboe::Usage::Media);
+    } else {
+        playoutBuilder.setSampleRate(config->sample_rate)
+            ->setFramesPerDataCallback(config->frames_per_burst)
+            ->setUsage(oboe::Usage::VoiceCommunication);
+    }
+
     result = playoutBuilder.openStream(g_playout_stream);
     if (result != oboe::Result::OK) {
         LOGE("Failed to open playout stream: %s", oboe::convertToText(result));
@@ -365,6 +390,38 @@ int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
         return -5;
     }
 
+    // Log initial stream states right after requestStart() returns.
+    // On well-behaved HALs both will already be Started; on others
+    // (Nothing A059) they may still be in Starting state.
+    LOGI("requestStart returned: capture_state=%d playout_state=%d",
+         (int)g_capture_stream->getState(),
+         (int)g_playout_stream->getState());
+
+    // Poll until both streams report Started state, up to 2s timeout.
+    // Some Android HALs (Nothing A059) delay transitioning from Starting
+    // to Started; proceeding before the transition completes causes the
+    // first capture/playout callbacks to be dropped silently.
+    {
+        auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(2000);
+        int poll_count = 0;
+        while (std::chrono::steady_clock::now() < deadline) {
+            auto cap_state = g_capture_stream->getState();
+            auto play_state = g_playout_stream->getState();
+            if (cap_state == oboe::StreamState::Started &&
+                play_state == oboe::StreamState::Started) {
+                LOGI("both streams Started after %d polls", poll_count);
+                break;
+            }
+            poll_count++;
+            std::this_thread::sleep_for(std::chrono::milliseconds(10));
+        }
+        // Log final state even on timeout (helps diagnose HAL quirks)
+        LOGI("stream states after poll: capture=%d playout=%d (polls=%d)",
+             (int)g_capture_stream->getState(),
+             (int)g_playout_stream->getState(),
+             poll_count);
+    }
+
     LOGI("Oboe started: sr=%d burst=%d ch=%d",
          config->sample_rate, config->frames_per_burst, config->channel_count);
     return 0;

crates/wzp-native/cpp/oboe_bridge.h

@@ -16,6 +16,7 @@ typedef struct {
     int32_t sample_rate;
     int32_t frames_per_burst;
     int32_t channel_count;
+    int32_t bt_active;  /* nonzero = BT SCO mode: skip sample rate + input preset */
 } WzpOboeConfig;
 
 typedef struct {

crates/wzp-native/src/lib.rs

@@ -26,6 +26,11 @@ pub extern "C" fn wzp_native_version() -> i32 {
 
 /// Writes a NUL-terminated string into `out` (capped at `cap`) and
 /// returns bytes written excluding the NUL.
+///
+/// # Safety
+/// `out` must be a valid pointer to at least `cap` contiguous bytes of
+/// writable memory. Passing a null pointer or zero capacity is safe
+/// (returns 0), but a dangling non-null pointer is undefined behaviour.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn wzp_native_hello(out: *mut u8, cap: usize) -> usize {
     const MSG: &[u8] = b"hello from wzp-native\0";
@@ -47,6 +52,10 @@ struct WzpOboeConfig {
     sample_rate: i32,
     frames_per_burst: i32,
     channel_count: i32,
+    /// When nonzero, capture stream skips setSampleRate and setInputPreset
+    /// so the system can route to BT SCO at its native rate (8/16kHz).
+    /// Oboe's SampleRateConversionQuality::Best resamples to 48kHz.
+    bt_active: i32,
 }
 
 #[repr(C)]
@@ -174,6 +183,13 @@ struct AudioBackend {
     started: std::sync::Mutex<bool>,
     /// Per-write logging throttle counter for wzp_native_audio_write_playout.
     playout_write_log_count: std::sync::atomic::AtomicU64,
+    /// Fix A (task #35): the playout ring's read_idx at the last
+    /// check. If audio_write_playout observes read_idx hasn't
+    /// advanced after N writes, the Oboe playout callback has
+    /// stopped firing → restart the streams.
+    playout_last_read_idx: std::sync::atomic::AtomicI32,
+    /// Number of writes since the last read_idx advance.
+    playout_stall_writes: std::sync::atomic::AtomicU32,
 }
 
 static BACKEND: OnceLock<&'static AudioBackend> = OnceLock::new();
@@ -185,6 +201,8 @@ fn backend() -> &'static AudioBackend {
             playout: RingBuffer::new(RING_CAPACITY),
             started: std::sync::Mutex::new(false),
             playout_write_log_count: std::sync::atomic::AtomicU64::new(0),
+            playout_last_read_idx: std::sync::atomic::AtomicI32::new(0),
+            playout_stall_writes: std::sync::atomic::AtomicU32::new(0),
         }))
     })
 }
@@ -195,6 +213,17 @@ fn backend() -> &'static AudioBackend {
 /// Idempotent — calling while already running is a no-op that returns 0.
 #[unsafe(no_mangle)]
 pub extern "C" fn wzp_native_audio_start() -> i32 {
+    audio_start_inner(false)
+}
+
+/// Start Oboe in Bluetooth SCO mode — skips sample rate and input preset
+/// on capture so the system can route to the BT SCO device natively.
+#[unsafe(no_mangle)]
+pub extern "C" fn wzp_native_audio_start_bt() -> i32 {
+    audio_start_inner(true)
+}
+
+fn audio_start_inner(bt: bool) -> i32 {
     let b = backend();
     let mut started = match b.started.lock() {
         Ok(g) => g,
@@ -208,6 +237,7 @@ pub extern "C" fn wzp_native_audio_start() -> i32 {
         sample_rate: 48_000,
         frames_per_burst: FRAME_SAMPLES as i32,
         channel_count: 1,
+        bt_active: if bt { 1 } else { 0 },
     };
     let rings = WzpOboeRings {
         capture_buf: b.capture.buf_ptr(),
@@ -239,9 +269,20 @@ pub extern "C" fn wzp_native_audio_stop() {
     }
 }
 
+/// Number of capture samples available to read without blocking.
+#[unsafe(no_mangle)]
+pub extern "C" fn wzp_native_audio_capture_available() -> usize {
+    backend().capture.available_read()
+}
+
 /// Read captured PCM samples from the capture ring. Returns the number
 /// of `i16` samples actually copied into `out` (may be less than
 /// `out_len` if the ring is empty).
+///
+/// # Safety
+/// `out` must be a valid pointer to `out_len` contiguous `i16` values.
+/// The caller must ensure no other thread writes to the same buffer
+/// concurrently. Passing a null pointer or zero length is safe (returns 0).
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn wzp_native_audio_read_capture(out: *mut i16, out_len: usize) -> usize {
     if out.is_null() || out_len == 0 {
@@ -255,6 +296,12 @@ pub unsafe extern "C" fn wzp_native_audio_read_capture(out: *mut i16, out_len: u
 /// samples actually enqueued (may be less than `in_len` if the ring
 /// is nearly full — in practice the caller should pace to 20 ms
 /// frames and spin briefly if the ring is full).
+///
+/// # Safety
+/// `input` must be a valid pointer to `in_len` contiguous `i16` values
+/// that remain valid for the duration of the call. Passing a null pointer
+/// or zero length is safe (returns 0). The caller must not free or mutate
+/// the buffer while this function is executing.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn wzp_native_audio_write_playout(input: *const i16, in_len: usize) -> usize {
     if input.is_null() || in_len == 0 {
@@ -262,6 +309,77 @@ pub unsafe extern "C" fn wzp_native_audio_write_playout(input: *const i16, in_le
     }
     let slice = unsafe { std::slice::from_raw_parts(input, in_len) };
     let b = backend();
+
+    // Fix A (task #35): detect playout callback stall. If the
+    // playout ring's read_idx hasn't advanced in 50+ writes
+    // (~1 second at 50 writes/sec), the Oboe playout callback
+    // has stopped firing → restart the streams. This is the
+    // self-healing behavior that makes rejoin work: teardown +
+    // rebuild clears whatever HAL state locked up the callback.
+    let current_read_idx = b.playout.read_idx.load(std::sync::atomic::Ordering::Relaxed);
+    let last_read_idx = b.playout_last_read_idx.load(std::sync::atomic::Ordering::Relaxed);
+    if current_read_idx == last_read_idx {
+        let stall = b.playout_stall_writes.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        if stall >= 50 {
+            // Callback hasn't drained anything in ~1 second.
+            // Force a stream restart.
+            unsafe {
+                android_log("playout STALL detected (50 writes, read_idx unchanged) — restarting Oboe streams");
+            }
+            b.playout_stall_writes.store(0, std::sync::atomic::Ordering::Relaxed);
+            // Release the started lock, stop, re-start.
+            // This is the same logic as the Rust-side
+            // audio_stop() + audio_start() but done inline
+            // because we can't call the extern "C" fns
+            // recursively. Just call the C++ side directly.
+            {
+                if let Ok(mut started) = b.started.lock() {
+                    if *started {
+                        unsafe { wzp_oboe_stop() };
+                        *started = false;
+                    }
+                }
+            }
+            // Clear the rings so the restart doesn't read stale data
+            b.playout.write_idx.store(0, std::sync::atomic::Ordering::Relaxed);
+            b.playout.read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
+            b.capture.write_idx.store(0, std::sync::atomic::Ordering::Relaxed);
+            b.capture.read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
+            // Re-start (stall detector — always non-BT mode)
+            let config = WzpOboeConfig {
+                sample_rate: 48_000,
+                frames_per_burst: FRAME_SAMPLES as i32,
+                channel_count: 1,
+                bt_active: 0,
+            };
+            let rings = WzpOboeRings {
+                capture_buf: b.capture.buf_ptr(),
+                capture_capacity: b.capture.capacity as i32,
+                capture_write_idx: b.capture.write_idx_ptr(),
+                capture_read_idx: b.capture.read_idx_ptr(),
+                playout_buf: b.playout.buf_ptr(),
+                playout_capacity: b.playout.capacity as i32,
+                playout_write_idx: b.playout.write_idx_ptr(),
+                playout_read_idx: b.playout.read_idx_ptr(),
+            };
+            let ret = unsafe { wzp_oboe_start(&config, &rings) };
+            if ret == 0 {
+                if let Ok(mut started) = b.started.lock() {
+                    *started = true;
+                }
+                unsafe { android_log("playout restart OK — Oboe streams rebuilt"); }
+            } else {
+                unsafe { android_log(&format!("playout restart FAILED: {ret}")); }
+            }
+            b.playout_last_read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
+            return 0; // caller will retry on next frame
+        }
+    } else {
+        // read_idx advanced — callback is alive, reset counter
+        b.playout_stall_writes.store(0, std::sync::atomic::Ordering::Relaxed);
+        b.playout_last_read_idx.store(current_read_idx, std::sync::atomic::Ordering::Relaxed);
+    }
+
     let before_w = b.playout.write_idx.load(std::sync::atomic::Ordering::Relaxed);
     let before_r = b.playout.read_idx.load(std::sync::atomic::Ordering::Relaxed);
     let written = b.playout.write(slice);

crates/wzp-proto/src/dred_tuner.rs

@@ -0,0 +1,316 @@
+//! Continuous DRED tuning from real-time network metrics.
+//!
+//! Instead of locking DRED duration to 3 discrete quality tiers (100/200/500 ms),
+//! `DredTuner` maps live path quality metrics to a continuous DRED duration and
+//! expected-loss hint, updated every N packets. This makes DRED reactive within
+//! ~200 ms instead of waiting for 3+ consecutive bad quality reports to trigger
+//! a full tier transition.
+//!
+//! The tuner also implements pre-emptive jitter-spike detection ("sawtooth"
+//! prediction): when jitter variance spikes >30% over a 200 ms window — typical
+//! of Starlink satellite handovers — it temporarily boosts DRED to the maximum
+//! allowed for the current codec before packets actually start dropping.
+//!
+//! See also: [`crate::quality`] for discrete tier classification that drives
+//! codec switching. DredTuner operates within a tier, adjusting DRED
+//! parameters continuously based on live network metrics.
+
+use crate::CodecId;
+
+/// Output of a single tuning cycle.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct DredTuning {
+    /// DRED duration in 10 ms frame units (0–104). Passed directly to
+    /// `OpusEncoder::set_dred_duration()`.
+    pub dred_frames: u8,
+    /// Expected packet loss percentage (0–100). Passed to
+    /// `OpusEncoder::set_expected_loss()`. Floored at 15% by the encoder
+    /// itself, but we pass the real value so the encoder can override upward.
+    pub expected_loss_pct: u8,
+}
+
+/// Minimum DRED frames for any Opus codec (matches DRED_LOSS_FLOOR_PCT logic:
+/// at 15% loss, libopus 1.5 emits ~95 ms of DRED, which needs at least 10
+/// frames configured to be useful).
+const MIN_DRED_FRAMES: u8 = 5;
+
+/// Maximum DRED frames libopus supports (104 × 10 ms = 1040 ms).
+const MAX_DRED_FRAMES: u8 = 104;
+
+/// Jitter variance spike ratio that triggers pre-emptive DRED boost.
+const JITTER_SPIKE_RATIO: f32 = 1.3;
+
+/// How many tuning cycles a jitter-spike boost persists (at 25 packets/cycle
+/// and 20 ms/packet, 10 cycles ≈ 5 seconds).
+const SPIKE_BOOST_COOLDOWN_CYCLES: u32 = 10;
+
+/// Maps codec tier to its baseline DRED frames (used when network is healthy).
+fn baseline_dred_frames(codec: CodecId) -> u8 {
+    match codec {
+        CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 10, // 100 ms
+        CodecId::Opus16k | CodecId::Opus24k => 20,                    // 200 ms
+        CodecId::Opus6k => 50,                                         // 500 ms
+        _ => 0,
+    }
+}
+
+/// Maps codec tier to its maximum allowed DRED frames under spike/bad conditions.
+fn max_dred_frames_for(codec: CodecId) -> u8 {
+    match codec {
+        // Studio: cap at 300 ms (don't waste bitrate on good links)
+        CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 30,
+        // Normal: cap at 500 ms
+        CodecId::Opus16k | CodecId::Opus24k => 50,
+        // Degraded: allow full 1040 ms
+        CodecId::Opus6k => MAX_DRED_FRAMES,
+        _ => 0,
+    }
+}
+
+/// Continuous DRED tuner driven by network path metrics.
+pub struct DredTuner {
+    /// Current codec (determines baseline and ceiling).
+    codec: CodecId,
+    /// Last computed tuning output.
+    last_tuning: DredTuning,
+    /// EWMA-smoothed jitter for spike detection (in ms).
+    jitter_ewma: f32,
+    /// Remaining cooldown cycles for a jitter-spike boost.
+    spike_cooldown: u32,
+    /// Whether the tuner has received at least one observation.
+    initialized: bool,
+}
+
+impl DredTuner {
+    /// Create a new tuner for the given codec.
+    pub fn new(codec: CodecId) -> Self {
+        let baseline = baseline_dred_frames(codec);
+        Self {
+            codec,
+            last_tuning: DredTuning {
+                dred_frames: baseline,
+                expected_loss_pct: 15, // match DRED_LOSS_FLOOR_PCT
+            },
+            jitter_ewma: 0.0,
+            spike_cooldown: 0,
+            initialized: false,
+        }
+    }
+
+    /// Update the active codec (e.g. on tier transition). Resets spike state.
+    pub fn set_codec(&mut self, codec: CodecId) {
+        self.codec = codec;
+        self.spike_cooldown = 0;
+    }
+
+    /// Feed network metrics and compute new DRED parameters.
+    ///
+    /// Call this every tuning cycle (e.g. every 25 packets ≈ 500 ms at 20 ms
+    /// frame duration).
+    ///
+    /// - `loss_pct`: observed packet loss (0.0–100.0)
+    /// - `rtt_ms`: smoothed round-trip time
+    /// - `jitter_ms`: current jitter estimate (RTT variance)
+    ///
+    /// Returns `Some(tuning)` if the output changed, `None` if unchanged.
+    pub fn update(&mut self, loss_pct: f32, rtt_ms: u32, jitter_ms: u32) -> Option<DredTuning> {
+        if !self.codec.is_opus() {
+            return None;
+        }
+
+        let baseline = baseline_dred_frames(self.codec);
+        let ceiling = max_dred_frames_for(self.codec);
+
+        // --- Jitter spike detection ---
+        let jitter_f = jitter_ms as f32;
+        if !self.initialized {
+            self.jitter_ewma = jitter_f;
+            self.initialized = true;
+        } else {
+            // Fast-up (alpha=0.3), slow-down (alpha=0.05) asymmetric EWMA
+            let alpha = if jitter_f > self.jitter_ewma { 0.3 } else { 0.05 };
+            self.jitter_ewma = alpha * jitter_f + (1.0 - alpha) * self.jitter_ewma;
+        }
+
+        // Detect spike: instantaneous jitter > EWMA × 1.3
+        if self.jitter_ewma > 1.0 && jitter_f > self.jitter_ewma * JITTER_SPIKE_RATIO {
+            self.spike_cooldown = SPIKE_BOOST_COOLDOWN_CYCLES;
+        }
+
+        // Decrement cooldown
+        if self.spike_cooldown > 0 {
+            self.spike_cooldown -= 1;
+        }
+
+        // --- Compute DRED frames ---
+        let dred_frames = if self.spike_cooldown > 0 {
+            // During spike boost: jump to ceiling
+            ceiling
+        } else {
+            // Continuous mapping: scale linearly between baseline and ceiling
+            // based on loss percentage.
+            //   0% loss → baseline
+            //  40% loss → ceiling
+            let loss_clamped = loss_pct.clamp(0.0, 40.0);
+            let t = loss_clamped / 40.0;
+            let raw = baseline as f32 + t * (ceiling - baseline) as f32;
+            (raw as u8).clamp(MIN_DRED_FRAMES, ceiling)
+        };
+
+        // --- Compute expected loss hint ---
+        // Pass the real loss so the encoder can clamp at its own floor (15%).
+        // For RTT-driven boost: high RTT suggests impending loss, so add a
+        // phantom loss contribution to keep DRED emitting generously.
+        let rtt_loss_phantom = if rtt_ms > 200 {
+            ((rtt_ms - 200) as f32 / 40.0).min(15.0)
+        } else {
+            0.0
+        };
+        let expected_loss = (loss_pct + rtt_loss_phantom).clamp(0.0, 100.0) as u8;
+
+        let tuning = DredTuning {
+            dred_frames,
+            expected_loss_pct: expected_loss,
+        };
+
+        if tuning != self.last_tuning {
+            self.last_tuning = tuning;
+            Some(tuning)
+        } else {
+            None
+        }
+    }
+
+    /// Get the last computed tuning without updating.
+    pub fn current(&self) -> DredTuning {
+        self.last_tuning
+    }
+
+    /// Whether a jitter-spike boost is currently active.
+    pub fn spike_boost_active(&self) -> bool {
+        self.spike_cooldown > 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn baseline_for_opus24k() {
+        let tuner = DredTuner::new(CodecId::Opus24k);
+        assert_eq!(tuner.current().dred_frames, 20); // 200 ms
+    }
+
+    #[test]
+    fn baseline_for_opus6k() {
+        let tuner = DredTuner::new(CodecId::Opus6k);
+        assert_eq!(tuner.current().dred_frames, 50); // 500 ms
+    }
+
+    #[test]
+    fn codec2_returns_none() {
+        let mut tuner = DredTuner::new(CodecId::Codec2_1200);
+        assert!(tuner.update(10.0, 100, 20).is_none());
+    }
+
+    #[test]
+    fn scales_with_loss() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // 0% loss → baseline (20 frames)
+        tuner.update(0.0, 50, 5);
+        assert_eq!(tuner.current().dred_frames, 20);
+
+        // 20% loss → midpoint between 20 and 50 = 35
+        tuner.update(20.0, 50, 5);
+        assert_eq!(tuner.current().dred_frames, 35);
+
+        // 40%+ loss → ceiling (50 frames)
+        tuner.update(40.0, 50, 5);
+        assert_eq!(tuner.current().dred_frames, 50);
+    }
+
+    #[test]
+    fn jitter_spike_triggers_boost() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // Establish baseline jitter
+        for _ in 0..20 {
+            tuner.update(0.0, 50, 10);
+        }
+        assert!(!tuner.spike_boost_active());
+
+        // Spike: jitter jumps to 50 ms (5x the EWMA of ~10)
+        tuner.update(0.0, 50, 50);
+        assert!(tuner.spike_boost_active());
+        // Should be at ceiling (50 frames = 500 ms for Opus24k)
+        assert_eq!(tuner.current().dred_frames, 50);
+    }
+
+    #[test]
+    fn spike_cooldown_decays() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // Establish baseline then spike
+        for _ in 0..20 {
+            tuner.update(0.0, 50, 10);
+        }
+        tuner.update(0.0, 50, 50);
+        assert!(tuner.spike_boost_active());
+
+        // Run through cooldown
+        for _ in 0..SPIKE_BOOST_COOLDOWN_CYCLES {
+            tuner.update(0.0, 50, 10);
+        }
+        assert!(!tuner.spike_boost_active());
+        // Should return to baseline
+        assert_eq!(tuner.current().dred_frames, 20);
+    }
+
+    #[test]
+    fn rtt_phantom_loss() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // High RTT (400ms) with 0% real loss
+        tuner.update(0.0, 400, 10);
+        // Phantom loss = (400-200)/40 = 5
+        assert_eq!(tuner.current().expected_loss_pct, 5);
+    }
+
+    #[test]
+    fn set_codec_resets_spike() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // Trigger spike
+        for _ in 0..20 {
+            tuner.update(0.0, 50, 10);
+        }
+        tuner.update(0.0, 50, 50);
+        assert!(tuner.spike_boost_active());
+
+        // Switch codec — spike should reset
+        tuner.set_codec(CodecId::Opus6k);
+        assert!(!tuner.spike_boost_active());
+    }
+
+    #[test]
+    fn opus6k_reaches_max_1040ms() {
+        let mut tuner = DredTuner::new(CodecId::Opus6k);
+
+        // High loss → should reach 104 frames (1040 ms)
+        tuner.update(40.0, 50, 5);
+        assert_eq!(tuner.current().dred_frames, MAX_DRED_FRAMES);
+    }
+
+    #[test]
+    fn returns_none_when_unchanged() {
+        let mut tuner = DredTuner::new(CodecId::Opus24k);
+
+        // First update always returns Some (initial → computed)
+        let first = tuner.update(0.0, 50, 5);
+        // Same inputs → None
+        let second = tuner.update(0.0, 50, 5);
+        assert!(first.is_some() || second.is_none());
+    }
+}

crates/wzp-proto/src/error.rs

@@ -53,6 +53,15 @@ pub enum TransportError {
     Timeout { ms: u64 },
     #[error("io error: {0}")]
     Io(#[from] std::io::Error),
+    /// Parsed wire bytes successfully but the payload didn't
+    /// deserialize into a known `SignalMessage` variant. Usually
+    /// means the peer is running a newer build with a variant we
+    /// don't know yet. Callers should **log and continue** rather
+    /// than tearing down the connection, so that forward-compat
+    /// additions to `SignalMessage` don't silently kill old
+    /// clients/relays.
+    #[error("signal deserialize: {0}")]
+    Deserialize(String),
     #[error("internal transport error: {0}")]
     Internal(String),
 }

crates/wzp-proto/src/lib.rs

@@ -14,6 +14,7 @@
 
 pub mod bandwidth;
 pub mod codec_id;
+pub mod dred_tuner;
 pub mod error;
 pub mod jitter;
 pub mod packet;
@@ -26,10 +27,11 @@ pub use codec_id::{CodecId, QualityProfile};
 pub use error::*;
 pub use packet::{
     CallAcceptMode, HangupReason, MediaHeader, MediaPacket, MiniFrameContext, MiniHeader,
-    QualityReport, RoomParticipant, SignalMessage, TrunkEntry, TrunkFrame, FRAME_TYPE_FULL,
+    PresenceUser, QualityReport, RoomParticipant, SignalMessage, TrunkEntry, TrunkFrame, FRAME_TYPE_FULL,
     FRAME_TYPE_MINI,
 };
 pub use bandwidth::{BandwidthEstimator, CongestionState};
+pub use dred_tuner::{DredTuner, DredTuning};
 pub use quality::{AdaptiveQualityController, NetworkContext, Tier};
 pub use session::{Session, SessionEvent, SessionState};
 pub use traits::*;

crates/wzp-proto/src/quality.rs

@@ -1,3 +1,5 @@
+//! See also: [`crate::dred_tuner`] for continuous DRED tuning within a tier.
+
 use std::collections::VecDeque;
 use std::time::{Duration, Instant};
 
@@ -6,19 +8,31 @@ use crate::traits::QualityController;
 use crate::QualityProfile;
 
 /// Network quality tier — drives codec and FEC selection.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+///
+/// 5-tier range from studio quality down to catastrophic:
+/// Studio64k > Studio48k > Studio32k > Good > Degraded > Catastrophic
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub enum Tier {
-    /// loss < 10%, RTT < 400ms
-    Good,
-    /// loss 10-40% OR RTT 400-600ms
-    Degraded,
-    /// loss > 40% OR RTT > 600ms
-    Catastrophic,
+    /// loss >= 15% OR RTT >= 200ms — Codec2 1.2k
+    Catastrophic = 0,
+    /// loss < 15% AND RTT < 200ms — Opus 6k
+    Degraded = 1,
+    /// loss < 5% AND RTT < 100ms — Opus 24k
+    Good = 2,
+    /// loss < 2% AND RTT < 80ms — Opus 32k
+    Studio32k = 3,
+    /// loss < 1% AND RTT < 50ms — Opus 48k
+    Studio48k = 4,
+    /// loss < 1% AND RTT < 30ms — Opus 64k
+    Studio64k = 5,
 }
 
 impl Tier {
     pub fn profile(self) -> QualityProfile {
         match self {
+            Self::Studio64k => QualityProfile::STUDIO_64K,
+            Self::Studio48k => QualityProfile::STUDIO_48K,
+            Self::Studio32k => QualityProfile::STUDIO_32K,
             Self::Good => QualityProfile::GOOD,
             Self::Degraded => QualityProfile::DEGRADED,
             Self::Catastrophic => QualityProfile::CATASTROPHIC,
@@ -39,7 +53,7 @@ impl Tier {
             NetworkContext::CellularLte
             | NetworkContext::Cellular5g
             | NetworkContext::Cellular3g => {
-                // Tighter thresholds for cellular networks
+                // Tighter thresholds for cellular — no studio tiers
                 if loss > 25.0 || rtt > 500 {
                     Self::Catastrophic
                 } else if loss > 8.0 || rtt > 300 {
@@ -49,13 +63,18 @@ impl Tier {
                 }
             }
             NetworkContext::WiFi | NetworkContext::Unknown => {
-                // Original thresholds
-                if loss > 40.0 || rtt > 600 {
+                if loss >= 15.0 || rtt >= 200 {
                     Self::Catastrophic
-                } else if loss > 10.0 || rtt > 400 {
+                } else if loss >= 5.0 || rtt >= 100 {
                     Self::Degraded
-                } else {
+                } else if loss >= 2.0 || rtt >= 80 {
                     Self::Good
+                } else if loss >= 1.0 || rtt >= 50 {
+                    Self::Studio32k
+                } else if rtt >= 30 {
+                    Self::Studio48k
+                } else {
+                    Self::Studio64k
                 }
             }
         }
@@ -64,11 +83,19 @@ impl Tier {
     /// Return the next lower (worse) tier, or None if already at the worst.
     pub fn downgrade(self) -> Option<Tier> {
         match self {
+            Self::Studio64k => Some(Self::Studio48k),
+            Self::Studio48k => Some(Self::Studio32k),
+            Self::Studio32k => Some(Self::Good),
             Self::Good => Some(Self::Degraded),
             Self::Degraded => Some(Self::Catastrophic),
             Self::Catastrophic => None,
         }
     }
+
+    /// Whether this is a studio tier (above Good).
+    pub fn is_studio(self) -> bool {
+        matches!(self, Self::Studio64k | Self::Studio48k | Self::Studio32k)
+    }
 }
 
 /// Describes the network transport type for context-aware quality decisions.
@@ -108,20 +135,48 @@ pub struct AdaptiveQualityController {
     fec_boost_until: Option<Instant>,
     /// FEC boost amount to add during handoff recovery window.
     fec_boost_amount: f32,
+    /// Probing state: when Some, we're actively testing a higher tier.
+    probe: Option<ProbeState>,
+    /// Time spent stable at the current tier (for probe trigger).
+    stable_since: Option<Instant>,
 }
 
 /// Threshold for downgrading (fast reaction to degradation).
 const DOWNGRADE_THRESHOLD: u32 = 3;
 /// Threshold for downgrading on cellular networks (even faster).
 const CELLULAR_DOWNGRADE_THRESHOLD: u32 = 2;
-/// Threshold for upgrading (slow, cautious improvement).
-const UPGRADE_THRESHOLD: u32 = 10;
+/// Threshold for upgrading from Catastrophic/Degraded to Good.
+const UPGRADE_THRESHOLD: u32 = 5;
+/// Threshold for upgrading into studio tiers (very conservative).
+const STUDIO_UPGRADE_THRESHOLD: u32 = 10;
 /// Maximum history window size.
 const HISTORY_SIZE: usize = 20;
 /// Default FEC boost amount during handoff recovery.
 const DEFAULT_FEC_BOOST: f32 = 0.2;
 /// Duration of FEC boost after a network handoff.
 const FEC_BOOST_DURATION_SECS: u64 = 10;
+/// Minimum time stable at current tier before probing upward (30 seconds).
+const PROBE_STABLE_SECS: u64 = 30;
+/// Duration of a probe window (5 seconds — ~25 quality reports at 1/s).
+const PROBE_DURATION_SECS: u64 = 5;
+/// Maximum bad reports during probe before aborting (1 out of ~5 = 20%).
+const PROBE_MAX_BAD: u32 = 1;
+/// Cooldown after a failed probe before trying again (60 seconds).
+const PROBE_COOLDOWN_SECS: u64 = 60;
+
+/// Active bandwidth probe state.
+struct ProbeState {
+    /// The tier we're probing (one step above current).
+    target_tier: Tier,
+    /// Profile to apply during probe.
+    target_profile: QualityProfile,
+    /// When the probe started.
+    started: Instant,
+    /// Reports observed during probe.
+    probe_reports: u32,
+    /// Bad reports during probe (loss/RTT exceeded target tier thresholds).
+    bad_reports: u32,
+}
 
 impl AdaptiveQualityController {
     pub fn new() -> Self {
@@ -135,6 +190,8 @@ impl AdaptiveQualityController {
             network_context: NetworkContext::default(),
             fec_boost_until: None,
             fec_boost_amount: DEFAULT_FEC_BOOST,
+            probe: None,
+            stable_since: None,
         }
     }
 
@@ -174,6 +231,10 @@ impl AdaptiveQualityController {
             self.forced = false;
         }
 
+        // Cancel any active probe
+        self.probe = None;
+        self.stable_since = None;
+
         // Activate FEC boost for any network change
         self.fec_boost_until = Some(Instant::now() + Duration::from_secs(FEC_BOOST_DURATION_SECS));
     }
@@ -194,6 +255,8 @@ impl AdaptiveQualityController {
     pub fn reset_counters(&mut self) {
         self.consecutive_up = 0;
         self.consecutive_down = 0;
+        self.probe = None;
+        self.stable_since = None;
     }
 
     /// Get the effective downgrade threshold based on network context.
@@ -213,16 +276,13 @@ impl AdaptiveQualityController {
             return None;
         }
 
-        let is_worse = match (self.current_tier, observed_tier) {
-            (Tier::Good, Tier::Degraded | Tier::Catastrophic) => true,
-            (Tier::Degraded, Tier::Catastrophic) => true,
-            _ => false,
-        };
+        let is_worse = observed_tier < self.current_tier;
 
         if is_worse {
             self.consecutive_up = 0;
             self.consecutive_down += 1;
             if self.consecutive_down >= self.downgrade_threshold() {
+                // Jump directly to the observed tier (don't step one-at-a-time on downgrade)
                 self.current_tier = observed_tier;
                 self.current_profile = observed_tier.profile();
                 self.consecutive_down = 0;
@@ -232,22 +292,115 @@ impl AdaptiveQualityController {
             // Better conditions
             self.consecutive_down = 0;
             self.consecutive_up += 1;
-            if self.consecutive_up >= UPGRADE_THRESHOLD {
+            // Studio tiers require more consecutive good reports
+            let threshold = if self.current_tier >= Tier::Good {
+                STUDIO_UPGRADE_THRESHOLD
+            } else {
+                UPGRADE_THRESHOLD
+            };
+            if self.consecutive_up >= threshold {
                 // Only upgrade one step at a time
-                let next_tier = match self.current_tier {
-                    Tier::Catastrophic => Tier::Degraded,
-                    Tier::Degraded => Tier::Good,
-                    Tier::Good => return None,
-                };
-                self.current_tier = next_tier;
-                self.current_profile = next_tier.profile();
-                self.consecutive_up = 0;
-                return Some(self.current_profile);
+                if let Some(next_tier) = self.upgrade_one_step() {
+                    self.current_tier = next_tier;
+                    self.current_profile = next_tier.profile();
+                    self.consecutive_up = 0;
+                    return Some(self.current_profile);
+                }
             }
         }
 
         None
     }
+
+    /// Check whether to start, continue, or conclude a bandwidth probe.
+    ///
+    /// Called from `observe()` when no hysteresis transition fired.
+    fn check_probe(&mut self, observed_tier: Tier) -> Option<QualityProfile> {
+        // Don't probe if forced, or if already at highest tier, or on cellular
+        if self.forced || self.current_tier == Tier::Studio64k {
+            return None;
+        }
+        if matches!(
+            self.network_context,
+            NetworkContext::CellularLte | NetworkContext::Cellular5g | NetworkContext::Cellular3g
+        ) {
+            return None;
+        }
+
+        // If we have an active probe, evaluate it
+        if let Some(ref mut probe) = self.probe {
+            probe.probe_reports += 1;
+
+            // Check if the observed tier meets the probe target
+            if observed_tier < probe.target_tier {
+                probe.bad_reports += 1;
+            }
+
+            // Probe failed: too many bad reports
+            if probe.bad_reports > PROBE_MAX_BAD {
+                let _failed_probe = self.probe.take();
+                // Reset stable_since to trigger cooldown
+                self.stable_since =
+                    Some(Instant::now() + Duration::from_secs(PROBE_COOLDOWN_SECS));
+                return None; // stay at current tier
+            }
+
+            // Probe succeeded: enough good reports within the window
+            if probe.started.elapsed() >= Duration::from_secs(PROBE_DURATION_SECS) {
+                let target = probe.target_tier;
+                let profile = probe.target_profile;
+                self.probe.take();
+                self.current_tier = target;
+                self.current_profile = profile;
+                self.consecutive_up = 0;
+                self.stable_since = Some(Instant::now());
+                return Some(profile);
+            }
+
+            return None; // probe still running
+        }
+
+        // No active probe — check if we should start one
+        if observed_tier >= self.current_tier {
+            // Track stability
+            if self.stable_since.is_none() {
+                self.stable_since = Some(Instant::now());
+            }
+
+            if let Some(stable_since) = self.stable_since {
+                if stable_since.elapsed() >= Duration::from_secs(PROBE_STABLE_SECS) {
+                    // Stable long enough — start probing
+                    if let Some(next) = self.upgrade_one_step() {
+                        self.probe = Some(ProbeState {
+                            target_tier: next,
+                            target_profile: next.profile(),
+                            started: Instant::now(),
+                            probe_reports: 0,
+                            bad_reports: 0,
+                        });
+                        // Return the probe profile so the encoder switches
+                        return Some(next.profile());
+                    }
+                }
+            }
+        } else {
+            // Conditions degraded — reset stability timer
+            self.stable_since = None;
+        }
+
+        None
+    }
+
+    fn upgrade_one_step(&self) -> Option<Tier> {
+        match self.current_tier {
+            Tier::Catastrophic => Some(Tier::Degraded),
+            Tier::Degraded => Some(Tier::Good),
+            Tier::Good => Some(Tier::Studio32k),
+            Tier::Studio32k => Some(Tier::Studio48k),
+            Tier::Studio48k => Some(Tier::Studio64k),
+            Tier::Studio64k => None,
+        }
+    }
 }
 
 impl Default for AdaptiveQualityController {
@@ -269,7 +422,17 @@ impl QualityController for AdaptiveQualityController {
         }
 
         let observed = Tier::classify_with_context(report, self.network_context);
-        self.try_transition(observed)
+
+        // First check for downgrades/upgrades via hysteresis
+        if let Some(profile) = self.try_transition(observed) {
+            // Cancel any active probe on tier change
+            self.probe.take();
+            self.stable_since = None;
+            return Some(profile);
+        }
+
+        // Then check probing
+        self.check_probe(observed)
     }
 
     fn force_profile(&mut self, profile: QualityProfile) {
@@ -331,25 +494,33 @@ mod tests {
         }
         assert_eq!(ctrl.tier(), Tier::Catastrophic);
 
-        // 9 good reports — not enough
-        let good = make_report(2.0, 100);
-        for _ in 0..9 {
+        // 4 good reports — not enough (threshold is 5)
+        let good = make_report(0.5, 20); // studio-quality report
+        for _ in 0..4 {
             assert!(ctrl.observe(&good).is_none());
         }
         assert_eq!(ctrl.tier(), Tier::Catastrophic);
 
-        // 10th good report triggers upgrade (one step: Catastrophic → Degraded)
+        // 5th good report triggers upgrade (one step: Catastrophic → Degraded)
         let result = ctrl.observe(&good);
         assert!(result.is_some());
         assert_eq!(ctrl.tier(), Tier::Degraded);
 
-        // Need another 10 to go from Degraded → Good
-        for _ in 0..9 {
+        // Another 5 to go from Degraded → Good
+        for _ in 0..4 {
             assert!(ctrl.observe(&good).is_none());
         }
         let result = ctrl.observe(&good);
         assert!(result.is_some());
         assert_eq!(ctrl.tier(), Tier::Good);
+
+        // Studio upgrades need 10 consecutive — Good → Studio32k
+        for _ in 0..9 {
+            assert!(ctrl.observe(&good).is_none());
+        }
+        let result = ctrl.observe(&good);
+        assert!(result.is_some());
+        assert_eq!(ctrl.tier(), Tier::Studio32k);
     }
 
     #[test]
@@ -366,11 +537,29 @@ mod tests {
 
     #[test]
     fn tier_classification() {
-        assert_eq!(Tier::classify(&make_report(5.0, 200)), Tier::Good);
-        assert_eq!(Tier::classify(&make_report(15.0, 200)), Tier::Degraded);
-        assert_eq!(Tier::classify(&make_report(5.0, 500)), Tier::Degraded);
-        assert_eq!(Tier::classify(&make_report(50.0, 200)), Tier::Catastrophic);
-        assert_eq!(Tier::classify(&make_report(5.0, 700)), Tier::Catastrophic);
+        // Studio tiers
+        assert_eq!(Tier::classify(&make_report(0.5, 20)), Tier::Studio64k);
+        assert_eq!(Tier::classify(&make_report(0.5, 40)), Tier::Studio48k);
+        assert_eq!(Tier::classify(&make_report(1.5, 60)), Tier::Studio32k);
+        // Good/Degraded/Catastrophic
+        assert_eq!(Tier::classify(&make_report(3.0, 90)), Tier::Good);
+        assert_eq!(Tier::classify(&make_report(6.0, 120)), Tier::Degraded);
+        assert_eq!(Tier::classify(&make_report(16.0, 120)), Tier::Catastrophic);
+        assert_eq!(Tier::classify(&make_report(5.0, 200)), Tier::Catastrophic);
+    }
+
+    #[test]
+    fn studio_tier_boundaries() {
+        // loss < 1% AND RTT < 30ms → Studio64k
+        assert_eq!(Tier::classify(&make_report(0.9, 28)), Tier::Studio64k);
+        // loss < 1% AND RTT 30-49ms → Studio48k
+        assert_eq!(Tier::classify(&make_report(0.9, 32)), Tier::Studio48k);
+        // loss < 2% AND RTT < 80ms → Studio32k (but loss >= 1%)
+        assert_eq!(Tier::classify(&make_report(1.5, 40)), Tier::Studio32k);
+        // loss >= 2% → Good (use 2.5 to survive u8 quantization)
+        assert_eq!(Tier::classify(&make_report(2.5, 40)), Tier::Good);
+        // RTT 80ms → Good
+        assert_eq!(Tier::classify(&make_report(0.5, 80)), Tier::Good);
     }
 
     // ---------------------------------------------------------------
@@ -379,8 +568,8 @@ mod tests {
 
     #[test]
     fn cellular_tighter_thresholds() {
-        // 12% loss: Good on WiFi, Degraded on cellular
-        let report = make_report(12.0, 200);
+        // 9% loss: Degraded on both WiFi (>=5%) and cellular (>=8%)
+        let report = make_report(9.0, 80);
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::WiFi),
             Tier::Degraded
@@ -390,22 +579,22 @@ mod tests {
             Tier::Degraded
         );
 
-        // 9% loss: Good on WiFi, Degraded on cellular
-        let report = make_report(9.0, 200);
+        // 6% loss, low RTT: Degraded on WiFi (>=5%), Good on cellular (<8%)
+        let report = make_report(6.0, 80);
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::WiFi),
+            Tier::Degraded
+        );
+        assert_eq!(
+            Tier::classify_with_context(&report, NetworkContext::CellularLte),
             Tier::Good
         );
-        assert_eq!(
-            Tier::classify_with_context(&report, NetworkContext::CellularLte),
-            Tier::Degraded
-        );
 
-        // 30% loss: Degraded on WiFi, Catastrophic on cellular
-        let report = make_report(30.0, 200);
+        // 30% loss: Catastrophic on WiFi (>=15%), Catastrophic on cellular (>=25%)
+        let report = make_report(30.0, 80);
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::WiFi),
-            Tier::Degraded
+            Tier::Catastrophic
         );
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::Cellular3g),
@@ -415,15 +604,29 @@ mod tests {
 
     #[test]
     fn cellular_rtt_thresholds() {
-        // RTT 350ms: Good on WiFi, Degraded on cellular
-        let report = make_report(2.0, 348); // rtt_4ms rounds so use 348
+        // RTT 150ms: Degraded on WiFi (>=100ms), Good on cellular (<300ms and loss<8%)
+        let report = make_report(2.0, 148);
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::WiFi),
-            Tier::Good
+            Tier::Degraded
         );
         assert_eq!(
             Tier::classify_with_context(&report, NetworkContext::CellularLte),
-            Tier::Degraded
+            Tier::Good
+        );
+    }
+
+    #[test]
+    fn cellular_no_studio_tiers() {
+        // Even with perfect network, cellular stays at Good (no studio)
+        let report = make_report(0.0, 10);
+        assert_eq!(
+            Tier::classify_with_context(&report, NetworkContext::CellularLte),
+            Tier::Good
+        );
+        assert_eq!(
+            Tier::classify_with_context(&report, NetworkContext::WiFi),
+            Tier::Studio64k
         );
     }
 
@@ -469,6 +672,9 @@ mod tests {
 
     #[test]
     fn tier_downgrade() {
+        assert_eq!(Tier::Studio64k.downgrade(), Some(Tier::Studio48k));
+        assert_eq!(Tier::Studio48k.downgrade(), Some(Tier::Studio32k));
+        assert_eq!(Tier::Studio32k.downgrade(), Some(Tier::Good));
         assert_eq!(Tier::Good.downgrade(), Some(Tier::Degraded));
         assert_eq!(Tier::Degraded.downgrade(), Some(Tier::Catastrophic));
         assert_eq!(Tier::Catastrophic.downgrade(), None);
@@ -478,4 +684,97 @@ mod tests {
     fn network_context_default() {
         assert_eq!(NetworkContext::default(), NetworkContext::Unknown);
     }
+
+    // ---------------------------------------------------------------
+    // Bandwidth probing tests
+    // ---------------------------------------------------------------
+
+    #[test]
+    fn probe_triggers_after_stable_period() {
+        let mut ctrl = AdaptiveQualityController::new();
+        let excellent = make_report(0.3, 20); // would classify as Studio64k
+
+        // Starts at Good. Fast-forward stability by setting stable_since directly.
+        ctrl.stable_since = Some(Instant::now() - Duration::from_secs(31));
+
+        // One excellent report should trigger a probe (Good → Studio32k)
+        let result = ctrl.observe(&excellent);
+        assert!(result.is_some(), "should start probe after 30s stable");
+        assert!(ctrl.probe.is_some(), "probe should be active");
+        assert_eq!(ctrl.probe.as_ref().unwrap().target_tier, Tier::Studio32k);
+    }
+
+    #[test]
+    fn probe_succeeds_after_window() {
+        let mut ctrl = AdaptiveQualityController::new();
+        ctrl.stable_since = Some(Instant::now() - Duration::from_secs(31));
+
+        let excellent = make_report(0.3, 20);
+
+        // Trigger probe start
+        let result = ctrl.observe(&excellent);
+        assert!(result.is_some());
+
+        // Simulate probe window elapsed by backdating started
+        ctrl.probe.as_mut().unwrap().started =
+            Instant::now() - Duration::from_secs(PROBE_DURATION_SECS);
+
+        // Next good report should finalize the probe
+        let result = ctrl.observe(&excellent);
+        assert!(result.is_some(), "probe should succeed");
+        assert_eq!(ctrl.current_tier, Tier::Studio32k);
+        assert!(ctrl.probe.is_none(), "probe should be cleared");
+    }
+
+    #[test]
+    fn probe_fails_on_bad_reports() {
+        let mut ctrl = AdaptiveQualityController::new();
+        // Put controller at Studio32k, pretend we've been stable
+        ctrl.current_tier = Tier::Studio32k;
+        ctrl.current_profile = Tier::Studio32k.profile();
+        ctrl.stable_since = Some(Instant::now() - Duration::from_secs(31));
+
+        // Start a probe to Studio48k
+        let excellent = make_report(0.3, 20);
+        let result = ctrl.observe(&excellent);
+        assert!(result.is_some()); // probe started
+        assert_eq!(ctrl.probe.as_ref().unwrap().target_tier, Tier::Studio48k);
+
+        // Feed bad reports (loss too high for Studio48k)
+        let degraded = make_report(3.0, 100);
+        ctrl.observe(&degraded); // first bad
+        ctrl.observe(&degraded); // second bad — exceeds PROBE_MAX_BAD (1)
+
+        // Probe should be cancelled
+        assert!(ctrl.probe.is_none(), "probe should be cancelled after bad reports");
+        // Should still be at Studio32k (not upgraded)
+        assert_eq!(ctrl.current_tier, Tier::Studio32k);
+    }
+
+    #[test]
+    fn no_probe_on_cellular() {
+        let mut ctrl = AdaptiveQualityController::new();
+        ctrl.signal_network_change(NetworkContext::CellularLte);
+        ctrl.current_tier = Tier::Good;
+        ctrl.current_profile = Tier::Good.profile();
+        ctrl.stable_since = Some(Instant::now() - Duration::from_secs(60));
+
+        let good = make_report(0.5, 40);
+        let result = ctrl.observe(&good);
+        // Should NOT probe on cellular
+        assert!(ctrl.probe.is_none(), "should not probe on cellular");
+        assert!(result.is_none() || ctrl.current_tier == Tier::Good);
+    }
+
+    #[test]
+    fn no_probe_at_highest_tier() {
+        let mut ctrl = AdaptiveQualityController::new();
+        ctrl.current_tier = Tier::Studio64k;
+        ctrl.current_profile = Tier::Studio64k.profile();
+        ctrl.stable_since = Some(Instant::now() - Duration::from_secs(60));
+
+        let excellent = make_report(0.1, 10);
+        let result = ctrl.observe(&excellent);
+        assert!(result.is_none(), "should not probe when already at Studio64k");
+    }
 }

crates/wzp-proto/src/traits.rs

@@ -28,6 +28,13 @@ pub trait AudioEncoder: Send + Sync {
 
     /// Enable/disable DTX (discontinuous transmission). No-op for Codec2.
     fn set_dtx(&mut self, _enabled: bool) {}
+
+    /// Hint the encoder about expected packet loss (0–100). In DRED mode the
+    /// encoder floors this at 15% internally. No-op for Codec2.
+    fn set_expected_loss(&mut self, _loss_pct: u8) {}
+
+    /// Set DRED duration in 10 ms frame units (0–104). No-op for Codec2.
+    fn set_dred_duration(&mut self, _frames: u8) {}
 }
 
 /// Decodes compressed frames back to PCM audio.

crates/wzp-relay/Cargo.toml

@@ -20,6 +20,7 @@ bytes = { workspace = true }
 serde = { workspace = true }
 toml = "0.8"
 anyhow = "1"
+clap = { version = "4", features = ["derive"] }
 reqwest = { version = "0.12", features = ["json"] }
 serde_json = "1"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
@@ -28,6 +29,7 @@ prometheus = "0.13"
 axum = { version = "0.7", default-features = false, features = ["tokio", "http1", "ws"] }
 tower-http = { version = "0.6", features = ["fs"] }
 futures-util = "0.3"
+dashmap = "6"
 dirs = "6"
 sha2 = { workspace = true }
 chrono = "0.4"

crates/wzp-relay/src/call_registry.rs

@@ -31,6 +31,43 @@ pub struct DirectCall {
     pub created_at: Instant,
     pub answered_at: Option<Instant>,
     pub ended_at: Option<Instant>,
+    /// Phase 3 (hole-punching): caller's server-reflexive address
+    /// as carried in the `DirectCallOffer`. The relay stashes it
+    /// here when the offer arrives so it can later inject it as
+    /// `peer_direct_addr` into the callee's `CallSetup`.
+    pub caller_reflexive_addr: Option<String>,
+    /// Phase 3 (hole-punching): callee's server-reflexive address
+    /// as carried in the `DirectCallAnswer`. Only populated for
+    /// `AcceptTrusted` answers — privacy-mode answers leave this
+    /// `None`. Fed into the caller's `CallSetup.peer_direct_addr`.
+    pub callee_reflexive_addr: Option<String>,
+    /// Phase 4 (cross-relay): federation TLS fingerprint of the
+    /// PEER RELAY that forwarded the offer/answer for this call.
+    /// `None` for local calls — caller and callee both
+    /// registered on this relay. `Some(fp)` when one side of
+    /// the call is on a remote relay reached through the
+    /// federation link identified by `fp`. The
+    /// `DirectCallAnswer` handling uses this to route the reply
+    /// back through the SAME link instead of broadcasting again.
+    pub peer_relay_fp: Option<String>,
+    /// Phase 5.5 (ICE host candidates): caller's LAN-local
+    /// interface addresses from the `DirectCallOffer`. Cross-
+    /// wired into the callee's `CallSetup.peer_local_addrs` so
+    /// the callee can direct-dial the caller over the same LAN
+    /// without going through the WAN reflex addr (NAT
+    /// hairpinning often doesn't work for same-LAN peers).
+    pub caller_local_addrs: Vec<String>,
+    /// Phase 5.5 (ICE host candidates): callee's LAN-local
+    /// interface addresses from the `DirectCallAnswer`. Cross-
+    /// wired into the caller's `CallSetup.peer_local_addrs`.
+    pub callee_local_addrs: Vec<String>,
+    /// Phase 8 (Tailscale-inspired): caller's port-mapped
+    /// external address from NAT-PMP/PCP/UPnP. Cross-wired
+    /// into callee's `CallSetup.peer_mapped_addr`.
+    pub caller_mapped_addr: Option<String>,
+    /// Phase 8: callee's port-mapped external address.
+    /// Cross-wired into caller's `CallSetup.peer_mapped_addr`.
+    pub callee_mapped_addr: Option<String>,
 }
 
 /// Registry of active direct calls.
@@ -57,11 +94,79 @@ impl CallRegistry {
             created_at: Instant::now(),
             answered_at: None,
             ended_at: None,
+            caller_reflexive_addr: None,
+            callee_reflexive_addr: None,
+            peer_relay_fp: None,
+            caller_local_addrs: Vec::new(),
+            callee_local_addrs: Vec::new(),
+            caller_mapped_addr: None,
+            callee_mapped_addr: None,
         };
         self.calls.insert(call_id.clone(), call);
         self.calls.get(&call_id).unwrap()
     }
 
+    /// Phase 5.5: stash the caller's LAN host candidates from
+    /// the `DirectCallOffer`. Empty Vec is a valid value meaning
+    /// "caller has no LAN candidates" (e.g. old client).
+    pub fn set_caller_local_addrs(&mut self, call_id: &str, addrs: Vec<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.caller_local_addrs = addrs;
+        }
+    }
+
+    /// Phase 5.5: stash the callee's LAN host candidates from
+    /// the `DirectCallAnswer`.
+    pub fn set_callee_local_addrs(&mut self, call_id: &str, addrs: Vec<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.callee_local_addrs = addrs;
+        }
+    }
+
+    /// Phase 4: stash the federation TLS fingerprint of the peer
+    /// relay that originated (or will receive) the cross-relay
+    /// forward for this call. Safe to call with `None` to clear
+    /// a previously-set value.
+    pub fn set_peer_relay_fp(&mut self, call_id: &str, fp: Option<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.peer_relay_fp = fp;
+        }
+    }
+
+    /// Phase 3: stash the caller's server-reflexive address read
+    /// off a `DirectCallOffer`. Safe to call on any call state;
+    /// a no-op if the call doesn't exist.
+    pub fn set_caller_reflexive_addr(&mut self, call_id: &str, addr: Option<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.caller_reflexive_addr = addr;
+        }
+    }
+
+    /// Phase 3: stash the callee's server-reflexive address read
+    /// off a `DirectCallAnswer`. Safe to call on any call state;
+    /// a no-op if the call doesn't exist.
+    pub fn set_callee_reflexive_addr(&mut self, call_id: &str, addr: Option<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.callee_reflexive_addr = addr;
+        }
+    }
+
+    /// Phase 8: stash the caller's port-mapped address from
+    /// the `DirectCallOffer`.
+    pub fn set_caller_mapped_addr(&mut self, call_id: &str, addr: Option<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.caller_mapped_addr = addr;
+        }
+    }
+
+    /// Phase 8: stash the callee's port-mapped address from
+    /// the `DirectCallAnswer`.
+    pub fn set_callee_mapped_addr(&mut self, call_id: &str, addr: Option<String>) {
+        if let Some(call) = self.calls.get_mut(call_id) {
+            call.callee_mapped_addr = addr;
+        }
+    }
+
     /// Get a call by ID.
     pub fn get(&self, call_id: &str) -> Option<&DirectCall> {
         self.calls.get(call_id)
@@ -196,4 +301,122 @@ mod tests {
         assert_eq!(reg.peer_fingerprint("c1", "alice"), Some("bob"));
         assert_eq!(reg.peer_fingerprint("c1", "bob"), Some("alice"));
     }
+
+    #[test]
+    fn call_registry_stores_reflexive_addrs() {
+        let mut reg = CallRegistry::new();
+        reg.create_call("c1".into(), "alice".into(), "bob".into());
+
+        // Default: both addrs are None.
+        let c = reg.get("c1").unwrap();
+        assert!(c.caller_reflexive_addr.is_none());
+        assert!(c.callee_reflexive_addr.is_none());
+
+        // Caller advertises its reflex addr via DirectCallOffer.
+        reg.set_caller_reflexive_addr("c1", Some("192.0.2.1:4433".into()));
+        assert_eq!(
+            reg.get("c1").unwrap().caller_reflexive_addr.as_deref(),
+            Some("192.0.2.1:4433")
+        );
+
+        // Callee responds with AcceptTrusted + its own reflex addr.
+        reg.set_callee_reflexive_addr("c1", Some("198.51.100.9:4433".into()));
+        assert_eq!(
+            reg.get("c1").unwrap().callee_reflexive_addr.as_deref(),
+            Some("198.51.100.9:4433")
+        );
+
+        // Both addrs are independently readable — the relay uses
+        // them to cross-wire peer_direct_addr in CallSetup.
+        let c = reg.get("c1").unwrap();
+        assert_eq!(
+            c.caller_reflexive_addr.as_deref(),
+            Some("192.0.2.1:4433")
+        );
+        assert_eq!(
+            c.callee_reflexive_addr.as_deref(),
+            Some("198.51.100.9:4433")
+        );
+
+        // Setter on an unknown call is a no-op, not a panic.
+        reg.set_caller_reflexive_addr("does-not-exist", Some("x".into()));
+    }
+
+    #[test]
+    fn call_registry_stores_peer_relay_fp() {
+        let mut reg = CallRegistry::new();
+        reg.create_call("c1".into(), "alice".into(), "bob".into());
+
+        // Default: no peer relay.
+        assert!(reg.get("c1").unwrap().peer_relay_fp.is_none());
+
+        // Cross-relay call: origin relay's fp is stashed.
+        reg.set_peer_relay_fp("c1", Some("relay-a-tls-fp".into()));
+        assert_eq!(
+            reg.get("c1").unwrap().peer_relay_fp.as_deref(),
+            Some("relay-a-tls-fp")
+        );
+
+        // Clearing with None is a valid no-op and empties the field.
+        reg.set_peer_relay_fp("c1", None);
+        assert!(reg.get("c1").unwrap().peer_relay_fp.is_none());
+
+        // Unknown call is a no-op, not a panic.
+        reg.set_peer_relay_fp("does-not-exist", Some("x".into()));
+    }
+
+    #[test]
+    fn call_registry_stores_mapped_addrs() {
+        let mut reg = CallRegistry::new();
+        reg.create_call("c1".into(), "alice".into(), "bob".into());
+
+        // Default: both mapped addrs are None.
+        let c = reg.get("c1").unwrap();
+        assert!(c.caller_mapped_addr.is_none());
+        assert!(c.callee_mapped_addr.is_none());
+
+        // Caller advertises its port-mapped addr via DirectCallOffer.
+        reg.set_caller_mapped_addr("c1", Some("203.0.113.5:12345".into()));
+        assert_eq!(
+            reg.get("c1").unwrap().caller_mapped_addr.as_deref(),
+            Some("203.0.113.5:12345")
+        );
+
+        // Callee responds with its mapped addr.
+        reg.set_callee_mapped_addr("c1", Some("198.51.100.9:54321".into()));
+        assert_eq!(
+            reg.get("c1").unwrap().callee_mapped_addr.as_deref(),
+            Some("198.51.100.9:54321")
+        );
+
+        // Both addrs readable — relay uses them to cross-wire
+        // peer_mapped_addr in CallSetup.
+        let c = reg.get("c1").unwrap();
+        assert_eq!(c.caller_mapped_addr.as_deref(), Some("203.0.113.5:12345"));
+        assert_eq!(c.callee_mapped_addr.as_deref(), Some("198.51.100.9:54321"));
+
+        // Setter on unknown call is a no-op.
+        reg.set_caller_mapped_addr("nope", Some("x".into()));
+    }
+
+    #[test]
+    fn call_registry_clearing_mapped_addr_works() {
+        let mut reg = CallRegistry::new();
+        reg.create_call("c1".into(), "alice".into(), "bob".into());
+        reg.set_caller_mapped_addr("c1", Some("1.2.3.4:5".into()));
+        reg.set_caller_mapped_addr("c1", None);
+        assert!(reg.get("c1").unwrap().caller_mapped_addr.is_none());
+    }
+
+    #[test]
+    fn call_registry_clearing_reflex_addr_works() {
+        // Passing None to the setter must clear a previously-set value
+        // so callers that downgrade to privacy mode mid-flow don't
+        // leak a stale addr into CallSetup.
+        let mut reg = CallRegistry::new();
+        reg.create_call("c1".into(), "alice".into(), "bob".into());
+        reg.set_caller_reflexive_addr("c1", Some("192.0.2.1:4433".into()));
+        reg.set_caller_reflexive_addr("c1", None);
+        assert!(reg.get("c1").unwrap().caller_reflexive_addr.is_none());
+    }
 }

crates/wzp-relay/src/config.rs

@@ -87,6 +87,14 @@ pub struct RelayConfig {
     /// Unlike [[peers]], no url is needed — the peer connects to us.
     #[serde(default)]
     pub trusted: Vec<TrustedConfig>,
+    /// Phase 8: geographic region identifier (e.g., "us-east", "eu-west").
+    /// Sent to clients in `RegisterPresenceAck.relay_region` so they can
+    /// build a relay map for automatic selection.
+    pub region: Option<String>,
+    /// Phase 8: externally-advertised address for this relay. Used to
+    /// populate `available_relays` in `RegisterPresenceAck`. If not set,
+    /// `listen_addr` is used.
+    pub advertised_addr: Option<SocketAddr>,
     /// Debug tap: log packet headers for matching rooms ("*" = all rooms).
     /// Activated via --debug-tap <room> or debug_tap = "room" in TOML.
     pub debug_tap: Option<String>,
@@ -114,6 +122,8 @@ impl Default for RelayConfig {
             peers: Vec::new(),
             global_rooms: Vec::new(),
             trusted: Vec::new(),
+            region: None,
+            advertised_addr: None,
             debug_tap: None,
             event_log: None,
         }

crates/wzp-relay/src/federation.rs

@@ -134,7 +134,7 @@ pub struct FederationManager {
     peers: Vec<PeerConfig>,
     trusted: Vec<TrustedConfig>,
     global_rooms: HashSet<String>,
-    room_mgr: Arc<Mutex<RoomManager>>,
+    room_mgr: Arc<RoomManager>,
     endpoint: quinn::Endpoint,
     local_tls_fp: String,
     metrics: Arc<crate::metrics::RelayMetrics>,
@@ -146,6 +146,14 @@ pub struct FederationManager {
     event_log: EventLogger,
     /// Per-room rate limiters for inbound federation media.
     rate_limiters: Mutex<HashMap<String, RateLimiter>>,
+    /// Phase 4: channel for handing cross-relay direct-call
+    /// signaling (inner message + origin relay fp) back to the
+    /// main signal loop in `main.rs`. Set once at startup via
+    /// `set_cross_relay_tx`. `None` when the main loop hasn't
+    /// wired it up yet (e.g. during startup warmup) — forwards
+    /// that arrive before wiring are dropped with a warning.
+    cross_relay_signal_tx:
+        Mutex<Option<tokio::sync::mpsc::Sender<(wzp_proto::SignalMessage, String)>>>,
 }
 
 impl FederationManager {
@@ -153,7 +161,7 @@ impl FederationManager {
         peers: Vec<PeerConfig>,
         trusted: Vec<TrustedConfig>,
         global_rooms: HashSet<String>,
-        room_mgr: Arc<Mutex<RoomManager>>,
+        room_mgr: Arc<RoomManager>,
         endpoint: quinn::Endpoint,
         local_tls_fp: String,
         metrics: Arc<crate::metrics::RelayMetrics>,
@@ -171,31 +179,136 @@ impl FederationManager {
             dedup: Mutex::new(Deduplicator::new(DEDUP_WINDOW_SIZE)),
             event_log,
             rate_limiters: Mutex::new(HashMap::new()),
+            cross_relay_signal_tx: Mutex::new(None),
+        }
+    }
+
+    /// Phase 4: expose this relay's federation TLS fingerprint so
+    /// the main signal loop can populate
+    /// `SignalMessage::FederatedSignalForward.origin_relay_fp`.
+    pub fn local_tls_fp(&self) -> &str {
+        &self.local_tls_fp
+    }
+
+    /// Phase 4: wire the channel that the main signal loop uses
+    /// to receive unwrapped cross-relay direct-call signals. Called
+    /// once at startup from `main.rs`.
+    pub async fn set_cross_relay_tx(
+        &self,
+        tx: tokio::sync::mpsc::Sender<(wzp_proto::SignalMessage, String)>,
+    ) {
+        *self.cross_relay_signal_tx.lock().await = Some(tx);
+    }
+
+    /// Phase 4: broadcast a `SignalMessage::FederatedSignalForward`
+    /// to every active federation peer link. Returns the number of
+    /// peers the broadcast reached (not the number that successfully
+    /// delivered the message further). Used when the local relay
+    /// doesn't know which peer holds the target fingerprint for a
+    /// `DirectCallOffer` — whichever peer has it will unwrap and
+    /// handle locally; the rest drop silently after "target not
+    /// local" check.
+    ///
+    /// Loop prevention: the receiving relay checks
+    /// `origin_relay_fp` against its own fp and drops self-sourced
+    /// forwards.
+    pub async fn broadcast_signal(&self, msg: &wzp_proto::SignalMessage) -> usize {
+        let peers: Vec<(String, String, Arc<QuinnTransport>)> = {
+            let links = self.peer_links.lock().await;
+            links.iter().map(|(fp, l)| (fp.clone(), l.label.clone(), l.transport.clone())).collect()
+        };  // lock released
+        let mut count = 0;
+        for (fp, label, transport) in &peers {
+            match transport.send_signal(msg).await {
+                Ok(()) => {
+                    count += 1;
+                    tracing::debug!(peer = %label, %fp, "federation: broadcast signal ok");
+                }
+                Err(e) => {
+                    tracing::warn!(peer = %label, %fp, error = %e, "federation: broadcast signal failed");
+                }
+            }
+        }
+        count
+    }
+
+    /// Phase 4: targeted send — used by the
+    /// `DirectCallAnswer` path when the registry knows exactly
+    /// which peer relay to route the reply back to. More efficient
+    /// than re-broadcasting and avoids leaking the call to
+    /// uninvolved peers.
+    ///
+    /// Returns `Ok(())` on success, `Err(String)` when the peer
+    /// isn't currently linked or the send fails.
+    pub async fn send_signal_to_peer(
+        &self,
+        peer_relay_fp: &str,
+        msg: &wzp_proto::SignalMessage,
+    ) -> Result<(), String> {
+        let normalized = normalize_fp(peer_relay_fp);
+        let transport = {
+            let links = self.peer_links.lock().await;
+            links.get(&normalized).map(|l| l.transport.clone())
+        };  // lock released
+        match transport {
+            Some(t) => t
+                .send_signal(msg)
+                .await
+                .map_err(|e| format!("send to peer {normalized}: {e}")),
+            None => Err(format!("no active federation link for {normalized}")),
         }
     }
 
     /// Check if a room name (which may be hashed) is a global room.
+    ///
+    /// Phase 4.1: ALL `call-*` rooms are implicitly global for
+    /// federation. This is the simplest path to cross-relay direct
+    /// calling with relay-mediated media fallback: when both peers
+    /// join the same `call-<id>` room on their respective relays,
+    /// the federation media pipeline automatically forwards
+    /// datagrams between them. The relay's existing ACL (`call-*`
+    /// rooms are restricted to the two authorized participants in
+    /// the call registry) prevents random clients from creating or
+    /// joining `call-*` rooms.
     pub fn is_global_room(&self, room: &str) -> bool {
+        if room.starts_with("call-") {
+            return true;
+        }
         self.resolve_global_room(room).is_some()
     }
 
     /// Resolve a room name (raw or hashed) to the canonical global room name.
     /// Returns the configured global room name if it matches.
-    pub fn resolve_global_room(&self, room: &str) -> Option<&str> {
+    ///
+    /// Phase 4.1: `call-*` rooms resolve to themselves (they ARE
+    /// the canonical name — no hashing or aliasing involved).
+    ///
+    /// Returns `Option<String>` (owned) instead of `Option<&str>`
+    /// because call-* room names aren't stored on `self` — they
+    /// come from the caller and we just confirm "yes, this is
+    /// global" by returning it back. Pre-4.1 callers that used
+    /// the reference for equality checks or hashing work
+    /// unchanged via String/&str auto-deref.
+    pub fn resolve_global_room(&self, room: &str) -> Option<String> {
+        // Phase 4.1: call-* rooms are implicitly global, resolve
+        // to themselves
+        if room.starts_with("call-") {
+            return Some(room.to_string());
+        }
         // Direct match (raw room name, e.g. Android clients)
         if self.global_rooms.contains(room) {
-            return Some(self.global_rooms.iter().find(|n| n.as_str() == room).unwrap());
+            return Some(room.to_string());
         }
         // Hashed match (desktop clients hash room names for SNI privacy)
         self.global_rooms.iter().find(|name| {
             wzp_crypto::hash_room_name(name) == room
-        }).map(|s| s.as_str())
+        }).map(|s| s.to_string())
     }
 
     /// Get the canonical federation room hash for a room.
     /// Always uses the configured global room name, not the client-provided name.
     pub fn global_room_hash(&self, room: &str) -> [u8; 8] {
-        if let Some(canonical) = self.resolve_global_room(room) {
+        if let Some(ref canonical) = self.resolve_global_room(room) {
             room_hash(canonical)
         } else {
             room_hash(room)
@@ -225,10 +338,7 @@ impl FederationManager {
         }
 
         // Room event dispatcher
-        let room_events = {
-            let mgr = self.room_mgr.lock().await;
-            mgr.subscribe_events()
-        };
+        let room_events = self.room_mgr.subscribe_events();
         let this = self.clone();
         handles.push(tokio::spawn(async move {
             run_room_event_dispatcher(this, room_events).await;
@@ -267,8 +377,8 @@ impl FederationManager {
         let mut result = Vec::new();
         for link in links.values() {
             // Check canonical name
-            if let Some(c) = canonical {
-                if let Some(remote) = link.remote_participants.get(c) {
+            if let Some(ref c) = canonical {
+                if let Some(remote) = link.remote_participants.get(c.as_str()) {
                     result.extend(remote.iter().cloned());
                 }
                 // Also check raw room name, but only if different from canonical
@@ -298,20 +408,22 @@ impl FederationManager {
     /// or rate limiting; the body currently forwards on `room_hash` alone
     /// because that's what the wire format carries.
     pub async fn forward_to_peers(&self, _room_name: &str, room_hash: &[u8; 8], media_data: &Bytes) {
-        let links = self.peer_links.lock().await;
-        if links.is_empty() {
-            return;
-        }
-        for (_fp, link) in links.iter() {
+        let peers: Vec<(String, Arc<QuinnTransport>)> = {
+            let links = self.peer_links.lock().await;
+            if links.is_empty() { return; }
+            links.values().map(|l| (l.label.clone(), l.transport.clone())).collect()
+        };  // lock released
+
+        for (label, transport) in &peers {
             let mut tagged = Vec::with_capacity(8 + media_data.len());
             tagged.extend_from_slice(room_hash);
             tagged.extend_from_slice(media_data);
-            match link.transport.send_raw_datagram(&tagged) {
+            match transport.send_raw_datagram(&tagged) {
                 Ok(()) => {
                     self.metrics.federation_packets_forwarded
-                        .with_label_values(&[&link.label, "out"]).inc();
+                        .with_label_values(&[label, "out"]).inc();
                 }
-                Err(e) => warn!(peer = %link.label, "federation send error: {e}"),
+                Err(e) => warn!(peer = %label, "federation send error: {e}"),
             }
         }
     }
@@ -375,15 +487,15 @@ async fn run_room_event_dispatcher(
         match events.recv().await {
             Ok(RoomEvent::LocalJoin { room }) => {
                 if fm.is_global_room(&room) {
-                    let participants = {
-                        let mgr = fm.room_mgr.lock().await;
-                        mgr.local_participant_list(&room)
-                    };
+                    let participants = fm.room_mgr.local_participant_list(&room);
                     info!(room = %room, count = participants.len(), "global room now active, announcing to peers");
                     let msg = SignalMessage::GlobalRoomActive { room, participants };
-                    let links = fm.peer_links.lock().await;
-                    for link in links.values() {
-                        let _ = link.transport.send_signal(&msg).await;
+                    let transports: Vec<Arc<QuinnTransport>> = {
+                        let links = fm.peer_links.lock().await;
+                        links.values().map(|l| l.transport.clone()).collect()
+                    };
+                    for t in &transports {
+                        let _ = t.send_signal(&msg).await;
                     }
                 }
             }
@@ -391,9 +503,12 @@ async fn run_room_event_dispatcher(
                 if fm.is_global_room(&room) {
                     info!(room = %room, "global room now inactive, announcing to peers");
                     let msg = SignalMessage::GlobalRoomInactive { room };
-                    let links = fm.peer_links.lock().await;
-                    for link in links.values() {
-                        let _ = link.transport.send_signal(&msg).await;
+                    let transports: Vec<Arc<QuinnTransport>> = {
+                        let links = fm.peer_links.lock().await;
+                        links.values().map(|l| l.transport.clone()).collect()
+                    };
+                    for t in &transports {
+                        let _ = t.send_signal(&msg).await;
                     }
                 }
             }
@@ -452,11 +567,11 @@ async fn run_stale_presence_sweeper(fm: Arc<FederationManager>) {
 
         // Broadcast updated RoomUpdate for affected rooms
         for room in &affected_rooms {
-            let mgr = fm.room_mgr.lock().await;
-            for local_room in mgr.active_rooms() {
-                if fm.resolve_global_room(&local_room) == fm.resolve_global_room(room) {
-                    let mut all_participants = mgr.local_participant_list(&local_room);
-                    let remote = fm.get_remote_participants(&local_room).await;
+            let active = fm.room_mgr.active_rooms();
+            for local_room in &active {
+                if fm.resolve_global_room(local_room) == fm.resolve_global_room(room) {
+                    let mut all_participants = fm.room_mgr.local_participant_list(local_room);
+                    let remote = fm.get_remote_participants(local_room).await;
                     all_participants.extend(remote);
                     let mut seen = HashSet::new();
                     all_participants.retain(|p| seen.insert(p.fingerprint.clone()));
@@ -464,8 +579,7 @@ async fn run_stale_presence_sweeper(fm: Arc<FederationManager>) {
                         count: all_participants.len() as u32,
                         participants: all_participants,
                     };
-                    let senders = mgr.local_senders(&local_room);
-                    drop(mgr);
+                    let senders = fm.room_mgr.local_senders(local_room);
                     room::broadcast_signal(&senders, &update).await;
                     info!(room = %room, "swept stale presence — broadcast updated RoomUpdate");
                     break;
@@ -543,14 +657,13 @@ async fn run_federation_link(
     // Announce our currently active global rooms to this new peer
     // Collect all announcements first, then send (avoid holding locks across await)
     let announcements = {
-        let mgr = fm.room_mgr.lock().await;
-        let active = mgr.active_rooms();
+        let active = fm.room_mgr.active_rooms();
         let mut msgs = Vec::new();
 
         // Local rooms
         for room_name in &active {
             if fm.is_global_room(room_name) {
-                let participants = mgr.local_participant_list(room_name);
+                let participants = fm.room_mgr.local_participant_list(room_name);
                 info!(peer = %peer_label, room = %room_name, participants = participants.len(), "announcing local global room to new peer");
                 msgs.push(SignalMessage::GlobalRoomActive { room: room_name.clone(), participants });
             }
@@ -720,22 +833,24 @@ async fn handle_signal(
 
                 // Broadcast updated RoomUpdate to local clients in this room
                 // Find the local room name (may be hashed or raw)
-                let mgr = fm.room_mgr.lock().await;
-                for local_room in mgr.active_rooms() {
-                    if fm.is_global_room(&local_room) && fm.resolve_global_room(&local_room) == fm.resolve_global_room(&room) {
+                let active = fm.room_mgr.active_rooms();
+                for local_room in &active {
+                    if fm.is_global_room(local_room) && fm.resolve_global_room(local_room) == fm.resolve_global_room(&room) {
                         // Build merged participant list: local + all remote (deduped)
-                        let mut all_participants = mgr.local_participant_list(&local_room);
-                        let links = fm.peer_links.lock().await;
-                        for link in links.values() {
-                            if let Some(canonical) = fm.resolve_global_room(&local_room) {
-                                if let Some(remote) = link.remote_participants.get(canonical) {
-                                    all_participants.extend(remote.iter().cloned());
-                                }
-                                // Also check raw room name, but only if different from canonical
-                                if canonical != local_room {
-                                    if let Some(remote) = link.remote_participants.get(&local_room) {
+                        let mut all_participants = fm.room_mgr.local_participant_list(local_room);
+                        {
+                            let links = fm.peer_links.lock().await;
+                            for link in links.values() {
+                                if let Some(ref canonical) = fm.resolve_global_room(local_room) {
+                                    if let Some(remote) = link.remote_participants.get(canonical.as_str()) {
                                         all_participants.extend(remote.iter().cloned());
                                     }
+                                    // Also check raw room name, but only if different from canonical
+                                    if canonical != local_room {
+                                        if let Some(remote) = link.remote_participants.get(local_room) {
+                                            all_participants.extend(remote.iter().cloned());
+                                        }
+                                    }
                                 }
                             }
                         }
@@ -746,9 +861,7 @@ async fn handle_signal(
                             count: all_participants.len() as u32,
                             participants: all_participants,
                         };
-                        let senders = mgr.local_senders(&local_room);
-                        drop(links);
-                        drop(mgr);
+                        let senders = fm.room_mgr.local_senders(local_room);
                         room::broadcast_signal(&senders, &update).await;
                         break;
                     }
@@ -763,8 +876,8 @@ async fn handle_signal(
                 // Clear remote participants for this peer+room
                 link.remote_participants.remove(&room);
                 // Also try canonical name
-                if let Some(canonical) = fm.resolve_global_room(&room) {
-                    link.remote_participants.remove(canonical);
+                if let Some(ref canonical) = fm.resolve_global_room(&room) {
+                    link.remote_participants.remove(canonical.as_str());
                 }
             }
 
@@ -778,8 +891,8 @@ async fn handle_signal(
                 let mut result = Vec::new();
                 for (fp, link) in links.iter() {
                     if fp == peer_fp { continue; }
-                    if let Some(c) = canonical {
-                        if let Some(remote) = link.remote_participants.get(c) {
+                    if let Some(ref c) = canonical {
+                        if let Some(remote) = link.remote_participants.get(c.as_str()) {
                             result.extend(remote.iter().cloned());
                         }
                     }
@@ -791,10 +904,7 @@ async fn handle_signal(
 
             // Propagate to other peers: send updated GlobalRoomActive with revised list,
             // or GlobalRoomInactive if no participants remain anywhere
-            let local_active = {
-                let mgr = fm.room_mgr.lock().await;
-                mgr.active_rooms().iter().any(|r| fm.resolve_global_room(r) == fm.resolve_global_room(&room))
-            };
+            let local_active = fm.room_mgr.active_rooms().iter().any(|r| fm.resolve_global_room(r) == fm.resolve_global_room(&room));
             let has_remaining = !remaining_remote.is_empty() || local_active;
 
             // Collect peer transports to send to (avoid holding lock across await)
@@ -808,10 +918,9 @@ async fn handle_signal(
                 // Send updated participant list to other peers
                 let mut updated_participants = remaining_remote.clone();
                 if local_active {
-                    let mgr = fm.room_mgr.lock().await;
-                    for local_room in mgr.active_rooms() {
+                    for local_room in fm.room_mgr.active_rooms() {
                         if fm.resolve_global_room(&local_room) == fm.resolve_global_room(&room) {
-                            updated_participants.extend(mgr.local_participant_list(&local_room));
+                            updated_participants.extend(fm.room_mgr.local_participant_list(&local_room));
                             break;
                         }
                     }
@@ -832,10 +941,10 @@ async fn handle_signal(
             }
 
             // Broadcast updated RoomUpdate to local clients (remote participant removed)
-            let mgr = fm.room_mgr.lock().await;
-            for local_room in mgr.active_rooms() {
-                if fm.is_global_room(&local_room) && fm.resolve_global_room(&local_room) == fm.resolve_global_room(&room) {
-                    let mut all_participants = mgr.local_participant_list(&local_room);
+            let active = fm.room_mgr.active_rooms();
+            for local_room in &active {
+                if fm.is_global_room(local_room) && fm.resolve_global_room(local_room) == fm.resolve_global_room(&room) {
+                    let mut all_participants = fm.room_mgr.local_participant_list(local_room);
                     all_participants.extend(remaining_remote.iter().cloned());
                     // Deduplicate by fingerprint
                     let mut seen = HashSet::new();
@@ -844,14 +953,64 @@ async fn handle_signal(
                         count: all_participants.len() as u32,
                         participants: all_participants,
                     };
-                    let senders = mgr.local_senders(&local_room);
-                    drop(mgr);
+                    let senders = fm.room_mgr.local_senders(local_room);
                     room::broadcast_signal(&senders, &update).await;
                     info!(room = %room, "broadcast updated presence (remote participant removed)");
                     break;
                 }
             }
         }
+        // Phase 4: cross-relay direct-call signal envelope.
+        //
+        // Unwrap the inner message and hand it off to the main
+        // signal loop via the cross_relay_signal_tx channel. The
+        // main loop will then dispatch the inner DirectCallOffer/
+        // Answer/Ringing/Hangup exactly as if it had arrived on a
+        // local signal transport — with the extra context that
+        // the call is "federated" (origin_relay_fp).
+        //
+        // Loop prevention: drop any forward whose origin matches
+        // our own federation TLS fingerprint. With
+        // broadcast-to-all-peers this prevents A→B→A echo loops.
+        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
+            if origin_relay_fp == fm.local_tls_fp {
+                tracing::debug!(
+                    peer = %peer_label,
+                    "federation: dropping self-sourced FederatedSignalForward (loop prevention)"
+                );
+                return;
+            }
+            let tx_opt = {
+                let guard = fm.cross_relay_signal_tx.lock().await;
+                guard.clone()
+            };
+            match tx_opt {
+                Some(tx) => {
+                    let inner_discriminant = std::mem::discriminant(&*inner);
+                    if let Err(e) = tx.send((*inner, origin_relay_fp.clone())).await {
+                        warn!(
+                            peer = %peer_label,
+                            ?inner_discriminant,
+                            error = %e,
+                            "federation: cross-relay signal dispatcher full / closed"
+                        );
+                    } else {
+                        tracing::debug!(
+                            peer = %peer_label,
+                            ?inner_discriminant,
+                            %origin_relay_fp,
+                            "federation: forwarded cross-relay signal to main dispatcher"
+                        );
+                    }
+                }
+                None => {
+                    warn!(
+                        peer = %peer_label,
+                        "federation: cross_relay_signal_tx not wired yet — dropping forward"
+                    );
+                }
+            }
+        }
         _ => {} // ignore other signals
     }
 }
@@ -911,14 +1070,13 @@ async fn handle_datagram(
         }
     }
 
-    // Find room by hash — check local rooms AND global room config
+    // Find room by hash -- check local rooms AND global room config
     let room_name = {
-        let mgr = fm.room_mgr.lock().await;
-        let active = mgr.active_rooms();
+        let active = fm.room_mgr.active_rooms();
         // First: check local rooms (has participants)
         active.iter().find(|r| room_hash(r) == rh).cloned()
             .or_else(|| active.iter().find(|r| fm.global_room_hash(r) == rh).cloned())
-            // Second: check global room config (hub relay may have no local participants)
+            // Second: check static global room config (hub relay may have no local participants)
             .or_else(|| {
                 fm.global_rooms.iter().find(|name| room_hash(name) == rh).cloned()
             })
@@ -928,6 +1086,20 @@ async fn handle_datagram(
         Some(r) => r,
         None => {
             fm.event_log.emit(Event::new("room_not_found").seq(pkt.header.seq).peer(&peer_label));
+            // Phase 4.1 diagnostic: log the hash + active rooms
+            // so we can diagnose cross-relay call-* media routing
+            // failures. This fires when a peer relay sends media
+            // for a room we don't have locally — could be a
+            // timing issue (peer joined before us) or a hash
+            // mismatch.
+            let active = fm.room_mgr.active_rooms();
+            warn!(
+                room_hash = ?rh,
+                active_rooms = ?active,
+                seq = pkt.header.seq,
+                peer = %peer_label,
+                "federation datagram for unknown room — no local room matches hash"
+            );
             return;
         }
     };
@@ -945,10 +1117,7 @@ async fn handle_datagram(
 
     // Deliver to all local participants — forward the raw bytes as-is.
     // The original sender's MediaPacket is preserved exactly (no re-serialization).
-    let locals = {
-        let mgr = fm.room_mgr.lock().await;
-        mgr.local_senders(&room_name)
-    };
+    let locals = fm.room_mgr.local_senders(&room_name);
     for sender in &locals {
         match sender {
             room::ParticipantSender::Quic(t) => {

crates/wzp-relay/src/room.rs

@@ -9,10 +9,12 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use bytes::Bytes;
-use tokio::sync::Mutex;
+use dashmap::DashMap;
 use tracing::{error, info, warn};
 
 use wzp_proto::packet::TrunkFrame;
+use wzp_proto::quality::{AdaptiveQualityController, Tier};
+use wzp_proto::traits::QualityController;
 use wzp_proto::MediaTransport;
 
 use crate::metrics::RelayMetrics;
@@ -48,6 +50,143 @@ impl DebugTap {
             "TAP"
         );
     }
+
+    pub fn log_signal(&self, room: &str, signal: &wzp_proto::SignalMessage) {
+        match signal {
+            wzp_proto::SignalMessage::RoomUpdate { count, participants } => {
+                let names: Vec<&str> = participants.iter()
+                    .map(|p| p.alias.as_deref().unwrap_or("?"))
+                    .collect();
+                info!(
+                    target: "debug_tap",
+                    room = %room,
+                    signal = "RoomUpdate",
+                    count,
+                    participants = ?names,
+                    "TAP SIGNAL"
+                );
+            }
+            wzp_proto::SignalMessage::QualityDirective { recommended_profile, reason } => {
+                info!(
+                    target: "debug_tap",
+                    room = %room,
+                    signal = "QualityDirective",
+                    codec = ?recommended_profile.codec,
+                    reason = reason.as_deref().unwrap_or(""),
+                    "TAP SIGNAL"
+                );
+            }
+            other => {
+                info!(
+                    target: "debug_tap",
+                    room = %room,
+                    signal = ?std::mem::discriminant(other),
+                    "TAP SIGNAL"
+                );
+            }
+        }
+    }
+
+    pub fn log_event(&self, room: &str, event: &str, detail: &str) {
+        info!(
+            target: "debug_tap",
+            room = %room,
+            event,
+            detail,
+            "TAP EVENT"
+        );
+    }
+
+    pub fn log_stats(&self, room: &str, stats: &TapStats) {
+        let codecs: Vec<String> = stats.codecs_seen.iter().map(|c| format!("{c:?}")).collect();
+        info!(
+            target: "debug_tap",
+            room = %room,
+            period = "5s",
+            in_pkts = stats.in_pkts,
+            out_pkts = stats.out_pkts,
+            fan_out_avg = format!("{:.1}", if stats.in_pkts > 0 { stats.out_pkts as f64 / stats.in_pkts as f64 } else { 0.0 }),
+            seq_gaps = stats.seq_gaps,
+            codecs_seen = ?codecs,
+            "TAP STATS"
+        );
+    }
+}
+
+/// Per-participant stats for the debug tap periodic summary.
+pub struct TapStats {
+    pub in_pkts: u64,
+    pub out_pkts: u64,
+    pub seq_gaps: u64,
+    pub codecs_seen: std::collections::HashSet<wzp_proto::CodecId>,
+    last_seq: Option<u16>,
+}
+
+impl TapStats {
+    pub fn new() -> Self {
+        Self {
+            in_pkts: 0,
+            out_pkts: 0,
+            seq_gaps: 0,
+            codecs_seen: std::collections::HashSet::new(),
+            last_seq: None,
+        }
+    }
+
+    pub fn record_in(&mut self, pkt: &wzp_proto::MediaPacket, fan_out: usize) {
+        self.in_pkts += 1;
+        self.out_pkts += fan_out as u64;
+        self.codecs_seen.insert(pkt.header.codec_id);
+        if let Some(prev) = self.last_seq {
+            let expected = prev.wrapping_add(1);
+            if pkt.header.seq != expected {
+                self.seq_gaps += 1;
+            }
+        }
+        self.last_seq = Some(pkt.header.seq);
+    }
+
+    pub fn reset_period(&mut self) {
+        self.in_pkts = 0;
+        self.out_pkts = 0;
+        self.seq_gaps = 0;
+        // Keep codecs_seen and last_seq across periods
+    }
+}
+
+/// Tracks network quality for a single participant in a room.
+struct ParticipantQuality {
+    controller: AdaptiveQualityController,
+    current_tier: Tier,
+}
+
+impl ParticipantQuality {
+    fn new() -> Self {
+        Self {
+            controller: AdaptiveQualityController::new(),
+            current_tier: Tier::Good,
+        }
+    }
+
+    /// Feed a quality report and return the new tier if it changed.
+    fn observe(&mut self, report: &wzp_proto::packet::QualityReport) -> Option<Tier> {
+        let _ = self.controller.observe(report);
+        let new_tier = self.controller.tier();
+        if new_tier != self.current_tier {
+            self.current_tier = new_tier;
+            Some(new_tier)
+        } else {
+            None
+        }
+    }
+}
+
+/// Compute the weakest (worst) quality tier across all tracked participants.
+fn weakest_tier<'a>(qualities: impl Iterator<Item = &'a ParticipantQuality>) -> Tier {
+    qualities
+        .map(|pq| pq.current_tier)
+        .min()
+        .unwrap_or(Tier::Good)
 }
 
 /// Unique participant ID within a room.
@@ -138,12 +277,18 @@ struct Participant {
 /// A room holding multiple participants.
 struct Room {
     participants: Vec<Participant>,
+    /// Per-participant quality tracking, keyed by participant_id.
+    qualities: HashMap<ParticipantId, ParticipantQuality>,
+    /// Current room-wide tier (to avoid repeated broadcasts).
+    current_tier: Tier,
 }
 
 impl Room {
     fn new() -> Self {
         Self {
             participants: Vec::new(),
+            qualities: HashMap::new(),
+            current_tier: Tier::Good,
         }
     }
 
@@ -200,12 +345,16 @@ impl Room {
 }
 
 /// Manages all rooms on the relay.
+///
+/// Uses `DashMap` for per-room sharded locking -- rooms are independently
+/// lockable so the media hot-path never contends on a single mutex.
 pub struct RoomManager {
-    rooms: HashMap<String, Room>,
-    /// Room access control list. Maps hashed room name → allowed fingerprints.
+    rooms: DashMap<String, Room>,
+    /// Room access control list. Maps hashed room name -> allowed fingerprints.
     /// When `None`, rooms are open (no auth mode). When `Some`, only listed
-    /// fingerprints can join the corresponding room.
-    acl: Option<HashMap<String, HashSet<String>>>,
+    /// fingerprints can join the corresponding room. Protected by std Mutex
+    /// since ACL mutations are rare (only during call setup).
+    acl: Option<std::sync::Mutex<HashMap<String, HashSet<String>>>>,
     /// Channel for room lifecycle events (federation subscribes).
     event_tx: tokio::sync::broadcast::Sender<RoomEvent>,
 }
@@ -214,7 +363,7 @@ impl RoomManager {
     pub fn new() -> Self {
         let (event_tx, _) = tokio::sync::broadcast::channel(64);
         Self {
-            rooms: HashMap::new(),
+            rooms: DashMap::new(),
             acl: None,
             event_tx,
         }
@@ -224,8 +373,8 @@ impl RoomManager {
     pub fn with_acl() -> Self {
         let (event_tx, _) = tokio::sync::broadcast::channel(64);
         Self {
-            rooms: HashMap::new(),
-            acl: Some(HashMap::new()),
+            rooms: DashMap::new(),
+            acl: Some(std::sync::Mutex::new(HashMap::new())),
             event_tx,
         }
     }
@@ -236,9 +385,10 @@ impl RoomManager {
     }
 
     /// Grant a fingerprint access to a room.
-    pub fn allow(&mut self, room_name: &str, fingerprint: &str) {
-        if let Some(ref mut acl) = self.acl {
-            acl.entry(room_name.to_string())
+    pub fn allow(&self, room_name: &str, fingerprint: &str) {
+        if let Some(ref acl) = self.acl {
+            acl.lock().unwrap()
+                .entry(room_name.to_string())
                 .or_default()
                 .insert(fingerprint.to_string());
         }
@@ -251,6 +401,7 @@ impl RoomManager {
             (None, _) => true, // no ACL = open
             (Some(_), None) => false, // ACL enabled but no fingerprint
             (Some(acl), Some(fp)) => {
+                let acl = acl.lock().unwrap();
                 // Room not in ACL = open room (allow anyone authenticated)
                 match acl.get(room_name) {
                     None => true,
@@ -262,7 +413,7 @@ impl RoomManager {
 
     /// Join a room. Returns (participant_id, room_update_msg, all_senders) for broadcasting.
     pub fn join(
-        &mut self,
+        &self,
         room_name: &str,
         addr: std::net::SocketAddr,
         sender: ParticipantSender,
@@ -273,24 +424,25 @@ impl RoomManager {
             warn!(room = room_name, fingerprint = ?fingerprint, "unauthorized room join attempt");
             return Err("not authorized for this room".to_string());
         }
-        let was_empty = !self.rooms.contains_key(room_name)
-            || self.rooms.get(room_name).map_or(true, |r| r.is_empty());
-        let room = self.rooms.entry(room_name.to_string()).or_insert_with(Room::new);
+        let was_empty = self.rooms.get(room_name).map_or(true, |r| r.is_empty());
+        let mut room = self.rooms.entry(room_name.to_string()).or_insert_with(Room::new);
         let id = room.add(addr, sender, fingerprint.map(|s| s.to_string()), alias.map(|s| s.to_string()));
-        if was_empty {
-            let _ = self.event_tx.send(RoomEvent::LocalJoin { room: room_name.to_string() });
-        }
+        room.qualities.insert(id, ParticipantQuality::new());
         let update = wzp_proto::SignalMessage::RoomUpdate {
             count: room.len() as u32,
             participants: room.participant_list(),
         };
         let senders = room.all_senders();
+        drop(room); // release DashMap guard before event_tx send (not async, but good practice)
+        if was_empty {
+            let _ = self.event_tx.send(RoomEvent::LocalJoin { room: room_name.to_string() });
+        }
         Ok((id, update, senders))
     }
 
     /// Join a room via WebSocket. Convenience wrapper around `join()`.
     pub fn join_ws(
-        &mut self,
+        &self,
         room_name: &str,
         addr: std::net::SocketAddr,
         sender: tokio::sync::mpsc::Sender<Bytes>,
@@ -302,7 +454,7 @@ impl RoomManager {
 
     /// Get list of active room names.
     pub fn active_rooms(&self) -> Vec<String> {
-        self.rooms.keys().cloned().collect()
+        self.rooms.iter().map(|r| r.key().clone()).collect()
     }
 
     /// Get participant list for a room (fingerprint + alias).
@@ -322,24 +474,29 @@ impl RoomManager {
     }
 
     /// Leave a room. Returns (room_update_msg, remaining_senders) for broadcasting, or None if room is now empty.
-    pub fn leave(&mut self, room_name: &str, participant_id: ParticipantId) -> Option<(wzp_proto::SignalMessage, Vec<ParticipantSender>)> {
-        if let Some(room) = self.rooms.get_mut(room_name) {
-            room.remove(participant_id);
-            if room.is_empty() {
-                self.rooms.remove(room_name);
-                let _ = self.event_tx.send(RoomEvent::LocalLeave { room: room_name.to_string() });
-                info!(room = room_name, "room closed (empty)");
-                return None;
+    pub fn leave(&self, room_name: &str, participant_id: ParticipantId) -> Option<(wzp_proto::SignalMessage, Vec<ParticipantSender>)> {
+        let result = {
+            if let Some(mut room) = self.rooms.get_mut(room_name) {
+                room.qualities.remove(&participant_id);
+                room.remove(participant_id);
+                if room.is_empty() {
+                    drop(room); // release write guard before remove
+                    self.rooms.remove(room_name);
+                    let _ = self.event_tx.send(RoomEvent::LocalLeave { room: room_name.to_string() });
+                    info!(room = room_name, "room closed (empty)");
+                    return None;
+                }
+                let update = wzp_proto::SignalMessage::RoomUpdate {
+                    count: room.len() as u32,
+                    participants: room.participant_list(),
+                };
+                let senders = room.all_senders();
+                Some((update, senders))
+            } else {
+                None
             }
-            let update = wzp_proto::SignalMessage::RoomUpdate {
-                count: room.len() as u32,
-                participants: room.participant_list(),
-            };
-            let senders = room.all_senders();
-            Some((update, senders))
-        } else {
-            None
-        }
+        };
+        result
     }
 
     /// Get senders for all OTHER participants in a room.
@@ -359,9 +516,62 @@ impl RoomManager {
         self.rooms.get(room_name).map(|r| r.len()).unwrap_or(0)
     }
 
+    /// Check if a room exists and has participants.
+    pub fn is_room_active(&self, room_name: &str) -> bool {
+        self.rooms.contains_key(room_name)
+    }
+
     /// List all rooms with their sizes.
     pub fn list(&self) -> Vec<(String, usize)> {
-        self.rooms.iter().map(|(k, v)| (k.clone(), v.len())).collect()
+        self.rooms.iter().map(|r| (r.key().clone(), r.len())).collect()
+    }
+
+    /// Feed a quality report from a participant. If the room-wide weakest
+    /// tier changes, returns `(QualityDirective signal, all senders)` for
+    /// broadcasting.
+    pub fn observe_quality(
+        &self,
+        room_name: &str,
+        participant_id: ParticipantId,
+        report: &wzp_proto::packet::QualityReport,
+    ) -> Option<(wzp_proto::SignalMessage, Vec<ParticipantSender>)> {
+        let mut room = self.rooms.get_mut(room_name)?;
+
+        let tier_changed = room.qualities
+            .get_mut(&participant_id)
+            .and_then(|pq| pq.observe(report))
+            .is_some();
+
+        if !tier_changed {
+            return None;
+        }
+
+        // Compute the weakest tier across all participants in this room
+        let weakest = weakest_tier(room.qualities.values());
+
+        if weakest == room.current_tier {
+            return None;
+        }
+
+        // Room-wide tier changed -- update and broadcast directive
+        let old_tier = room.current_tier;
+        room.current_tier = weakest;
+        let profile = weakest.profile();
+        info!(
+            room = room_name,
+            old_tier = ?old_tier,
+            new_tier = ?weakest,
+            codec = ?profile.codec,
+            fec_ratio = profile.fec_ratio,
+            "room quality directive"
+        );
+
+        let directive = wzp_proto::SignalMessage::QualityDirective {
+            recommended_profile: profile,
+            reason: Some(format!("weakest link: {weakest:?}")),
+        };
+        let senders = room.all_senders();
+        Some((directive, senders))
     }
 }
 
@@ -382,18 +592,32 @@ impl TrunkedForwarder {
     /// Create a new trunked forwarder.
     ///
     /// `session_id` tags every entry pushed into the batcher so the receiver
-    /// can demultiplex packets by session.
+    /// can demultiplex packets by session. The batcher's `max_bytes` is
+    /// initialized from the transport's current PMTUD-discovered MTU so that
+    /// trunk frames fill the largest datagram the path supports (instead of
+    /// the conservative 1200-byte default).
     pub fn new(transport: Arc<wzp_transport::QuinnTransport>, session_id: [u8; 2]) -> Self {
+        let mut batcher = TrunkBatcher::new();
+        if let Some(mtu) = transport.max_datagram_size() {
+            batcher.max_bytes = mtu;
+        }
         Self {
             transport,
-            batcher: TrunkBatcher::new(),
+            batcher,
             session_id,
         }
     }
 
     /// Push a media packet into the batcher.  If the batcher is full it will
     /// flush automatically and the resulting trunk frame is sent immediately.
+    ///
+    /// Also refreshes `max_bytes` from the transport's PMTUD-discovered MTU
+    /// so the batcher fills larger datagrams as the path MTU grows.
     pub async fn send(&mut self, pkt: &wzp_proto::MediaPacket) -> anyhow::Result<()> {
+        // Refresh batcher limit from PMTUD (cheap: reads an atomic in quinn).
+        if let Some(mtu) = self.transport.max_datagram_size() {
+            self.batcher.max_bytes = mtu;
+        }
         let payload: Bytes = pkt.to_bytes();
         if let Some(frame) = self.batcher.push(self.session_id, payload) {
             self.send_frame(&frame)?;
@@ -430,7 +654,7 @@ impl TrunkedForwarder {
 /// into [`TrunkedForwarder`]s and flushed every 5 ms or when the batcher is
 /// full, reducing QUIC datagram overhead.
 pub async fn run_participant(
-    room_mgr: Arc<Mutex<RoomManager>>,
+    room_mgr: Arc<RoomManager>,
     room_name: String,
     participant_id: ParticipantId,
     transport: Arc<wzp_transport::QuinnTransport>,
@@ -456,7 +680,7 @@ pub async fn run_participant(
 
 /// Plain (non-trunked) forwarding loop — original behaviour.
 async fn run_participant_plain(
-    room_mgr: Arc<Mutex<RoomManager>>,
+    room_mgr: Arc<RoomManager>,
     room_name: String,
     participant_id: ParticipantId,
     transport: Arc<wzp_transport::QuinnTransport>,
@@ -474,6 +698,12 @@ async fn run_participant_plain(
     let mut send_errors = 0u64;
     let mut last_log_instant = std::time::Instant::now();
 
+    let mut tap_stats = if debug_tap.as_ref().map_or(false, |t| t.matches(&room_name)) {
+        Some(TapStats::new())
+    } else {
+        None
+    };
+
     info!(
         room = %room_name,
         participant = participant_id,
@@ -521,11 +751,16 @@ async fn run_participant_plain(
             metrics.update_session_quality(session_id, report);
         }
 
-        // Get current list of other participants
+        // Get current list of other participants + check quality directive
         let lock_start = std::time::Instant::now();
-        let others = {
-            let mgr = room_mgr.lock().await;
-            mgr.others(&room_name, participant_id)
+        let (others, quality_directive) = {
+            let directive = if let Some(ref report) = pkt.quality_report {
+                room_mgr.observe_quality(&room_name, participant_id, report)
+            } else {
+                None
+            };
+            let o = room_mgr.others(&room_name, participant_id);
+            (o, directive)
         };
         let lock_ms = lock_start.elapsed().as_millis() as u64;
         if lock_ms > 10 {
@@ -537,12 +772,25 @@ async fn run_participant_plain(
             );
         }
 
-        // Debug tap: log packet metadata
+        // Broadcast quality directive to all participants if tier changed
+        if let Some((directive, all_senders)) = quality_directive {
+            if let Some(ref tap) = debug_tap {
+                if tap.matches(&room_name) {
+                    tap.log_signal(&room_name, &directive);
+                }
+            }
+            broadcast_signal(&all_senders, &directive).await;
+        }
+
+        // Debug tap: log packet metadata + record stats
         if let Some(ref tap) = debug_tap {
             if tap.matches(&room_name) {
                 tap.log_packet(&room_name, "in", &addr, &pkt, others.len());
             }
         }
+        if let Some(ref mut ts) = tap_stats {
+            ts.record_in(&pkt, others.len());
+        }
 
         // Forward to all others
         let fwd_start = std::time::Instant::now();
@@ -600,10 +848,7 @@ async fn run_participant_plain(
 
         // Periodic stats log every 5 seconds
         if last_log_instant.elapsed() >= Duration::from_secs(5) {
-            let room_size = {
-                let mgr = room_mgr.lock().await;
-                mgr.room_size(&room_name)
-            };
+            let room_size = room_mgr.room_size(&room_name);
             info!(
                 room = %room_name,
                 participant = participant_id,
@@ -615,6 +860,10 @@ async fn run_participant_plain(
                 send_errors,
                 "participant stats"
             );
+            if let (Some(tap), Some(ts)) = (&debug_tap, &mut tap_stats) {
+                tap.log_stats(&room_name, ts);
+                ts.reset_period();
+            }
             max_recv_gap_ms = 0;
             max_forward_ms = 0;
             last_log_instant = std::time::Instant::now();
@@ -622,16 +871,28 @@ async fn run_participant_plain(
     }
 
     // Clean up — leave room and broadcast update to remaining participants
-    let mut mgr = room_mgr.lock().await;
-    if let Some((update, senders)) = mgr.leave(&room_name, participant_id) {
-        drop(mgr); // release lock before async broadcast
+    if let Some((update, senders)) = room_mgr.leave(&room_name, participant_id) {
+        if let Some(ref tap) = debug_tap {
+            if tap.matches(&room_name) {
+                tap.log_event(&room_name, "leave", &format!(
+                    "participant={participant_id} addr={addr} forwarded={packets_forwarded}"
+                ));
+                tap.log_signal(&room_name, &update);
+            }
+        }
         broadcast_signal(&senders, &update).await;
+    } else if let Some(ref tap) = debug_tap {
+        if tap.matches(&room_name) {
+            tap.log_event(&room_name, "leave", &format!(
+                "participant={participant_id} addr={addr} (room closed)"
+            ));
+        }
     }
 }
 
 /// Trunked forwarding loop — batches outgoing packets per peer.
 async fn run_participant_trunked(
-    room_mgr: Arc<Mutex<RoomManager>>,
+    room_mgr: Arc<RoomManager>,
     room_name: String,
     participant_id: ParticipantId,
     transport: Arc<wzp_transport::QuinnTransport>,
@@ -705,9 +966,14 @@ async fn run_participant_trunked(
                 }
 
                 let lock_start = std::time::Instant::now();
-                let others = {
-                    let mgr = room_mgr.lock().await;
-                    mgr.others(&room_name, participant_id)
+                let (others, quality_directive) = {
+                    let directive = if let Some(ref report) = pkt.quality_report {
+                        room_mgr.observe_quality(&room_name, participant_id, report)
+                    } else {
+                        None
+                    };
+                    let o = room_mgr.others(&room_name, participant_id);
+                    (o, directive)
                 };
                 let lock_ms = lock_start.elapsed().as_millis() as u64;
                 if lock_ms > 10 {
@@ -719,6 +985,11 @@ async fn run_participant_trunked(
                     );
                 }
 
+                // Broadcast quality directive to all participants if tier changed
+                if let Some((directive, all_senders)) = quality_directive {
+                    broadcast_signal(&all_senders, &directive).await;
+                }
+
                 let fwd_start = std::time::Instant::now();
                 let pkt_bytes = pkt.payload.len() as u64;
                 for other in &others {
@@ -767,10 +1038,7 @@ async fn run_participant_trunked(
 
                 // Periodic stats every 5 seconds
                 if last_log_instant.elapsed() >= Duration::from_secs(5) {
-                    let room_size = {
-                        let mgr = room_mgr.lock().await;
-                        mgr.room_size(&room_name)
-                    };
+                    let room_size = room_mgr.room_size(&room_name);
                     info!(
                         room = %room_name,
                         participant = participant_id,
@@ -811,9 +1079,7 @@ async fn run_participant_trunked(
         let _ = fwd.flush().await;
     }
 
-    let mut mgr = room_mgr.lock().await;
-    if let Some((update, senders)) = mgr.leave(&room_name, participant_id) {
-        drop(mgr);
+    if let Some((update, senders)) = room_mgr.leave(&room_name, participant_id) {
         broadcast_signal(&senders, &update).await;
     }
 }
@@ -859,7 +1125,7 @@ mod tests {
 
     #[test]
     fn acl_restricts_to_allowed() {
-        let mut mgr = RoomManager::with_acl();
+        let mgr = RoomManager::with_acl();
         mgr.allow("room1", "alice");
         mgr.allow("room1", "bob");
         assert!(mgr.is_authorized("room1", Some("alice")));
@@ -959,4 +1225,47 @@ mod tests {
         // Batcher should now be empty — nothing to flush.
         assert!(batcher.flush().is_none());
     }
+
+    fn make_report(loss_pct_f: f32, rtt_ms: u16) -> wzp_proto::packet::QualityReport {
+        wzp_proto::packet::QualityReport {
+            loss_pct: (loss_pct_f / 100.0 * 255.0) as u8,
+            rtt_4ms: (rtt_ms / 4) as u8,
+            jitter_ms: 10,
+            bitrate_cap_kbps: 200,
+        }
+    }
+
+    #[test]
+    fn participant_quality_starts_good() {
+        let pq = ParticipantQuality::new();
+        assert_eq!(pq.current_tier, Tier::Good);
+    }
+
+    #[test]
+    fn participant_quality_degrades_on_bad_reports() {
+        let mut pq = ParticipantQuality::new();
+        let bad = make_report(50.0, 300);
+        // Feed enough bad reports to trigger downgrade (3 consecutive)
+        for _ in 0..5 {
+            pq.observe(&bad);
+        }
+        assert_ne!(pq.current_tier, Tier::Good, "should degrade from Good");
+    }
+
+    #[test]
+    fn weakest_tier_picks_worst() {
+        let good = ParticipantQuality::new();
+        // good stays at Good tier
+
+        let mut bad = ParticipantQuality::new();
+        let bad_report = make_report(50.0, 300);
+        for _ in 0..5 {
+            bad.observe(&bad_report);
+        }
+        // bad should be degraded or catastrophic
+
+        let participants = vec![good, bad];
+        let weakest = weakest_tier(participants.iter());
+        assert_ne!(weakest, Tier::Good, "weakest should not be Good when one participant is bad");
+    }
 }

crates/wzp-relay/src/signal_hub.rs

@@ -86,6 +86,26 @@ impl SignalHub {
     pub fn alias(&self, fp: &str) -> Option<&str> {
         self.clients.get(fp).and_then(|c| c.alias.as_deref())
     }
+
+    /// Build a PresenceList message with all online users.
+    pub fn presence_list(&self) -> SignalMessage {
+        let users: Vec<wzp_proto::PresenceUser> = self
+            .clients
+            .values()
+            .map(|c| wzp_proto::PresenceUser {
+                fingerprint: c.fingerprint.clone(),
+                alias: c.alias.clone(),
+            })
+            .collect();
+        SignalMessage::PresenceList { users }
+    }
+
+    /// Broadcast a message to ALL connected signal clients.
+    pub async fn broadcast(&self, msg: &SignalMessage) {
+        for client in self.clients.values() {
+            let _ = client.transport.send_signal(msg).await;
+        }
+    }
 }
 
 #[cfg(test)]

crates/wzp-relay/src/ws.rs

@@ -31,7 +31,7 @@ use crate::session_mgr::SessionManager;
 /// Shared state for WebSocket handlers.
 #[derive(Clone)]
 pub struct WsState {
-    pub room_mgr: Arc<Mutex<RoomManager>>,
+    pub room_mgr: Arc<RoomManager>,
     pub session_mgr: Arc<Mutex<SessionManager>>,
     pub auth_url: Option<String>,
     pub metrics: Arc<RelayMetrics>,
@@ -143,10 +143,9 @@ async fn handle_ws_connection(socket: WebSocket, room: String, state: WsState) {
     // 4. Join room with WS sender
     let addr: SocketAddr = ([0, 0, 0, 0], 0).into();
     let participant_id = {
-        let mut mgr = state.room_mgr.lock().await;
-        match mgr.join_ws(&room, addr, tx, fingerprint.as_deref()) {
+        match state.room_mgr.join_ws(&room, addr, tx, fingerprint.as_deref()) {
             Ok(id) => {
-                state.metrics.active_rooms.set(mgr.list().len() as i64);
+                state.metrics.active_rooms.set(state.room_mgr.list().len() as i64);
                 id
             }
             Err(e) => {
@@ -184,10 +183,7 @@ async fn handle_ws_connection(socket: WebSocket, room: String, state: WsState) {
     loop {
         match ws_rx.next().await {
             Some(Ok(Message::Binary(data))) => {
-                let others = {
-                    let mgr = state.room_mgr.lock().await;
-                    mgr.others(&room, participant_id)
-                };
+                let others = state.room_mgr.others(&room, participant_id);
                 for other in &others {
                     let _ = other.send_raw(&data).await;
                 }
@@ -214,11 +210,8 @@ async fn handle_ws_connection(socket: WebSocket, room: String, state: WsState) {
         reg.unregister_local(fp);
     }
 
-    {
-        let mut mgr = state.room_mgr.lock().await;
-        mgr.leave(&room, participant_id);
-        state.metrics.active_rooms.set(mgr.list().len() as i64);
-    }
+    state.room_mgr.leave(&room, participant_id);
+    state.metrics.active_rooms.set(state.room_mgr.list().len() as i64);
 
     let session_id_str: String = session_id.iter().map(|b| format!("{b:02x}")).collect();
     state.metrics.remove_session_metrics(&session_id_str);

crates/wzp-relay/tests/cross_relay_direct_call.rs

@@ -0,0 +1,321 @@
+//! Phase 4 integration test for cross-relay direct calling
+//! (PRD: .taskmaster/docs/prd_phase4_cross_relay_p2p.txt).
+//!
+//! Drives the call-registry cross-wiring + a simulated federation
+//! forward without spinning up actual relay binaries. The real
+//! main-loop and dispatcher code are exercised end-to-end in
+//! `reflect.rs` / `hole_punching.rs` already; this file focuses on
+//! the *new* invariants Phase 4 adds:
+//!
+//! 1. When Relay A forwards a DirectCallOffer, its local registry
+//!    stashes caller_reflexive_addr and leaves peer_relay_fp
+//!    unset (broadcast, answer-side will identify itself).
+//! 2. When Relay B's cross-relay dispatcher receives the forward,
+//!    its local registry stores the call with
+//!    peer_relay_fp = Some(relay_a_tls_fp).
+//! 3. When Relay B processes the local callee's answer, it sees
+//!    peer_relay_fp.is_some() and MUST NOT deliver the answer via
+//!    local signal_hub — instead it routes through federation.
+//! 4. When Relay A receives the forwarded answer via its
+//!    cross-relay dispatcher, it stashes callee_reflexive_addr
+//!    and emits a CallSetup to its local caller with
+//!    peer_direct_addr = callee_addr.
+//! 5. Final state: Alice's CallSetup carries Bob's reflex addr,
+//!    Bob's CallSetup carries Alice's reflex addr — cross-wired
+//!    through two relays + a federation link.
+
+use wzp_proto::{CallAcceptMode, SignalMessage};
+use wzp_relay::call_registry::CallRegistry;
+
+// ────────────────────────────────────────────────────────────────
+// Simulated dispatch helpers — these reproduce the exact logic
+// in main.rs without the tokio + federation boilerplate.
+// ────────────────────────────────────────────────────────────────
+
+const RELAY_A_TLS_FP: &str = "relay-A-tls-fingerprint";
+const RELAY_B_TLS_FP: &str = "relay-B-tls-fingerprint";
+const ALICE_ADDR: &str = "192.0.2.1:4433";
+const BOB_ADDR: &str = "198.51.100.9:4433";
+const RELAY_A_ADDR: &str = "203.0.113.5:4433";
+const RELAY_B_ADDR: &str = "203.0.113.10:4433";
+
+/// Helper that Alice's place_call sends.
+fn alice_offer(call_id: &str) -> SignalMessage {
+    SignalMessage::DirectCallOffer {
+        caller_fingerprint: "alice".into(),
+        caller_alias: None,
+        target_fingerprint: "bob".into(),
+        call_id: call_id.into(),
+        identity_pub: [0; 32],
+        ephemeral_pub: [0; 32],
+        signature: vec![],
+        supported_profiles: vec![],
+        caller_reflexive_addr: Some(ALICE_ADDR.into()),
+        caller_local_addrs: Vec::new(),
+        caller_mapped_addr: None,
+        caller_build_version: None,
+    }
+}
+
+/// Relay A receives Alice's offer. Target Bob is not local.
+/// Relay A wraps + broadcasts over federation, stashes the call
+/// locally with peer_relay_fp = None (broadcast — answer-side
+/// identifies itself).
+fn relay_a_handle_offer(reg_a: &mut CallRegistry, offer: &SignalMessage) -> SignalMessage {
+    match offer {
+        SignalMessage::DirectCallOffer {
+            caller_fingerprint,
+            target_fingerprint,
+            call_id,
+            caller_reflexive_addr,
+            ..
+        } => {
+            reg_a.create_call(
+                call_id.clone(),
+                caller_fingerprint.clone(),
+                target_fingerprint.clone(),
+            );
+            reg_a.set_caller_reflexive_addr(call_id, caller_reflexive_addr.clone());
+            // peer_relay_fp stays None — we don't know which peer
+            // will respond yet.
+        }
+        _ => panic!("not an offer"),
+    }
+    // Build the federation envelope the main loop would
+    // broadcast.
+    SignalMessage::FederatedSignalForward {
+        inner: Box::new(offer.clone()),
+        origin_relay_fp: RELAY_A_TLS_FP.into(),
+    }
+}
+
+/// Relay B receives a FederatedSignalForward(DirectCallOffer).
+/// This is the cross-relay dispatcher task code in main.rs —
+/// reproduced here for the test.
+fn relay_b_handle_forwarded_offer(reg_b: &mut CallRegistry, forward: &SignalMessage) {
+    let (inner, origin_relay_fp) = match forward {
+        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
+            (inner.as_ref().clone(), origin_relay_fp.clone())
+        }
+        _ => panic!("not a forward"),
+    };
+    // Loop-prevention: drop self-sourced.
+    assert_ne!(origin_relay_fp, RELAY_B_TLS_FP);
+
+    let SignalMessage::DirectCallOffer {
+        caller_fingerprint,
+        target_fingerprint,
+        call_id,
+        caller_reflexive_addr,
+        ..
+    } = inner
+    else {
+        panic!("inner was not DirectCallOffer");
+    };
+
+    // Simulated: target is local to B (Bob is registered here).
+    reg_b.create_call(
+        call_id.clone(),
+        caller_fingerprint,
+        target_fingerprint,
+    );
+    reg_b.set_caller_reflexive_addr(&call_id, caller_reflexive_addr);
+    reg_b.set_peer_relay_fp(&call_id, Some(origin_relay_fp));
+}
+
+/// Bob's answer — AcceptTrusted with his reflex addr.
+fn bob_answer(call_id: &str) -> SignalMessage {
+    SignalMessage::DirectCallAnswer {
+        call_id: call_id.into(),
+        accept_mode: CallAcceptMode::AcceptTrusted,
+        identity_pub: None,
+        ephemeral_pub: None,
+        signature: None,
+        chosen_profile: None,
+        callee_reflexive_addr: Some(BOB_ADDR.into()),
+        callee_local_addrs: Vec::new(),
+        callee_mapped_addr: None,
+        callee_build_version: None,
+    }
+}
+
+/// Relay B handles the LOCAL callee's answer. If peer_relay_fp
+/// is Some, wrap the answer in a FederatedSignalForward + emit the
+/// local CallSetup to Bob. Returns the (forward_envelope,
+/// bob_call_setup) pair.
+fn relay_b_handle_local_answer(
+    reg_b: &mut CallRegistry,
+    answer: &SignalMessage,
+) -> (SignalMessage, SignalMessage) {
+    let (call_id, mode, callee_addr) = match answer {
+        SignalMessage::DirectCallAnswer {
+            call_id,
+            accept_mode,
+            callee_reflexive_addr,
+            ..
+        } => (call_id.clone(), *accept_mode, callee_reflexive_addr.clone()),
+        _ => panic!(),
+    };
+    // Stash callee addr + activate.
+    reg_b.set_active(&call_id, mode, format!("call-{call_id}"));
+    reg_b.set_callee_reflexive_addr(&call_id, callee_addr);
+    let call = reg_b.get(&call_id).unwrap();
+    let caller_addr = call.caller_reflexive_addr.clone();
+    let callee_addr = call.callee_reflexive_addr.clone();
+    assert!(
+        call.peer_relay_fp.is_some(),
+        "Relay B must know this call is cross-relay"
+    );
+
+    // Forward the answer back over federation.
+    let forward = SignalMessage::FederatedSignalForward {
+        inner: Box::new(answer.clone()),
+        origin_relay_fp: RELAY_B_TLS_FP.into(),
+    };
+
+    // Local CallSetup for Bob — peer_direct_addr = Alice's addr.
+    let setup_for_bob = SignalMessage::CallSetup {
+        call_id: call_id.clone(),
+        room: format!("call-{call_id}"),
+        relay_addr: RELAY_B_ADDR.into(),
+        peer_direct_addr: caller_addr,
+        peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
+    };
+    let _ = callee_addr;
+    (forward, setup_for_bob)
+}
+
+/// Relay A's cross-relay dispatcher receives the forwarded answer.
+/// It stashes the callee addr, forwards the raw answer to local
+/// Alice, and emits a CallSetup with peer_direct_addr = Bob's addr.
+fn relay_a_handle_forwarded_answer(
+    reg_a: &mut CallRegistry,
+    forward: &SignalMessage,
+) -> SignalMessage {
+    let (inner, origin_relay_fp) = match forward {
+        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
+            (inner.as_ref().clone(), origin_relay_fp.clone())
+        }
+        _ => panic!("not a forward"),
+    };
+    assert_ne!(origin_relay_fp, RELAY_A_TLS_FP);
+
+    let SignalMessage::DirectCallAnswer {
+        call_id,
+        accept_mode,
+        callee_reflexive_addr,
+        ..
+    } = inner
+    else {
+        panic!("inner was not DirectCallAnswer");
+    };
+    assert_eq!(accept_mode, CallAcceptMode::AcceptTrusted);
+
+    reg_a.set_active(&call_id, accept_mode, format!("call-{call_id}"));
+    reg_a.set_callee_reflexive_addr(&call_id, callee_reflexive_addr.clone());
+
+    // Alice's CallSetup — peer_direct_addr = Bob's addr.
+    SignalMessage::CallSetup {
+        call_id: call_id.clone(),
+        room: format!("call-{call_id}"),
+        relay_addr: RELAY_A_ADDR.into(),
+        peer_direct_addr: callee_reflexive_addr,
+        peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
+    }
+}
+
+// ────────────────────────────────────────────────────────────────
+// Tests
+// ────────────────────────────────────────────────────────────────
+
+#[test]
+fn cross_relay_offer_forwards_and_stashes_peer_relay_fp() {
+    let mut reg_a = CallRegistry::new();
+    let mut reg_b = CallRegistry::new();
+
+    let offer = alice_offer("c-xrelay-1");
+    let forward = relay_a_handle_offer(&mut reg_a, &offer);
+
+    // Relay A's local view: call exists, caller addr stashed,
+    // peer_relay_fp still None (broadcast — answer identifies the
+    // peer).
+    let call_a = reg_a.get("c-xrelay-1").unwrap();
+    assert_eq!(call_a.caller_fingerprint, "alice");
+    assert_eq!(call_a.callee_fingerprint, "bob");
+    assert_eq!(call_a.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
+    assert!(call_a.peer_relay_fp.is_none());
+
+    // Relay B dispatches the forward: creates the call locally
+    // and stashes peer_relay_fp = Relay A.
+    relay_b_handle_forwarded_offer(&mut reg_b, &forward);
+    let call_b = reg_b.get("c-xrelay-1").unwrap();
+    assert_eq!(call_b.caller_fingerprint, "alice");
+    assert_eq!(call_b.callee_fingerprint, "bob");
+    assert_eq!(call_b.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
+    assert_eq!(call_b.peer_relay_fp.as_deref(), Some(RELAY_A_TLS_FP));
+}
+
+#[test]
+fn cross_relay_answer_crosswires_peer_direct_addrs() {
+    let mut reg_a = CallRegistry::new();
+    let mut reg_b = CallRegistry::new();
+
+    // Full round trip: offer → forward → dispatch → answer →
+    // forward back → dispatch → both CallSetups.
+    let offer = alice_offer("c-xrelay-2");
+    let offer_forward = relay_a_handle_offer(&mut reg_a, &offer);
+    relay_b_handle_forwarded_offer(&mut reg_b, &offer_forward);
+
+    // Bob answers on Relay B.
+    let answer = bob_answer("c-xrelay-2");
+    let (answer_forward, setup_for_bob) =
+        relay_b_handle_local_answer(&mut reg_b, &answer);
+
+    // Bob's CallSetup carries Alice's addr.
+    match setup_for_bob {
+        SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
+            assert_eq!(peer_direct_addr.as_deref(), Some(ALICE_ADDR));
+            assert_eq!(relay_addr, RELAY_B_ADDR);
+        }
+        _ => panic!("wrong variant"),
+    }
+
+    // Alice's dispatcher receives the forwarded answer and builds
+    // her CallSetup.
+    let setup_for_alice = relay_a_handle_forwarded_answer(&mut reg_a, &answer_forward);
+    match setup_for_alice {
+        SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
+            assert_eq!(peer_direct_addr.as_deref(), Some(BOB_ADDR));
+            assert_eq!(relay_addr, RELAY_A_ADDR);
+        }
+        _ => panic!("wrong variant"),
+    }
+
+    // Both registries agree on caller + callee reflex addrs after
+    // the full round-trip.
+    for reg in [&reg_a, &reg_b] {
+        let c = reg.get("c-xrelay-2").unwrap();
+        assert_eq!(c.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
+        assert_eq!(c.callee_reflexive_addr.as_deref(), Some(BOB_ADDR));
+    }
+}
+
+#[test]
+fn cross_relay_loop_prevention_drops_self_sourced_forward() {
+    // A FederatedSignalForward that circles back to the origin
+    // relay should be dropped before it hits the call registry.
+    let forward = SignalMessage::FederatedSignalForward {
+        inner: Box::new(alice_offer("c-loop")),
+        origin_relay_fp: RELAY_B_TLS_FP.into(),
+    };
+    // The dispatcher in main.rs calls this explicit check before
+    // doing any work. Reproduce it inline.
+    let origin = match &forward {
+        SignalMessage::FederatedSignalForward { origin_relay_fp, .. } => origin_relay_fp.clone(),
+        _ => unreachable!(),
+    };
+    // Relay B sees origin == its own fp → drop.
+    assert_eq!(origin, RELAY_B_TLS_FP, "loop-prevention triggers on self-fp");
+}

crates/wzp-relay/tests/federation.rs

@@ -0,0 +1,662 @@
+//! Tests for `wzp_relay::federation`.
+//!
+//! Covers:
+//!  - room_hash determinism and uniqueness
+//!  - is_global_room (static config + call-* implicit global)
+//!  - resolve_global_room
+//!  - global_room_hash
+//!  - forward_to_peers with zero peers (no-op)
+//!  - forward_to_peers with live QUIC peer links
+//!  - broadcast_signal to live QUIC peers
+//!  - send_signal_to_peer targeted routing
+//!  - find_peer_by_fingerprint / find_peer_by_addr / check_inbound_trust
+//!  - set_cross_relay_tx + local_tls_fp accessors
+
+use std::collections::HashSet;
+use std::net::{Ipv4Addr, SocketAddr};
+use std::sync::Arc;
+use std::time::Duration;
+
+use bytes::Bytes;
+use wzp_proto::{MediaTransport, SignalMessage};
+use wzp_relay::config::{PeerConfig, TrustedConfig};
+use wzp_relay::event_log::EventLogger;
+use wzp_relay::federation::{room_hash, FederationManager};
+use wzp_relay::metrics::RelayMetrics;
+use wzp_relay::room::RoomManager;
+use wzp_transport::{client_config, create_endpoint, server_config, QuinnTransport};
+
+// ───────────────────────────── helpers ──────────────────────────────
+
+/// Create a FederationManager for unit tests (no live peers).
+fn create_test_fm(global_rooms: HashSet<String>) -> Arc<FederationManager> {
+    create_test_fm_full(vec![], vec![], global_rooms)
+}
+
+/// Create a FederationManager with full config (peers + trusted + global rooms).
+fn create_test_fm_full(
+    peers: Vec<PeerConfig>,
+    trusted: Vec<TrustedConfig>,
+    global_rooms: HashSet<String>,
+) -> Arc<FederationManager> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let (sc, _cert) = server_config();
+    let ep = create_endpoint((Ipv4Addr::LOCALHOST, 0).into(), Some(sc))
+        .expect("test endpoint");
+    let room_mgr = Arc::new(RoomManager::new());
+    let metrics = Arc::new(RelayMetrics::new());
+    let event_log = EventLogger::Noop;
+
+    Arc::new(FederationManager::new(
+        peers,
+        trusted,
+        global_rooms,
+        room_mgr,
+        ep,
+        "test-relay-fp-abc123".into(),
+        metrics,
+        event_log,
+    ))
+}
+
+/// Build an in-process QUIC client/server pair on loopback.
+/// Returns (client_transport, server_transport, endpoints).
+/// The endpoints must be kept alive for the test duration.
+async fn connected_pair() -> (
+    Arc<QuinnTransport>,
+    Arc<QuinnTransport>,
+    (quinn::Endpoint, quinn::Endpoint),
+) {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    let (sc, _cert_der) = server_config();
+    let server_addr: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let server_ep = create_endpoint(server_addr, Some(sc)).expect("server endpoint");
+    let server_listen = server_ep.local_addr().expect("server local addr");
+
+    let client_bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let client_ep = create_endpoint(client_bind, None).expect("client endpoint");
+
+    let server_ep_clone = server_ep.clone();
+    let accept_fut = tokio::spawn(async move {
+        let conn = wzp_transport::accept(&server_ep_clone)
+            .await
+            .expect("accept");
+        Arc::new(QuinnTransport::new(conn))
+    });
+
+    let client_conn =
+        wzp_transport::connect(&client_ep, server_listen, "localhost", client_config())
+            .await
+            .expect("connect");
+    let client_transport = Arc::new(QuinnTransport::new(client_conn));
+    let server_transport = accept_fut.await.expect("join accept task");
+
+    (client_transport, server_transport, (server_ep, client_ep))
+}
+
+// ───────────────────── 1. room_hash determinism ─────────────────────
+
+#[test]
+fn room_hash_deterministic() {
+    let h1 = room_hash("podcast");
+    let h2 = room_hash("podcast");
+    assert_eq!(h1, h2);
+}
+
+#[test]
+fn room_hash_different_rooms() {
+    let h1 = room_hash("room-a");
+    let h2 = room_hash("room-b");
+    assert_ne!(h1, h2);
+}
+
+#[test]
+fn room_hash_is_8_bytes() {
+    let h = room_hash("some-room");
+    assert_eq!(h.len(), 8);
+}
+
+#[test]
+fn room_hash_empty_string() {
+    // Should not panic on empty input
+    let h = room_hash("");
+    assert_eq!(h.len(), 8);
+    // And should differ from a non-empty room
+    assert_ne!(h, room_hash("nonempty"));
+}
+
+#[test]
+fn room_hash_case_sensitive() {
+    // "Podcast" and "podcast" are different rooms
+    let h1 = room_hash("Podcast");
+    let h2 = room_hash("podcast");
+    assert_ne!(h1, h2);
+}
+
+// ───────────────── 2. is_global_room / resolve_global_room ──────────
+
+#[tokio::test]
+async fn is_global_room_static_config() {
+    let global: HashSet<String> = ["podcast", "lobby"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm(global);
+
+    assert!(fm.is_global_room("podcast"));
+    assert!(fm.is_global_room("lobby"));
+    assert!(!fm.is_global_room("private-room"));
+    assert!(!fm.is_global_room(""));
+}
+
+#[tokio::test]
+async fn is_global_room_call_prefix_implicit() {
+    // Phase 4.1: call-* rooms are implicitly global
+    let fm = create_test_fm(HashSet::new());
+
+    assert!(fm.is_global_room("call-abc123"));
+    assert!(fm.is_global_room("call-"));
+    assert!(fm.is_global_room("call-some-uuid-here"));
+    // But not just "call" without the dash
+    assert!(!fm.is_global_room("call"));
+    assert!(!fm.is_global_room("callback"));
+}
+
+#[tokio::test]
+async fn resolve_global_room_static() {
+    let global: HashSet<String> = ["podcast"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm(global);
+
+    assert_eq!(fm.resolve_global_room("podcast"), Some("podcast".into()));
+    assert_eq!(fm.resolve_global_room("unknown"), None);
+}
+
+#[tokio::test]
+async fn resolve_global_room_call_prefix() {
+    let fm = create_test_fm(HashSet::new());
+
+    let resolved = fm.resolve_global_room("call-test-123");
+    assert_eq!(resolved, Some("call-test-123".into()));
+}
+
+#[tokio::test]
+async fn global_room_hash_uses_canonical_name() {
+    let global: HashSet<String> = ["podcast"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm(global);
+
+    // For a known global room, global_room_hash should match room_hash of the canonical name
+    let expected = room_hash("podcast");
+    assert_eq!(fm.global_room_hash("podcast"), expected);
+}
+
+#[tokio::test]
+async fn global_room_hash_unknown_room_falls_through() {
+    let fm = create_test_fm(HashSet::new());
+
+    // Unknown room: just hashes whatever was passed
+    let expected = room_hash("random-room");
+    assert_eq!(fm.global_room_hash("random-room"), expected);
+}
+
+#[tokio::test]
+async fn global_room_hash_call_prefix() {
+    let fm = create_test_fm(HashSet::new());
+
+    // call-* resolves to itself
+    let expected = room_hash("call-xyz");
+    assert_eq!(fm.global_room_hash("call-xyz"), expected);
+}
+
+// ───────────────── 3. forward_to_peers with zero peers ──────────────
+
+#[tokio::test]
+async fn forward_to_peers_empty_returns_immediately() {
+    let fm = create_test_fm(HashSet::new());
+    let hash = room_hash("room");
+    let data = Bytes::from_static(b"test-media-payload");
+
+    // Should not panic or hang
+    let result = tokio::time::timeout(
+        Duration::from_secs(2),
+        fm.forward_to_peers("room", &hash, &data),
+    )
+    .await;
+    assert!(result.is_ok(), "forward_to_peers should return immediately with no peers");
+}
+
+// ─────────── 4. forward_to_peers with live QUIC peer links ──────────
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn forward_to_peers_delivers_tagged_datagram() {
+    // We create a FederationManager and manually wire a connected QUIC
+    // pair to simulate a peer link. The fm holds the server-side
+    // transport; we read from the client side to verify delivery.
+    let fm = create_test_fm(HashSet::new());
+
+    let (client_transport, server_transport, _endpoints) = connected_pair().await;
+
+    // Manually insert a PeerLink by using handle_inbound's internal
+    // pattern: we call the private peer_links mutex directly. Since
+    // PeerLink is private, we instead use handle_inbound which calls
+    // run_federation_link. But that requires a full signal loop.
+    //
+    // Alternative approach: spawn a mock "federation relay" server,
+    // have the FM connect to it via connect_to_peer, and read back
+    // from the server side. But connect_to_peer also starts the full
+    // link loop.
+    //
+    // Simplest: create a second FM that acts as the peer, and use
+    // the broadcast_signal / forward_to_peers pattern after the link
+    // is established via handle_inbound.
+    //
+    // Actually the simplest approach for testing forward_to_peers is
+    // to accept that PeerLink is private, so we instead test through
+    // the full federation link lifecycle. We'll spawn a mini relay
+    // that does the FederationHello handshake and then reads datagrams.
+
+    // Approach: spawn the server side to do the hello exchange, then
+    // the fm handle_inbound will register the link, then we can call
+    // forward_to_peers and read from the server side... But
+    // handle_inbound blocks in run_federation_link.
+    //
+    // Final approach: we test the wire format directly. The client
+    // side is "us" (the relay) — we send a tagged datagram manually,
+    // and verify the peer side receives it with the correct format.
+    // This tests the same logic as forward_to_peers without needing
+    // peer_links access.
+
+    let room = "test-room";
+    let rh = room_hash(room);
+    let media = b"opus-frame-data-here";
+
+    // Build the tagged datagram the same way forward_to_peers does
+    let mut tagged = Vec::with_capacity(8 + media.len());
+    tagged.extend_from_slice(&rh);
+    tagged.extend_from_slice(media);
+
+    // Send from the server side (as if we are the relay forwarding)
+    server_transport
+        .send_raw_datagram(&tagged)
+        .expect("send datagram");
+
+    // Read from client side (as if we are the peer relay receiving)
+    let received = tokio::time::timeout(
+        Duration::from_secs(2),
+        client_transport.connection().read_datagram(),
+    )
+    .await
+    .expect("should receive within timeout")
+    .expect("read_datagram ok");
+
+    // Verify: first 8 bytes are the room hash, remainder is media
+    assert!(received.len() >= 8, "datagram too short");
+    let mut recv_hash = [0u8; 8];
+    recv_hash.copy_from_slice(&received[..8]);
+    assert_eq!(recv_hash, rh, "room hash mismatch");
+    assert_eq!(&received[8..], media, "media payload mismatch");
+
+    drop(client_transport);
+    drop(server_transport);
+}
+
+// ─────────── 5. broadcast_signal to live QUIC peers ─────────────────
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn broadcast_signal_sends_to_all_peers() {
+    // We need the peer links to be registered inside the FM.
+    // The simplest approach: spawn a mock peer relay that accepts
+    // federation connections, does the FederationHello handshake,
+    // and then reads signals.
+
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    // Create a mock "peer relay" server endpoint
+    let (sc, _cert) = server_config();
+    let peer_addr: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let peer_ep = create_endpoint(peer_addr, Some(sc)).expect("peer endpoint");
+    let peer_listen = peer_ep.local_addr().expect("peer local addr");
+
+    // The FM that will connect outbound
+    let peer_cfg = PeerConfig {
+        url: peer_listen.to_string(),
+        fingerprint: "aa:bb:cc:dd".into(),
+        label: Some("mock-peer".into()),
+    };
+    let global: HashSet<String> = ["podcast"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm_full(vec![peer_cfg], vec![], global);
+
+    // Spawn the FM's run (which will try to connect to our mock peer)
+    let fm_clone = fm.clone();
+    let _fm_task = tokio::spawn(async move {
+        fm_clone.run().await;
+    });
+
+    // Accept the connection on the mock peer side
+    let peer_ep_clone = peer_ep.clone();
+    let peer_transport = tokio::time::timeout(Duration::from_secs(5), async {
+        let conn = wzp_transport::accept(&peer_ep_clone).await.expect("accept");
+        Arc::new(QuinnTransport::new(conn))
+    })
+    .await
+    .expect("FM should connect to mock peer within 5s");
+
+    // The FM sends FederationHello as the first signal. Read it.
+    let hello = tokio::time::timeout(
+        Duration::from_secs(2),
+        peer_transport.recv_signal(),
+    )
+    .await
+    .expect("hello timeout")
+    .expect("recv ok")
+    .expect("some message");
+
+    match hello {
+        SignalMessage::FederationHello { tls_fingerprint } => {
+            assert_eq!(tls_fingerprint, "test-relay-fp-abc123");
+        }
+        other => panic!("expected FederationHello, got: {:?}", std::mem::discriminant(&other)),
+    }
+
+    // Now the FM's run_federation_link registered the peer in peer_links
+    // and will announce active global rooms. We may receive
+    // GlobalRoomActive signals next (for any rooms the FM has active).
+    // For this test, no local participants, so no GlobalRoomActive.
+
+    // Give the link time to fully set up
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    // Now call broadcast_signal on the FM
+    let test_msg = SignalMessage::FederatedSignalForward {
+        inner: Box::new(SignalMessage::Reflect),
+        origin_relay_fp: "other-relay-fp".into(),
+    };
+    let count = fm.broadcast_signal(&test_msg).await;
+    assert_eq!(count, 1, "should have broadcast to exactly 1 peer");
+
+    // Read the signal on the peer side
+    let received = tokio::time::timeout(
+        Duration::from_secs(2),
+        peer_transport.recv_signal(),
+    )
+    .await
+    .expect("broadcast signal timeout")
+    .expect("recv ok")
+    .expect("some message");
+
+    match received {
+        SignalMessage::FederatedSignalForward { origin_relay_fp, .. } => {
+            assert_eq!(origin_relay_fp, "other-relay-fp");
+        }
+        other => panic!("expected FederatedSignalForward, got: {:?}", std::mem::discriminant(&other)),
+    }
+
+    drop(peer_transport);
+}
+
+// ──────────── 6. send_signal_to_peer targeted routing ───────────────
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn send_signal_to_peer_unknown_fp_returns_error() {
+    let fm = create_test_fm(HashSet::new());
+
+    let msg = SignalMessage::Reflect;
+    let result = fm.send_signal_to_peer("nonexistent-fp", &msg).await;
+    assert!(result.is_err());
+    assert!(result.unwrap_err().contains("no active federation link"));
+}
+
+// ──────────── 7. find_peer_by_fingerprint / addr / trust ────────────
+
+#[tokio::test]
+async fn find_peer_by_fingerprint_matches() {
+    let peer = PeerConfig {
+        url: "10.0.0.1:4433".into(),
+        fingerprint: "AA:BB:CC:DD".into(),
+        label: Some("relay-eu".into()),
+    };
+    let fm = create_test_fm_full(vec![peer], vec![], HashSet::new());
+
+    // Normalized match (colons removed, lowercased)
+    let found = fm.find_peer_by_fingerprint("aabbccdd");
+    assert!(found.is_some());
+    assert_eq!(found.unwrap().label.as_deref(), Some("relay-eu"));
+
+    // With colons
+    let found2 = fm.find_peer_by_fingerprint("AA:BB:CC:DD");
+    assert!(found2.is_some());
+
+    // Non-matching
+    assert!(fm.find_peer_by_fingerprint("11:22:33:44").is_none());
+}
+
+#[tokio::test]
+async fn find_peer_by_addr_matches_ip() {
+    let peer = PeerConfig {
+        url: "10.0.0.1:4433".into(),
+        fingerprint: "aabb".into(),
+        label: None,
+    };
+    let fm = create_test_fm_full(vec![peer], vec![], HashSet::new());
+
+    // Same IP, different port still matches (find_peer_by_addr matches by IP)
+    let addr: SocketAddr = "10.0.0.1:9999".parse().unwrap();
+    let found = fm.find_peer_by_addr(addr);
+    assert!(found.is_some());
+
+    // Different IP
+    let addr2: SocketAddr = "10.0.0.2:4433".parse().unwrap();
+    assert!(fm.find_peer_by_addr(addr2).is_none());
+}
+
+#[tokio::test]
+async fn find_trusted_by_fingerprint() {
+    let trusted = TrustedConfig {
+        fingerprint: "AA:BB:CC:DD:EE".into(),
+        label: Some("trusted-relay".into()),
+    };
+    let fm = create_test_fm_full(vec![], vec![trusted], HashSet::new());
+
+    let found = fm.find_trusted_by_fingerprint("aabbccddee");
+    assert!(found.is_some());
+    assert_eq!(found.unwrap().label.as_deref(), Some("trusted-relay"));
+
+    assert!(fm.find_trusted_by_fingerprint("ffffffff").is_none());
+}
+
+#[tokio::test]
+async fn check_inbound_trust_prefers_peer_by_addr() {
+    let peer = PeerConfig {
+        url: "10.0.0.1:4433".into(),
+        fingerprint: "aabb".into(),
+        label: Some("peer-relay".into()),
+    };
+    let trusted = TrustedConfig {
+        fingerprint: "ccdd".into(),
+        label: Some("trusted-relay".into()),
+    };
+    let fm = create_test_fm_full(vec![peer], vec![trusted], HashSet::new());
+
+    // Matches by addr (peer takes priority)
+    let addr: SocketAddr = "10.0.0.1:5555".parse().unwrap();
+    let label = fm.check_inbound_trust(addr, "ccdd");
+    assert_eq!(label, Some("peer-relay".into()));
+}
+
+#[tokio::test]
+async fn check_inbound_trust_falls_back_to_trusted_fp() {
+    let trusted = TrustedConfig {
+        fingerprint: "CC:DD".into(),
+        label: Some("trusted-relay".into()),
+    };
+    let fm = create_test_fm_full(vec![], vec![trusted], HashSet::new());
+
+    // No peer matches, but trusted fingerprint matches
+    let addr: SocketAddr = "10.99.99.99:1234".parse().unwrap();
+    let label = fm.check_inbound_trust(addr, "ccdd");
+    assert_eq!(label, Some("trusted-relay".into()));
+}
+
+#[tokio::test]
+async fn check_inbound_trust_returns_none_for_unknown() {
+    let fm = create_test_fm(HashSet::new());
+    let addr: SocketAddr = "10.0.0.1:4433".parse().unwrap();
+    assert!(fm.check_inbound_trust(addr, "unknown-fp").is_none());
+}
+
+// ──────────── 8. set_cross_relay_tx + local_tls_fp ──────────────────
+
+#[tokio::test]
+async fn local_tls_fp_returns_configured_value() {
+    let fm = create_test_fm(HashSet::new());
+    assert_eq!(fm.local_tls_fp(), "test-relay-fp-abc123");
+}
+
+#[tokio::test]
+async fn set_cross_relay_tx_wires_channel() {
+    let fm = create_test_fm(HashSet::new());
+    let (tx, mut rx) = tokio::sync::mpsc::channel(16);
+
+    fm.set_cross_relay_tx(tx).await;
+
+    // The channel is now wired — we can't easily test it without
+    // going through handle_signal, but we can at least verify it
+    // doesn't panic and the fm accepted the sender.
+    // (The channel itself works — we test the Sender.)
+    let msg = SignalMessage::Reflect;
+    let _ = rx.try_recv(); // should be empty
+    drop(rx);
+}
+
+// ──────────── 9. broadcast_signal with zero peers ───────────────────
+
+#[tokio::test]
+async fn broadcast_signal_zero_peers_returns_zero() {
+    let fm = create_test_fm(HashSet::new());
+    let msg = SignalMessage::Reflect;
+    let count = fm.broadcast_signal(&msg).await;
+    assert_eq!(count, 0);
+}
+
+// ──────────── 10. get_remote_participants with no links ─────────────
+
+#[tokio::test]
+async fn get_remote_participants_empty_with_no_links() {
+    let fm = create_test_fm(HashSet::new());
+    let participants = fm.get_remote_participants("podcast").await;
+    assert!(participants.is_empty());
+}
+
+// ─────── 11. Federation media egress with live QUIC connection ──────
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn federation_media_egress_forwards_to_peer() {
+    // This test verifies the full media path:
+    //   local media -> federation egress channel -> forward_to_peers -> peer reads datagram
+    //
+    // We set up a real QUIC federation link via fm.run() connecting to
+    // a mock peer, then push media through the room manager's federation
+    // egress channel.
+
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    // Mock peer relay
+    let (sc, _cert) = server_config();
+    let peer_addr: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let peer_ep = create_endpoint(peer_addr, Some(sc)).expect("peer endpoint");
+    let peer_listen = peer_ep.local_addr().expect("peer local addr");
+
+    let peer_cfg = PeerConfig {
+        url: peer_listen.to_string(),
+        fingerprint: "ee:ff:00:11".into(),
+        label: Some("egress-peer".into()),
+    };
+    let global: HashSet<String> = ["podcast"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm_full(vec![peer_cfg], vec![], global);
+
+    // Start the FM (connects to mock peer)
+    let fm_clone = fm.clone();
+    let _fm_task = tokio::spawn(async move { fm_clone.run().await });
+
+    // Accept the connection
+    let peer_ep_clone = peer_ep.clone();
+    let peer_transport = tokio::time::timeout(Duration::from_secs(5), async {
+        let conn = wzp_transport::accept(&peer_ep_clone).await.expect("accept");
+        Arc::new(QuinnTransport::new(conn))
+    })
+    .await
+    .expect("FM should connect within 5s");
+
+    // Read the FederationHello
+    let _hello = tokio::time::timeout(
+        Duration::from_secs(2),
+        peer_transport.recv_signal(),
+    )
+    .await
+    .expect("hello timeout")
+    .expect("recv ok")
+    .expect("some message");
+
+    // Wait for link setup
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    // Now send media via forward_to_peers
+    let room = "podcast";
+    let rh = room_hash(room);
+    let media_payload = Bytes::from_static(b"test-opus-frame-1234567890");
+
+    fm.forward_to_peers(room, &rh, &media_payload).await;
+
+    // Read the datagram on the peer side
+    let received = tokio::time::timeout(
+        Duration::from_secs(2),
+        peer_transport.connection().read_datagram(),
+    )
+    .await
+    .expect("should receive media within timeout")
+    .expect("read_datagram ok");
+
+    // Verify tagged format: [8-byte room_hash][media_payload]
+    assert!(received.len() >= 8);
+    let mut recv_hash = [0u8; 8];
+    recv_hash.copy_from_slice(&received[..8]);
+    assert_eq!(recv_hash, rh, "room hash must match");
+    assert_eq!(
+        &received[8..],
+        &media_payload[..],
+        "media payload must match"
+    );
+
+    drop(peer_transport);
+}
+
+// ───── 12. Multiple global rooms: each hashes independently ─────────
+
+#[tokio::test]
+async fn multiple_global_rooms_independent_hashes() {
+    let global: HashSet<String> = ["podcast", "lobby", "arena"]
+        .iter()
+        .map(|s| s.to_string())
+        .collect();
+    let fm = create_test_fm(global);
+
+    let hashes: Vec<[u8; 8]> = ["podcast", "lobby", "arena"]
+        .iter()
+        .map(|r| fm.global_room_hash(r))
+        .collect();
+
+    // All different
+    assert_ne!(hashes[0], hashes[1]);
+    assert_ne!(hashes[1], hashes[2]);
+    assert_ne!(hashes[0], hashes[2]);
+}
+
+// ───── 13. is_global_room edge cases ────────────────────────────────
+
+#[tokio::test]
+async fn is_global_room_exact_match_required_for_static() {
+    let global: HashSet<String> = ["podcast"].iter().map(|s| s.to_string()).collect();
+    let fm = create_test_fm(global);
+
+    // Substring/prefix should NOT match
+    assert!(!fm.is_global_room("podcast-extra"));
+    assert!(!fm.is_global_room("pod"));
+    assert!(!fm.is_global_room("podcastt"));
+}

crates/wzp-relay/tests/hole_punching.rs

@@ -0,0 +1,298 @@
+//! Phase 3 integration tests for hole-punching advertising
+//! (PRD: .taskmaster/docs/prd_hole_punching.txt).
+//!
+//! These verify the end-to-end protocol cross-wiring:
+//!   caller (places offer with caller_reflexive_addr=A)
+//!     → relay (stashes A in registry)
+//!       → callee (reads A off the forwarded offer)
+//!   callee (sends AcceptTrusted answer with callee_reflexive_addr=B)
+//!     → relay (stashes B, emits CallSetup to both parties)
+//!       → caller receives CallSetup.peer_direct_addr = B
+//!       → callee receives CallSetup.peer_direct_addr = A
+//!
+//! The actual QUIC hole-punch race is a Phase 3.5 follow-up.
+//! These tests only cover the signal-plane plumbing — that the
+//! addrs make it from each peer's offer/answer through the relay
+//! cross-wiring back out in CallSetup with the peer's addr.
+//!
+//! We drive the call registry + a minimal routing function
+//! directly instead of spinning up a full relay process — easier
+//! to reason about, no real network, and what we actually want to
+//! test is the cross-wiring logic, not the whole signal stack.
+
+use wzp_proto::{CallAcceptMode, SignalMessage};
+use wzp_relay::call_registry::CallRegistry;
+
+/// Helper: simulate the relay's handling of a DirectCallOffer. In
+/// `wzp-relay/src/main.rs` this is the match arm that creates the
+/// call in the registry and stashes the caller's reflex addr.
+fn handle_offer(reg: &mut CallRegistry, offer: &SignalMessage) -> String {
+    match offer {
+        SignalMessage::DirectCallOffer {
+            caller_fingerprint,
+            target_fingerprint,
+            call_id,
+            caller_reflexive_addr,
+            ..
+        } => {
+            reg.create_call(
+                call_id.clone(),
+                caller_fingerprint.clone(),
+                target_fingerprint.clone(),
+            );
+            reg.set_caller_reflexive_addr(call_id, caller_reflexive_addr.clone());
+            call_id.clone()
+        }
+        _ => panic!("not an offer"),
+    }
+}
+
+/// Helper: simulate the relay's handling of a DirectCallAnswer +
+/// the subsequent CallSetup emission. Returns the two CallSetup
+/// messages the relay would push: (for_caller, for_callee).
+fn handle_answer_and_build_setups(
+    reg: &mut CallRegistry,
+    answer: &SignalMessage,
+) -> (SignalMessage, SignalMessage) {
+    let (call_id, mode, callee_addr) = match answer {
+        SignalMessage::DirectCallAnswer {
+            call_id,
+            accept_mode,
+            callee_reflexive_addr,
+            ..
+        } => (call_id.clone(), *accept_mode, callee_reflexive_addr.clone()),
+        _ => panic!("not an answer"),
+    };
+
+    reg.set_callee_reflexive_addr(&call_id, callee_addr);
+    let room = format!("call-{call_id}");
+    reg.set_active(&call_id, mode, room.clone());
+
+    let (caller_addr, callee_addr) = {
+        let c = reg.get(&call_id).unwrap();
+        (
+            c.caller_reflexive_addr.clone(),
+            c.callee_reflexive_addr.clone(),
+        )
+    };
+
+    let setup_for_caller = SignalMessage::CallSetup {
+        call_id: call_id.clone(),
+        room: room.clone(),
+        relay_addr: "203.0.113.5:4433".into(),
+        peer_direct_addr: callee_addr,
+        peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
+    };
+    let setup_for_callee = SignalMessage::CallSetup {
+        call_id,
+        room,
+        relay_addr: "203.0.113.5:4433".into(),
+        peer_direct_addr: caller_addr,
+        peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
+    };
+    (setup_for_caller, setup_for_callee)
+}
+
+fn mk_offer(call_id: &str, caller_reflexive_addr: Option<&str>) -> SignalMessage {
+    SignalMessage::DirectCallOffer {
+        caller_fingerprint: "alice".into(),
+        caller_alias: None,
+        target_fingerprint: "bob".into(),
+        call_id: call_id.into(),
+        identity_pub: [0; 32],
+        ephemeral_pub: [0; 32],
+        signature: vec![],
+        supported_profiles: vec![],
+        caller_reflexive_addr: caller_reflexive_addr.map(String::from),
+        caller_local_addrs: Vec::new(),
+        caller_mapped_addr: None,
+        caller_build_version: None,
+    }
+}
+
+fn mk_answer(
+    call_id: &str,
+    mode: CallAcceptMode,
+    callee_reflexive_addr: Option<&str>,
+) -> SignalMessage {
+    SignalMessage::DirectCallAnswer {
+        call_id: call_id.into(),
+        accept_mode: mode,
+        identity_pub: None,
+        ephemeral_pub: None,
+        signature: None,
+        chosen_profile: None,
+        callee_reflexive_addr: callee_reflexive_addr.map(String::from),
+        callee_local_addrs: Vec::new(),
+        callee_mapped_addr: None,
+        callee_build_version: None,
+    }
+}
+
+// -----------------------------------------------------------------------
+// Test 1: both peers advertise — CallSetup cross-wires correctly
+// -----------------------------------------------------------------------
+
+#[test]
+fn both_peers_advertise_reflex_addrs_cross_wire_in_setup() {
+    let mut reg = CallRegistry::new();
+
+    let caller_addr = "192.0.2.1:4433";
+    let callee_addr = "198.51.100.9:4433";
+
+    let offer = mk_offer("c1", Some(caller_addr));
+    let call_id = handle_offer(&mut reg, &offer);
+    assert_eq!(call_id, "c1");
+    assert_eq!(
+        reg.get("c1").unwrap().caller_reflexive_addr.as_deref(),
+        Some(caller_addr)
+    );
+
+    let answer = mk_answer("c1", CallAcceptMode::AcceptTrusted, Some(callee_addr));
+    let (setup_caller, setup_callee) =
+        handle_answer_and_build_setups(&mut reg, &answer);
+
+    // The CALLER's setup should carry the CALLEE's addr as peer_direct_addr.
+    match setup_caller {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            assert_eq!(
+                peer_direct_addr.as_deref(),
+                Some(callee_addr),
+                "caller's CallSetup must contain callee's addr"
+            );
+        }
+        _ => panic!("wrong variant"),
+    }
+
+    // The CALLEE's setup should carry the CALLER's addr.
+    match setup_callee {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            assert_eq!(
+                peer_direct_addr.as_deref(),
+                Some(caller_addr),
+                "callee's CallSetup must contain caller's addr"
+            );
+        }
+        _ => panic!("wrong variant"),
+    }
+}
+
+// -----------------------------------------------------------------------
+// Test 2: callee uses AcceptGeneric (privacy) — no addr leaks
+// -----------------------------------------------------------------------
+
+#[test]
+fn privacy_mode_answer_omits_callee_addr_from_setup() {
+    let mut reg = CallRegistry::new();
+    let caller_addr = "192.0.2.1:4433";
+
+    handle_offer(&mut reg, &mk_offer("c2", Some(caller_addr)));
+
+    // AcceptGeneric explicitly passes None for callee_reflexive_addr —
+    // the whole point is to hide the callee's IP from the caller.
+    let answer = mk_answer("c2", CallAcceptMode::AcceptGeneric, None);
+    let (setup_caller, setup_callee) =
+        handle_answer_and_build_setups(&mut reg, &answer);
+
+    // CALLER should see peer_direct_addr = None (privacy preserved).
+    match setup_caller {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            assert!(
+                peer_direct_addr.is_none(),
+                "privacy mode must not leak callee addr to caller"
+            );
+        }
+        _ => panic!("wrong variant"),
+    }
+
+    // CALLEE still gets the caller's addr — only the callee opted for
+    // privacy, the caller already volunteered its addr in the offer.
+    match setup_callee {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            assert_eq!(
+                peer_direct_addr.as_deref(),
+                Some(caller_addr),
+                "callee's CallSetup should still carry caller's volunteered addr"
+            );
+        }
+        _ => panic!("wrong variant"),
+    }
+}
+
+// -----------------------------------------------------------------------
+// Test 3: old caller (no addr) + new callee — relay path only
+// -----------------------------------------------------------------------
+
+#[test]
+fn pre_phase3_caller_leaves_both_setups_relay_only() {
+    let mut reg = CallRegistry::new();
+
+    // Pre-Phase-3 client doesn't know about caller_reflexive_addr
+    // so the field is None.
+    handle_offer(&mut reg, &mk_offer("c3", None));
+
+    // New callee advertises its addr — doesn't matter because
+    // without caller_reflexive_addr the caller has nothing to
+    // attempt a direct handshake to, so the cross-wiring should
+    // still leave the caller's CallSetup without peer_direct_addr.
+    let answer = mk_answer(
+        "c3",
+        CallAcceptMode::AcceptTrusted,
+        Some("198.51.100.9:4433"),
+    );
+    let (setup_caller, setup_callee) =
+        handle_answer_and_build_setups(&mut reg, &answer);
+
+    match setup_caller {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            // Phase 3 relay behavior: we always inject whatever
+            // addrs are in the registry, regardless of who
+            // advertised. The caller here gets the callee's addr
+            // because the callee did advertise.
+            assert_eq!(peer_direct_addr.as_deref(), Some("198.51.100.9:4433"));
+        }
+        _ => panic!("wrong variant"),
+    }
+
+    // The callee's setup has no caller addr (pre-Phase-3 offer).
+    match setup_callee {
+        SignalMessage::CallSetup { peer_direct_addr, .. } => {
+            assert!(
+                peer_direct_addr.is_none(),
+                "callee should see no caller addr when offer was pre-Phase-3"
+            );
+        }
+        _ => panic!("wrong variant"),
+    }
+}
+
+// -----------------------------------------------------------------------
+// Test 4: neither side advertises — both CallSetups fall back cleanly
+// -----------------------------------------------------------------------
+
+#[test]
+fn neither_peer_advertises_both_setups_are_relay_only() {
+    let mut reg = CallRegistry::new();
+
+    handle_offer(&mut reg, &mk_offer("c4", None));
+    let answer = mk_answer("c4", CallAcceptMode::AcceptTrusted, None);
+    let (setup_caller, setup_callee) =
+        handle_answer_and_build_setups(&mut reg, &answer);
+
+    for (label, setup) in [("caller", setup_caller), ("callee", setup_callee)] {
+        match setup {
+            SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
+                assert!(
+                    peer_direct_addr.is_none(),
+                    "{label}'s CallSetup must have no peer_direct_addr"
+                );
+                // Relay addr is always filled — that's the fallback
+                // path and the existing behavior.
+                assert!(!relay_addr.is_empty(), "{label} relay_addr must be set");
+            }
+            _ => panic!("wrong variant"),
+        }
+    }
+}

crates/wzp-relay/tests/multi_reflect.rs

@@ -0,0 +1,231 @@
+//! Phase 2 integration tests for multi-relay NAT reflection
+//! (PRD: .taskmaster/docs/prd_multi_relay_reflect.txt).
+//!
+//! These spin up one or two mock relays that implement the full
+//! pre-reflect dance — RegisterPresence → RegisterPresenceAck →
+//! Reflect → ReflectResponse — which is what the transient
+//! probe helper in `wzp_client::reflect::probe_reflect_addr` does
+//! against a real relay.
+//!
+//! Test matrix:
+//!   1. `probe_reflect_addr_happy_path`
+//!      — single mock relay, assert the probe helper returns the
+//!        observed addr as 127.0.0.1:<client ephemeral port>
+//!   2. `detect_nat_type_two_loopback_relays_is_cone`
+//!      — two mock relays, one client; loopback single-host means
+//!        every probe sees the same (127.0.0.1, same_port) so the
+//!        classifier returns `Cone` + a consensus addr
+//!   3. `detect_nat_type_dead_relay_is_unknown`
+//!      — one alive relay + one dead address; aggregator returns
+//!        `Unknown` with a non-empty `error` field on the failed
+//!        probe
+
+use std::net::{Ipv4Addr, SocketAddr};
+use std::sync::Arc;
+use std::time::Duration;
+
+use wzp_client::reflect::{detect_nat_type, probe_reflect_addr, NatType};
+use wzp_proto::{MediaTransport, SignalMessage};
+use wzp_transport::{create_endpoint, server_config, QuinnTransport};
+
+/// Minimal mock relay that loops accepting connections, handles
+/// RegisterPresence + Reflect, and responds correctly. Mirrors the
+/// two match arms from `wzp-relay/src/main.rs` that matter here.
+///
+/// Each accepted connection gets its own inner task so multiple
+/// simultaneous probes work.
+async fn spawn_mock_relay() -> (SocketAddr, tokio::task::JoinHandle<()>) {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let (sc, _cert_der) = server_config();
+    let bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
+    let endpoint = create_endpoint(bind, Some(sc)).expect("server endpoint");
+    let listen_addr = endpoint.local_addr().expect("local_addr");
+
+    let handle = tokio::spawn(async move {
+        loop {
+            // Accept the next incoming connection. `wzp_transport::accept`
+            // returns the established `quinn::Connection`.
+            let conn = match wzp_transport::accept(&endpoint).await {
+                Ok(c) => c,
+                Err(_) => break, // endpoint closed
+            };
+            let observed_addr = conn.remote_address();
+            let transport = Arc::new(QuinnTransport::new(conn));
+
+            // Per-connection handler. Keep servicing messages until
+            // the peer closes so one probe connection can do
+            // RegisterPresence → Ack → Reflect → Response without
+            // racing other incoming connections.
+            let t = transport;
+            tokio::spawn(async move {
+                loop {
+                    match t.recv_signal().await {
+                        Ok(Some(SignalMessage::RegisterPresence { .. })) => {
+                            let _ = t
+                                .send_signal(&SignalMessage::RegisterPresenceAck {
+                                    success: true,
+                                    error: None,
+                                    relay_build: None,
+                                    relay_region: None,
+                                    available_relays: Vec::new(),
+                                })
+                                .await;
+                        }
+                        Ok(Some(SignalMessage::Reflect)) => {
+                            let _ = t
+                                .send_signal(&SignalMessage::ReflectResponse {
+                                    observed_addr: observed_addr.to_string(),
+                                })
+                                .await;
+                        }
+                        Ok(Some(_other)) => { /* ignore */ }
+                        Ok(None) => break,
+                        Err(_) => break,
+                    }
+                }
+            });
+        }
+    });
+
+    (listen_addr, handle)
+}
+
+// -----------------------------------------------------------------------
+// Test 1: probe_reflect_addr against a single mock relay
+// -----------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn probe_reflect_addr_happy_path() {
+    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
+
+    let (observed, latency_ms) = tokio::time::timeout(
+        Duration::from_secs(3),
+        probe_reflect_addr(relay_addr, 2000, None),
+    )
+    .await
+    .expect("probe must complete within 3s")
+    .expect("probe must succeed");
+
+    assert_eq!(
+        observed.ip().to_string(),
+        "127.0.0.1",
+        "loopback test should see 127.0.0.1"
+    );
+    assert_ne!(observed.port(), 0, "observed port must be non-zero");
+    // Latency on same host is dominated by the handshake — generously
+    // allow up to 2s (the timeout) rather than picking a tight number
+    // that would be flaky on busy CI runners.
+    assert!(latency_ms < 2000, "latency {latency_ms}ms too high");
+}
+
+// -----------------------------------------------------------------------
+// Test 2: two loopback relays → probes succeed, classification is Unknown
+// -----------------------------------------------------------------------
+//
+// With the private-IP filter added in the NAT classifier, loopback
+// reflex addrs (127.0.0.1) are dropped before classification —
+// they can't possibly indicate public-internet NAT state. So the
+// test now asserts:
+//   - both probes succeed end-to-end (wire plumbing works)
+//   - both return 127.0.0.1 (same-host is visible)
+//   - the aggregated verdict is Unknown (no public probes)
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn detect_nat_type_two_loopback_relays_probes_work_but_classify_unknown() {
+    let (addr_a, _h_a) = spawn_mock_relay().await;
+    let (addr_b, _h_b) = spawn_mock_relay().await;
+
+    let detection = detect_nat_type(
+        vec![
+            ("RelayA".into(), addr_a),
+            ("RelayB".into(), addr_b),
+        ],
+        2000,
+        None,
+    )
+    .await;
+
+    assert_eq!(detection.probes.len(), 2);
+    for p in &detection.probes {
+        assert!(
+            p.observed_addr.is_some(),
+            "probe {:?} failed: {:?}",
+            p.relay_name,
+            p.error
+        );
+    }
+    let observed_ips: Vec<String> = detection
+        .probes
+        .iter()
+        .map(|p| {
+            p.observed_addr
+                .as_ref()
+                .and_then(|s| s.parse::<SocketAddr>().ok())
+                .map(|a| a.ip().to_string())
+                .unwrap_or_default()
+        })
+        .collect();
+    assert_eq!(observed_ips[0], "127.0.0.1");
+    assert_eq!(observed_ips[1], "127.0.0.1");
+
+    // Classification: loopback probes are filtered out of the
+    // public-NAT classifier, so with 0 public probes the result
+    // is Unknown.
+    assert_eq!(
+        detection.nat_type,
+        NatType::Unknown,
+        "loopback-only probes must not contribute to public NAT classification"
+    );
+    assert!(detection.consensus_addr.is_none());
+}
+
+// -----------------------------------------------------------------------
+// Test 3: one alive relay + one dead address → Unknown
+// -----------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn detect_nat_type_dead_relay_is_unknown() {
+    let (alive_addr, _alive_handle) = spawn_mock_relay().await;
+
+    // Dead relay: a port that nothing is listening on. OS will drop
+    // the packets, the probe should time out within the 600ms budget
+    // we give it. Pick a port unlikely to be in use — port 1 on
+    // loopback works on every OS I care about and fails fast.
+    let dead_addr: SocketAddr = "127.0.0.1:1".parse().unwrap();
+
+    let detection = detect_nat_type(
+        vec![
+            ("Alive".into(), alive_addr),
+            ("Dead".into(), dead_addr),
+        ],
+        600, // tight timeout so the dead probe fails fast
+        None,
+    )
+    .await;
+
+    assert_eq!(detection.probes.len(), 2);
+
+    // Find the alive and dead probes by name (order of JoinSet
+    // completions is not guaranteed).
+    let alive = detection.probes.iter().find(|p| p.relay_name == "Alive").unwrap();
+    let dead = detection.probes.iter().find(|p| p.relay_name == "Dead").unwrap();
+
+    assert!(
+        alive.observed_addr.is_some(),
+        "alive probe must succeed: {:?}",
+        alive.error
+    );
+    assert!(
+        dead.observed_addr.is_none(),
+        "dead probe must fail, got addr {:?}",
+        dead.observed_addr
+    );
+    assert!(
+        dead.error.is_some(),
+        "dead probe must surface an error string"
+    );
+
+    // With only 1 successful probe, the classifier returns Unknown.
+    assert_eq!(detection.nat_type, NatType::Unknown);
+    assert!(detection.consensus_addr.is_none());
+}

crates/wzp-transport/Cargo.toml

@@ -15,6 +15,7 @@ tracing = { workspace = true }
 async-trait = { workspace = true }
 serde_json = "1"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+socket2 = { workspace = true }
 rcgen = "0.13"
 ed25519-dalek = { workspace = true }
 hkdf = { workspace = true }

crates/wzp-transport/src/config.rs

@@ -123,7 +123,6 @@ fn transport_config() -> quinn::TransportConfig {
     config.keep_alive_interval(Some(Duration::from_secs(5)));
 
     // Enable DATAGRAM extension for unreliable media packets.
-    // Allow datagrams up to 1200 bytes (conservative for lossy links).
     config.datagram_receive_buffer_size(Some(65536));
 
     // Conservative flow control for bandwidth-constrained links
@@ -134,6 +133,26 @@ fn transport_config() -> quinn::TransportConfig {
     // Aggressive initial RTT estimate for high-latency links
     config.initial_rtt(Duration::from_millis(300));
 
+    // PMTUD (Path MTU Discovery) — quinn 0.11 enables this by default but
+    // with conservative bounds (initial 1200, upper 1452). We keep the safe
+    // initial_mtu of 1200 so the first packets always get through, but raise
+    // upper_bound so the binary search can discover larger MTUs on paths that
+    // support them. Typical results:
+    //   - Ethernet/fiber: discovers ~1452 (Ethernet MTU minus IP/UDP/QUIC)
+    //   - WireGuard/VPN: discovers ~1380-1420
+    //   - Starlink: discovers ~1400-1452
+    //   - Cellular: stays at 1200-1300
+    // Black hole detection automatically falls back to 1200 if probes fail.
+    // This matters for future video frames which can be 1-50 KB and benefit
+    // from fewer application-layer fragments per frame.
+    let mut mtu_config = quinn::MtuDiscoveryConfig::default();
+    mtu_config
+        .upper_bound(1452)
+        .interval(Duration::from_secs(300))       // re-probe every 5 min
+        .black_hole_cooldown(Duration::from_secs(30)); // retry faster on lossy links
+    config.mtu_discovery_config(Some(mtu_config));
+    config.initial_mtu(1200); // safe starting point
+
     config
 }
 

crates/wzp-transport/src/connection.rs

@@ -39,6 +39,71 @@ pub async fn connect(
     Ok(connection)
 }
 
+/// Create an IPv6-only QUIC endpoint with `IPV6_V6ONLY=1`.
+///
+/// Tries `[::]:preferred_port` first (same port as the IPv4 signal
+/// endpoint — allowed on Linux/Android when the AFs differ and
+/// V6ONLY is set). Falls back to `[::]:0` (OS-assigned) if the
+/// preferred port is already taken.
+///
+/// Must be called from within a tokio runtime (quinn needs the
+/// async runtime handle for its I/O driver).
+pub fn create_ipv6_endpoint(
+    preferred_port: u16,
+    server_config: Option<quinn::ServerConfig>,
+) -> Result<quinn::Endpoint, TransportError> {
+    use socket2::{Domain, Protocol, Socket, Type};
+    use std::net::{Ipv6Addr, SocketAddrV6};
+
+    let sock = Socket::new(Domain::IPV6, Type::DGRAM, Some(Protocol::UDP))
+        .map_err(|e| TransportError::Internal(format!("ipv6 socket: {e}")))?;
+
+    // Critical: IPv6-only so this socket never intercepts IPv4.
+    // On Android some kernels default to V6ONLY=1 anyway, but we
+    // set it explicitly for cross-platform consistency.
+    sock.set_only_v6(true)
+        .map_err(|e| TransportError::Internal(format!("set_only_v6: {e}")))?;
+
+    sock.set_reuse_address(true)
+        .map_err(|e| TransportError::Internal(format!("set_reuse_address: {e}")))?;
+
+    // Try the preferred port (same as IPv4 signal endpoint), fall
+    // back to ephemeral if the OS rejects it.
+    let bind_addr = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, preferred_port, 0, 0);
+    if let Err(e) = sock.bind(&bind_addr.into()) {
+        if preferred_port != 0 {
+            tracing::debug!(
+                preferred_port,
+                error = %e,
+                "ipv6 bind to preferred port failed, falling back to ephemeral"
+            );
+            let fallback = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, 0, 0, 0);
+            sock.bind(&fallback.into())
+                .map_err(|e| TransportError::Internal(format!("ipv6 bind fallback: {e}")))?;
+        } else {
+            return Err(TransportError::Internal(format!("ipv6 bind: {e}")));
+        }
+    }
+
+    sock.set_nonblocking(true)
+        .map_err(|e| TransportError::Internal(format!("set_nonblocking: {e}")))?;
+
+    let udp_socket: std::net::UdpSocket = sock.into();
+
+    let runtime = quinn::default_runtime()
+        .ok_or_else(|| TransportError::Internal("no async runtime for ipv6 endpoint".into()))?;
+
+    let endpoint = quinn::Endpoint::new(
+        quinn::EndpointConfig::default(),
+        server_config,
+        udp_socket,
+        runtime,
+    )
+    .map_err(|e| TransportError::Internal(format!("ipv6 endpoint: {e}")))?;
+
+    Ok(endpoint)
+}
+
 /// Accept the next incoming connection on an endpoint.
 pub async fn accept(endpoint: &quinn::Endpoint) -> Result<quinn::Connection, TransportError> {
     let incoming = endpoint

crates/wzp-transport/src/lib.rs

@@ -23,9 +23,9 @@ pub mod quic;
 pub mod reliable;
 
 pub use config::{client_config, server_config, server_config_from_seed, tls_fingerprint};
-pub use connection::{accept, connect, create_endpoint};
+pub use connection::{accept, connect, create_endpoint, create_ipv6_endpoint};
 pub use path_monitor::PathMonitor;
-pub use quic::QuinnTransport;
+pub use quic::{QuinnPathSnapshot, QuinnTransport};
 pub use wzp_proto::{MediaTransport, PathQuality, TransportError};
 
 // Re-export the quinn Endpoint type so downstream crates (wzp-desktop) can

crates/wzp-transport/src/path_monitor.rs

@@ -2,11 +2,17 @@
 //!
 //! Tracks packet loss (via sequence number gaps), RTT, jitter, and bandwidth.
 
+use std::collections::VecDeque;
+
 use wzp_proto::PathQuality;
 
 /// EWMA smoothing factor.
 const ALPHA: f64 = 0.1;
 
+/// Maximum number of RTT samples in the jitter variance sliding window.
+/// At ~50 packets/sec (20 ms frame), 10 samples ≈ 200 ms.
+const JITTER_VARIANCE_WINDOW_SIZE: usize = 10;
+
 /// Monitors network path quality metrics.
 pub struct PathMonitor {
     /// EWMA-smoothed loss percentage (0.0 - 100.0).
@@ -31,6 +37,8 @@ pub struct PathMonitor {
     last_rtt_ms: Option<f64>,
     /// Whether we have any observations yet.
     initialized: bool,
+    /// Sliding window of recent RTT samples for variance calculation.
+    rtt_window: VecDeque<f64>,
 }
 
 impl PathMonitor {
@@ -51,6 +59,7 @@ impl PathMonitor {
             total_received: 0,
             last_rtt_ms: None,
             initialized: false,
+            rtt_window: VecDeque::with_capacity(JITTER_VARIANCE_WINDOW_SIZE),
         }
     }
 
@@ -122,6 +131,12 @@ impl PathMonitor {
         } else {
             self.rtt_ewma = ALPHA * rtt + (1.0 - ALPHA) * self.rtt_ewma;
         }
+
+        // Maintain sliding window for variance calculation
+        if self.rtt_window.len() >= JITTER_VARIANCE_WINDOW_SIZE {
+            self.rtt_window.pop_front();
+        }
+        self.rtt_window.push_back(rtt);
     }
 
     /// Get the current estimated path quality.
@@ -155,6 +170,20 @@ impl PathMonitor {
         0
     }
 
+    /// Compute the jitter (RTT standard deviation) over the sliding window.
+    ///
+    /// Returns the standard deviation in milliseconds, or 0.0 if insufficient
+    /// samples. Used by `DredTuner` for spike detection.
+    pub fn jitter_variance_ms(&self) -> f64 {
+        let n = self.rtt_window.len();
+        if n < 2 {
+            return 0.0;
+        }
+        let mean = self.rtt_window.iter().sum::<f64>() / n as f64;
+        let var = self.rtt_window.iter().map(|r| (r - mean).powi(2)).sum::<f64>() / n as f64;
+        var.sqrt()
+    }
+
     /// Detect whether a network handoff likely occurred.
     ///
     /// Returns `true` if the most recent RTT jitter measurement exceeds 3x

crates/wzp-transport/src/quic.rs

@@ -13,6 +13,29 @@ use crate::datagram;
 use crate::path_monitor::PathMonitor;
 use crate::reliable;
 
+/// Snapshot of quinn's QUIC-level path statistics.
+///
+/// Provides more accurate loss/RTT data than `PathMonitor`'s sequence-gap
+/// heuristic because quinn sees ACK frames and congestion signals directly.
+#[derive(Clone, Copy, Debug)]
+pub struct QuinnPathSnapshot {
+    /// Smoothed RTT in milliseconds (from quinn's congestion controller).
+    pub rtt_ms: u32,
+    /// Cumulative loss percentage (lost_packets / sent_packets × 100).
+    pub loss_pct: f32,
+    /// Total congestion events observed by the QUIC stack.
+    pub congestion_events: u64,
+    /// Current congestion window in bytes.
+    pub cwnd: u64,
+    /// Total packets sent on this path.
+    pub sent_packets: u64,
+    /// Total packets lost on this path.
+    pub lost_packets: u64,
+    /// Current PMTUD-discovered maximum datagram payload size (bytes).
+    /// Starts at `initial_mtu` (1200) and grows as PMTUD probes succeed.
+    pub current_mtu: usize,
+}
+
 /// QUIC-based transport implementing the `MediaTransport` trait.
 pub struct QuinnTransport {
     connection: quinn::Connection,
@@ -33,6 +56,11 @@ impl QuinnTransport {
         &self.connection
     }
 
+    /// Remote address of the peer on this connection.
+    pub fn remote_address(&self) -> std::net::SocketAddr {
+        self.connection.remote_address()
+    }
+
     /// Send raw bytes as a QUIC datagram (no MediaPacket framing).
     pub fn send_raw_datagram(&self, data: &[u8]) -> Result<(), TransportError> {
         self.connection
@@ -61,6 +89,31 @@ impl QuinnTransport {
         datagram::max_datagram_payload(&self.connection)
     }
 
+    /// Snapshot of QUIC-level path stats from quinn, useful for DRED tuning.
+    ///
+    /// Returns `(rtt_ms, loss_pct, congestion_events)` derived from quinn's
+    /// internal congestion controller — more accurate than our own sequence-gap
+    /// heuristic in `PathMonitor` because quinn sees ACK frames directly.
+    pub fn quinn_path_stats(&self) -> QuinnPathSnapshot {
+        let stats = self.connection.stats();
+        let rtt_ms = stats.path.rtt.as_millis() as u32;
+        let loss_pct = if stats.path.sent_packets > 0 {
+            (stats.path.lost_packets as f32 / stats.path.sent_packets as f32) * 100.0
+        } else {
+            0.0
+        };
+        let current_mtu = self.connection.max_datagram_size().unwrap_or(1200);
+        QuinnPathSnapshot {
+            rtt_ms,
+            loss_pct,
+            congestion_events: stats.path.congestion_events,
+            cwnd: stats.path.cwnd,
+            sent_packets: stats.path.sent_packets,
+            lost_packets: stats.path.lost_packets,
+            current_mtu,
+        }
+    }
+
     /// Send an encoded [`TrunkFrame`] as a single QUIC datagram.
     pub fn send_trunk(&self, frame: &TrunkFrame) -> Result<(), TransportError> {
         let data = frame.encode();

crates/wzp-transport/src/reliable.rs

@@ -53,6 +53,13 @@ pub async fn recv_signal(recv: &mut quinn::RecvStream) -> Result<SignalMessage,
         .await
         .map_err(|e| TransportError::Internal(format!("stream read payload error: {e}")))?;
 
-    serde_json::from_slice(&payload)
-        .map_err(|e| TransportError::Internal(format!("signal deserialize error: {e}")))
+    serde_json::from_slice(&payload).map_err(|e| {
+        // Distinguish serde failures from transport failures so the
+        // caller (relay main loop, client recv loop) can continue on
+        // unknown-variant / parse errors instead of tearing down the
+        // whole signal connection. Forward-compat: adding a new
+        // `SignalMessage` variant in one side must not break the
+        // other side's signal connection.
+        TransportError::Deserialize(format!("{e}"))
+    })
 }

desktop/index.html

@@ -11,122 +11,119 @@
   </head>
   <body>
     <div id="app">
-      <!-- Connect screen -->
-      <div id="connect-screen">
-        <h1>WarzonePhone</h1>
-        <p class="subtitle">Encrypted Voice</p>
-        <div class="form">
-          <label>Relay
-            <button id="relay-selected" class="relay-selected" type="button">
-              <span id="relay-dot" class="dot"></span>
-              <span id="relay-label">Select relay...</span>
-              <span class="arrow">&#9881;</span>
-            </button>
-          </label>
-          <label>Room
-            <input id="room" type="text" value="general" />
-          </label>
-          <label>Alias
-            <input id="alias" type="text" placeholder="your name" />
-          </label>
-          <div class="form-row">
-            <label class="checkbox">
-              <input id="os-aec" type="checkbox" checked />
-              OS Echo Cancel
-            </label>
-            <button id="settings-btn-home" class="icon-btn" title="Settings (Cmd+,)">&#9881;</button>
+
+      <!-- ═══════════════════════════════════════════════════════
+           LOBBY — default view, auto-connects signal on launch
+           ═══════════════════════════════════════════════════════ -->
+      <div id="lobby-screen">
+        <header class="lobby-header">
+          <div class="lobby-title-row">
+            <h1>WarzonePhone</h1>
+            <button id="settings-btn" class="icon-btn" title="Settings">&#9881;</button>
           </div>
-          <!-- Mode toggle -->
-          <div class="mode-toggle" style="display:flex;gap:8px;margin-bottom:8px;">
-            <button id="mode-room" class="mode-btn active" style="flex:1">Room</button>
-            <button id="mode-direct" class="mode-btn" style="flex:1">Direct Call</button>
+          <div class="lobby-status-row">
+            <span id="lobby-dot" class="dot"></span>
+            <span id="lobby-relay-label" class="lobby-relay">Connecting...</span>
+            <span id="lobby-room-label" class="lobby-room">general</span>
           </div>
-
-          <!-- Room mode (default) -->
-          <div id="room-mode">
-            <button id="connect-btn" class="primary">Connect</button>
+          <div class="lobby-identity">
+            <span id="lobby-identicon"></span>
+            <span id="lobby-fp" class="fp-display"></span>
           </div>
+        </header>
 
-          <!-- Direct call mode -->
-          <div id="direct-mode" class="hidden">
-            <button id="register-btn" class="primary" style="background:#2196F3">Register on Relay</button>
-            <div id="direct-registered" class="hidden" style="margin-top:12px">
-              <div class="direct-registered-header">
-                <p style="color:var(--green);font-size:13px;margin:0">&#x2705; Registered — waiting for calls</p>
-                <button id="deregister-btn" class="secondary-btn small">Deregister</button>
-              </div>
-              <div id="incoming-call-panel" class="hidden" style="background:#1B5E20;padding:12px;border-radius:8px;margin:8px 0">
-                <p style="font-weight:bold;margin:0 0 4px 0">Incoming Call</p>
-                <p id="incoming-caller" style="font-size:12px;opacity:0.8;margin:0 0 8px 0">From: unknown</p>
-                <div style="display:flex;gap:8px">
-                  <button id="accept-call-btn" style="flex:1;background:var(--green);color:white;border:none;padding:8px;border-radius:6px;cursor:pointer">Accept</button>
-                  <button id="reject-call-btn" style="flex:1;background:var(--red);color:white;border:none;padding:8px;border-radius:6px;cursor:pointer">Reject</button>
-                </div>
-              </div>
+        <!-- User list -->
+        <div class="lobby-users-section">
+          <div class="lobby-users-header">
+            <span>Online</span>
+            <span id="lobby-user-count" class="badge">0</span>
+          </div>
+          <div id="lobby-user-list" class="lobby-user-list">
+            <div class="lobby-empty">No one else is here yet</div>
+          </div>
+        </div>
 
-              <!-- Recent contacts -->
-              <div id="recent-contacts-section" class="hidden">
-                <div class="history-header">Recent contacts</div>
-                <div id="recent-contacts-list" class="history-list"></div>
-              </div>
+        <!-- Voice join FAB -->
+        <div class="lobby-fab-row">
+          <button id="join-voice-btn" class="fab" title="Join Voice Chat">
+            <span class="fab-icon">&#x1F3A7;</span>
+            <span class="fab-label">Join Voice</span>
+          </button>
+        </div>
 
-              <!-- Call history -->
-              <div id="call-history-section" class="hidden">
-                <div class="history-header">
-                  History
-                  <button id="clear-history-btn" class="link-btn">clear</button>
-                </div>
-                <div id="call-history-list" class="history-list"></div>
-              </div>
-
-              <label style="margin-top:8px">Call by fingerprint
-                <input id="target-fp" type="text" placeholder="xxxx:xxxx:xxxx:..." />
-              </label>
-              <button id="call-btn" class="primary" style="margin-top:8px">Call</button>
-              <p id="call-status-text" style="color:var(--yellow);font-size:13px;margin-top:4px"></p>
+        <!-- Incoming call banner -->
+        <div id="incoming-call-banner" class="incoming-banner hidden">
+          <div class="incoming-info">
+            <span id="incoming-identicon" class="incoming-identicon"></span>
+            <div>
+              <div id="incoming-caller-name" class="incoming-name">Unknown</div>
+              <div class="incoming-subtitle">Incoming call...</div>
             </div>
           </div>
-
-          <p id="connect-error" class="error"></p>
-        </div>
-        <div class="identity-info">
-          <span id="my-identicon"></span>
-          <span id="my-fingerprint" class="fp-display"></span>
-        </div>
-        <div class="recent-rooms" id="recent-rooms"></div>
-      </div>
-
-      <!-- In-call screen -->
-      <div id="call-screen" class="hidden">
-        <div class="call-header">
-          <div class="call-header-row">
-            <div id="room-name" class="room-name"></div>
-            <button id="settings-btn-call" class="icon-btn small" title="Settings (Cmd+,)">&#9881;</button>
-          </div>
-          <div class="call-meta">
-            <span id="call-status" class="status-dot"></span>
-            <span id="call-timer" class="call-timer">0:00</span>
+          <div class="incoming-actions">
+            <button id="accept-call-btn" class="btn-accept">Accept</button>
+            <button id="reject-call-btn" class="btn-reject">Reject</button>
           </div>
         </div>
-        <div class="level-meter">
-          <div id="level-bar" class="level-bar-fill"></div>
+        <!-- ═════ Voice Drawer (bottom bar, stays on lobby) ═════ -->
+        <div id="voice-drawer" class="voice-drawer hidden">
+          <div class="voice-drawer-bar" id="voice-drawer-bar">
+            <div class="vd-info">
+              <span id="vd-status" class="vd-status-dot"></span>
+              <span id="vd-room" class="vd-room">general</span>
+              <span id="vd-timer" class="vd-timer">0:00</span>
+              <span id="vd-badge" class="vd-badge hidden"></span>
+            </div>
+            <div class="vd-level">
+              <div id="vd-level-bar" class="vd-level-fill"></div>
+            </div>
+            <div class="vd-controls">
+              <button id="vd-mic-btn" class="vd-btn" title="Mic (m)">
+                <span id="vd-mic-icon">Mic</span>
+              </button>
+              <button id="vd-spk-btn" class="vd-btn" title="Speaker (s)">
+                <span id="vd-spk-icon">Spk</span>
+              </button>
+              <button id="vd-end-btn" class="vd-btn vd-end" title="Leave voice (q)">
+                <span>End</span>
+              </button>
+            </div>
+          </div>
+          <!-- Direct call info (shown during P2P calls) -->
+          <div id="vd-direct-info" class="vd-direct-info hidden">
+            <span id="vd-dc-identicon" class="vd-dc-identicon"></span>
+            <div class="vd-dc-details">
+              <div id="vd-dc-name" class="vd-dc-name">Unknown</div>
+              <div id="vd-dc-badge" class="vd-dc-badge">Connecting...</div>
+            </div>
+          </div>
+          <div id="vd-stats" class="vd-stats"></div>
         </div>
-        <div id="participants" class="participants"></div>
-        <div class="controls">
-          <button id="mic-btn" class="control-btn" title="Toggle Mic (m)">
-            <span class="icon" id="mic-icon">Mic</span>
-          </button>
-          <button id="hangup-btn" class="control-btn hangup" title="Hang Up (q)">
-            <span class="icon">End</span>
-          </button>
-          <button id="spk-btn" class="control-btn" title="Toggle Speaker (s)">
-            <span class="icon" id="spk-icon">Spk</span>
-          </button>
-        </div>
-        <div id="stats" class="stats"></div>
       </div>
 
-      <!-- Settings panel -->
+      <!-- ═══════════════════════════════════════════════════════
+           USER CONTEXT MENU (tap on user in lobby)
+           ═══════════════════════════════════════════════════════ -->
+      <div id="user-context-menu" class="context-menu hidden">
+        <div class="context-header">
+          <span id="ctx-identicon" class="ctx-identicon"></span>
+          <div>
+            <div id="ctx-name" class="ctx-name">User</div>
+            <div id="ctx-fp" class="ctx-fp"></div>
+          </div>
+        </div>
+        <button id="ctx-call-btn" class="context-action">
+          <span>&#x1F4DE;</span> Direct Call
+        </button>
+        <button id="ctx-message-btn" class="context-action" disabled>
+          <span>&#x1F4AC;</span> Message (coming soon)
+        </button>
+        <button id="ctx-close-btn" class="context-action dim">Close</button>
+      </div>
+
+      <!-- ═══════════════════════════════════════════════════════
+           SETTINGS PANEL (overlay)
+           ═══════════════════════════════════════════════════════ -->
       <div id="settings-panel" class="hidden">
         <div class="settings-card">
           <div class="settings-header">
@@ -147,102 +144,81 @@
             <div class="quality-control">
               <div class="quality-header">
                 <span class="setting-label">QUALITY</span>
-                <span id="s-quality-label" class="quality-label">Auto</span>
+                <span id="s-quality-label" class="quality-value">Auto</span>
               </div>
-              <input id="s-quality" type="range" min="0" max="7" step="1" value="3" class="quality-slider" />
-              <div class="quality-ticks">
-                <span>64k</span>
-                <span>48k</span>
-                <span>32k</span>
+              <input id="s-quality" type="range" min="0" max="6" step="1" value="6" />
+              <div class="quality-labels">
+                <span>Codec2 1.2k</span>
                 <span>Auto</span>
-                <span>24k</span>
-                <span>6k</span>
-                <span>C2</span>
-                <span>1.2k</span>
               </div>
             </div>
             <label class="checkbox">
-              <input id="s-os-aec" type="checkbox" />
-              OS Echo Cancellation (macOS VoiceProcessingIO)
-            </label>
-            <label class="checkbox">
-              <input id="s-agc" type="checkbox" checked />
-              Automatic Gain Control
-            </label>
-            <label class="checkbox">
-              <input id="s-dred-debug" type="checkbox" />
-              DRED debug logs (verbose, dev only)
+              <input id="s-os-aec" type="checkbox" checked />
+              OS Echo Cancellation
             </label>
           </div>
           <div class="settings-section">
-            <h3>Identity</h3>
-            <div class="setting-row">
-              <span class="setting-label">Fingerprint</span>
-              <span id="s-fingerprint" class="fp-display-large"></span>
+            <h3>Relays</h3>
+            <div id="s-relay-list"></div>
+            <div class="relay-add">
+              <input id="s-relay-name" type="text" placeholder="Name" style="flex:1" />
+              <input id="s-relay-addr" type="text" placeholder="host:port" style="flex:2" />
+              <button id="s-relay-add" class="secondary-btn small">Add</button>
             </div>
-            <div class="setting-row">
-              <span class="setting-label">Identity file</span>
-              <span class="fp-display">~/.wzp/identity</span>
+          </div>
+          <div class="settings-section">
+            <h3>Identity</h3>
+            <div>
+              <span class="setting-label">FINGERPRINT</span>
+              <div id="s-fingerprint" class="fp-display" style="margin-top:4px"></div>
+            </div>
+            <div style="margin-top:8px">
+              <span class="setting-label">IDENTITY FILE</span>
+              <div style="font-size:12px;opacity:0.6;margin-top:2px">~/.wzp/identity</div>
             </div>
           </div>
           <div class="settings-section">
             <h3>Network</h3>
-            <div class="setting-row">
-              <span class="setting-label">Public address</span>
-              <span id="s-reflected-addr" class="fp-display">(not queried)</span>
-              <button id="s-reflect-btn" class="secondary-btn">Detect</button>
+            <div>
+              <span class="setting-label">PUBLIC ADDRESS</span>
+              <span id="s-public-addr" style="color:var(--green);font-size:13px;margin-left:8px"></span>
+              <button id="s-reflect-btn" class="secondary-btn small" style="margin-left:8px">Detect</button>
+            </div>
+            <div style="margin-top:8px">
+              <button id="s-nat-detect-btn" class="secondary-btn" style="width:100%">Detect NAT</button>
+              <div id="s-nat-result" style="font-size:11px;margin-top:4px;opacity:0.7;white-space:pre-wrap"></div>
             </div>
-            <small style="color:var(--text-dim);display:block;margin-top:4px">
-              Asks the registered relay to echo back the IP:port it sees for this
-              connection (QUIC-native NAT reflection, replaces STUN).
-            </small>
           </div>
           <div class="settings-section">
-            <h3>Recent Rooms</h3>
-            <div id="s-recent-rooms" class="recent-rooms-list"></div>
-            <button id="s-clear-recent" class="secondary-btn">Clear History</button>
+            <h3>Debug</h3>
+            <label class="checkbox">
+              <input id="s-dred-debug" type="checkbox" />
+              DRED debug logs (verbose, dev only)
+            </label>
+            <label class="checkbox">
+              <input id="s-call-debug" type="checkbox" />
+              Call flow debug logs (trace every step of a call)
+            </label>
+            <label class="checkbox">
+              <input id="s-direct-only" type="checkbox" />
+              Direct-only mode (no relay fallback)
+            </label>
+            <label class="checkbox">
+              <input id="s-birthday-attack" type="checkbox" />
+              Birthday attack (extra ports for hard NAT — adds ~3s)
+            </label>
           </div>
-          <button id="settings-save" class="primary">Save</button>
-        </div>
-      </div>
-
-      <!-- Manage Relays dialog -->
-      <div id="relay-dialog" class="hidden">
-        <div class="settings-card relay-dialog-card">
-          <div class="settings-header">
-            <h2>Manage Relays</h2>
-            <button id="relay-dialog-close" class="icon-btn">&times;</button>
-          </div>
-          <div id="relay-dialog-list" class="relay-dialog-list"></div>
-          <div class="relay-add-row">
-            <div class="relay-add-inputs">
-              <input id="relay-add-name" type="text" placeholder="Name" />
-              <input id="relay-add-addr" type="text" placeholder="host:port" />
+          <div class="settings-section" id="s-call-debug-section" style="display:none">
+            <h3>Call Debug Log</h3>
+            <div id="s-call-debug-log" style="max-height:220px;overflow-y:auto;background:#0a0a0a;color:#e0e0e0;font-family:ui-monospace,Menlo,Monaco,'Courier New',monospace;font-size:10px;padding:6px;border-radius:4px;line-height:1.4;white-space:pre-wrap"></div>
+            <div style="display:flex;gap:6px;margin-top:6px">
+              <button id="s-call-debug-copy" class="secondary-btn" style="flex:1">Copy log</button>
+              <button id="s-call-debug-share" class="secondary-btn" style="flex:1">Share</button>
+              <button id="s-call-debug-clear" class="secondary-btn" style="flex:1">Clear log</button>
             </div>
-            <button id="relay-add-btn" class="primary">Add Relay</button>
-          </div>
-        </div>
-      </div>
-      <!-- Key changed warning dialog -->
-      <div id="key-warning" class="hidden">
-        <div class="settings-card key-warning-card">
-          <div class="key-warning-icon">&#9888;</div>
-          <h2>Server Key Changed</h2>
-          <p class="key-warning-text">The relay's identity has changed since you last connected. This usually happens when the server was restarted, but could also indicate a security issue.</p>
-          <div class="key-warning-fps">
-            <div class="key-fp-row">
-              <span class="key-fp-label">Previously known</span>
-              <code id="kw-old-fp" class="key-fp"></code>
-            </div>
-            <div class="key-fp-row">
-              <span class="key-fp-label">New key</span>
-              <code id="kw-new-fp" class="key-fp"></code>
-            </div>
-          </div>
-          <div class="key-warning-actions">
-            <button id="kw-accept" class="primary">Accept New Key</button>
-            <button id="kw-cancel" class="secondary-btn">Cancel</button>
+            <small id="s-call-debug-copy-status" style="display:block;margin-top:4px;color:var(--text-dim);font-size:10px"></small>
           </div>
+          <button id="settings-save" class="primary" style="margin-top:12px">Save</button>
         </div>
       </div>
     </div>

desktop/src-tauri/Cargo.toml

@@ -36,6 +36,7 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 tauri = { version = "2", features = [] }
 tauri-plugin-shell = "2"
+tauri-plugin-notification = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }

desktop/src-tauri/capabilities/default.json

@@ -21,6 +21,10 @@
     "core:window:default",
     "core:app:default",
     "core:webview:default",
-    "shell:default"
+    "shell:default",
+    "notification:default",
+    "notification:allow-notify",
+    "notification:allow-request-permission",
+    "notification:allow-is-permission-granted"
   ]
 }

desktop/src-tauri/gen/android/app/src/main/java/com/wzp/desktop/MainActivity.kt

@@ -72,18 +72,22 @@ class MainActivity : TauriActivity() {
    * STREAM_VOICE_CALL volume is cranked to max since the in-call volume
    * slider is separate from media volume on most devices.
    */
+  /**
+   * Pre-flight: only set volumes. Do NOT set MODE_IN_COMMUNICATION here —
+   * that hijacks the entire audio routing (music stops, BT A2DP drops to
+   * earpiece) even before a call starts. The Rust side sets the mode via
+   * JNI when the call engine actually starts, and restores MODE_NORMAL
+   * when the call ends.
+   */
   private fun configureAudioForCall() {
     try {
       val am = getSystemService(Context.AUDIO_SERVICE) as AudioManager
-      Log.i(TAG, "audio state before: mode=${am.mode} speaker=${am.isSpeakerphoneOn} " +
+      Log.i(TAG, "audio state: mode=${am.mode} speaker=${am.isSpeakerphoneOn} " +
         "voiceVol=${am.getStreamVolume(AudioManager.STREAM_VOICE_CALL)}/" +
         "${am.getStreamMaxVolume(AudioManager.STREAM_VOICE_CALL)} " +
         "musicVol=${am.getStreamVolume(AudioManager.STREAM_MUSIC)}/" +
         "${am.getStreamMaxVolume(AudioManager.STREAM_MUSIC)}")
 
-      am.mode = AudioManager.MODE_IN_COMMUNICATION
-      am.isSpeakerphoneOn = false   // default: handset / earpiece
-
       // Crank both voice-call and music volumes so nothing silent slips
       // through regardless of which stream actually ends up driving.
       val maxVoice = am.getStreamMaxVolume(AudioManager.STREAM_VOICE_CALL)
@@ -91,9 +95,7 @@ class MainActivity : TauriActivity() {
       val maxMusic = am.getStreamMaxVolume(AudioManager.STREAM_MUSIC)
       am.setStreamVolume(AudioManager.STREAM_MUSIC, maxMusic, 0)
 
-      Log.i(TAG, "audio state after: mode=${am.mode} speaker=${am.isSpeakerphoneOn} " +
-        "voiceVol=${am.getStreamVolume(AudioManager.STREAM_VOICE_CALL)}/$maxVoice " +
-        "musicVol=${am.getStreamVolume(AudioManager.STREAM_MUSIC)}/$maxMusic")
+      Log.i(TAG, "volumes set: voiceVol=$maxVoice musicVol=$maxMusic (mode left at ${am.mode})")
     } catch (e: Throwable) {
       Log.e(TAG, "configureAudioForCall failed: ${e.message}", e)
     }

desktop/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default capability — grants core APIs (events, path, window, app, clipboard) to the main window on every platform we ship to.","local":true,"windows":["main"],"permissions":["core:default","core:event:default","core:event:allow-listen","core:event:allow-unlisten","core:event:allow-emit","core:event:allow-emit-to","core:path:default","core:window:default","core:app:default","core:webview:default","shell:default"],"platforms":["linux","macOS","windows","android","iOS"]}}
+{"default":{"identifier":"default","description":"Default capability — grants core APIs (events, path, window, app, clipboard) to the main window on every platform we ship to.","local":true,"windows":["main"],"permissions":["core:default","core:event:default","core:event:allow-listen","core:event:allow-unlisten","core:event:allow-emit","core:event:allow-emit-to","core:path:default","core:window:default","core:app:default","core:webview:default","shell:default","notification:default","notification:allow-notify","notification:allow-request-permission","notification:allow-is-permission-granted"],"platforms":["linux","macOS","windows","android","iOS"]}}

desktop/src-tauri/gen/schemas/desktop-schema.json

@@ -2354,6 +2354,204 @@
           "const": "core:window:deny-unminimize",
           "markdownDescription": "Denies the unminimize command without any pre-configured scope."
         },
+        {
+          "description": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`",
+          "type": "string",
+          "const": "notification:default",
+          "markdownDescription": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`"
+        },
+        {
+          "description": "Enables the batch command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-batch",
+          "markdownDescription": "Enables the batch command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-cancel",
+          "markdownDescription": "Enables the cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the check_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-check-permissions",
+          "markdownDescription": "Enables the check_permissions command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-create-channel",
+          "markdownDescription": "Enables the create_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the delete_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-delete-channel",
+          "markdownDescription": "Enables the delete_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-get-active",
+          "markdownDescription": "Enables the get_active command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_pending command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-get-pending",
+          "markdownDescription": "Enables the get_pending command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_permission_granted command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-is-permission-granted",
+          "markdownDescription": "Enables the is_permission_granted command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the list_channels command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-list-channels",
+          "markdownDescription": "Enables the list_channels command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the notify command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-notify",
+          "markdownDescription": "Enables the notify command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the permission_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-permission-state",
+          "markdownDescription": "Enables the permission_state command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register_action_types command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-register-action-types",
+          "markdownDescription": "Enables the register_action_types command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-register-listener",
+          "markdownDescription": "Enables the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-remove-active",
+          "markdownDescription": "Enables the remove_active command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the request_permission command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-request-permission",
+          "markdownDescription": "Enables the request_permission command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-show",
+          "markdownDescription": "Enables the show command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the batch command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-batch",
+          "markdownDescription": "Denies the batch command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-cancel",
+          "markdownDescription": "Denies the cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-check-permissions",
+          "markdownDescription": "Denies the check_permissions command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-create-channel",
+          "markdownDescription": "Denies the create_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the delete_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-delete-channel",
+          "markdownDescription": "Denies the delete_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-get-active",
+          "markdownDescription": "Denies the get_active command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_pending command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-get-pending",
+          "markdownDescription": "Denies the get_pending command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_permission_granted command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-is-permission-granted",
+          "markdownDescription": "Denies the is_permission_granted command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the list_channels command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-list-channels",
+          "markdownDescription": "Denies the list_channels command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the notify command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-notify",
+          "markdownDescription": "Denies the notify command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the permission_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-permission-state",
+          "markdownDescription": "Denies the permission_state command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register_action_types command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-register-action-types",
+          "markdownDescription": "Denies the register_action_types command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-register-listener",
+          "markdownDescription": "Denies the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-remove-active",
+          "markdownDescription": "Denies the remove_active command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the request_permission command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-request-permission",
+          "markdownDescription": "Denies the request_permission command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-show",
+          "markdownDescription": "Denies the show command without any pre-configured scope."
+        },
         {
           "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
           "type": "string",

desktop/src-tauri/gen/schemas/macOS-schema.json

@@ -2354,6 +2354,204 @@
           "const": "core:window:deny-unminimize",
           "markdownDescription": "Denies the unminimize command without any pre-configured scope."
         },
+        {
+          "description": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`",
+          "type": "string",
+          "const": "notification:default",
+          "markdownDescription": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`"
+        },
+        {
+          "description": "Enables the batch command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-batch",
+          "markdownDescription": "Enables the batch command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-cancel",
+          "markdownDescription": "Enables the cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the check_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-check-permissions",
+          "markdownDescription": "Enables the check_permissions command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-create-channel",
+          "markdownDescription": "Enables the create_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the delete_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-delete-channel",
+          "markdownDescription": "Enables the delete_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-get-active",
+          "markdownDescription": "Enables the get_active command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_pending command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-get-pending",
+          "markdownDescription": "Enables the get_pending command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_permission_granted command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-is-permission-granted",
+          "markdownDescription": "Enables the is_permission_granted command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the list_channels command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-list-channels",
+          "markdownDescription": "Enables the list_channels command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the notify command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-notify",
+          "markdownDescription": "Enables the notify command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the permission_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-permission-state",
+          "markdownDescription": "Enables the permission_state command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register_action_types command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-register-action-types",
+          "markdownDescription": "Enables the register_action_types command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-register-listener",
+          "markdownDescription": "Enables the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-remove-active",
+          "markdownDescription": "Enables the remove_active command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the request_permission command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-request-permission",
+          "markdownDescription": "Enables the request_permission command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:allow-show",
+          "markdownDescription": "Enables the show command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the batch command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-batch",
+          "markdownDescription": "Denies the batch command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-cancel",
+          "markdownDescription": "Denies the cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check_permissions command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-check-permissions",
+          "markdownDescription": "Denies the check_permissions command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-create-channel",
+          "markdownDescription": "Denies the create_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the delete_channel command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-delete-channel",
+          "markdownDescription": "Denies the delete_channel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-get-active",
+          "markdownDescription": "Denies the get_active command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_pending command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-get-pending",
+          "markdownDescription": "Denies the get_pending command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_permission_granted command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-is-permission-granted",
+          "markdownDescription": "Denies the is_permission_granted command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the list_channels command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-list-channels",
+          "markdownDescription": "Denies the list_channels command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the notify command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-notify",
+          "markdownDescription": "Denies the notify command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the permission_state command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-permission-state",
+          "markdownDescription": "Denies the permission_state command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register_action_types command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-register-action-types",
+          "markdownDescription": "Denies the register_action_types command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-register-listener",
+          "markdownDescription": "Denies the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_active command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-remove-active",
+          "markdownDescription": "Denies the remove_active command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the request_permission command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-request-permission",
+          "markdownDescription": "Denies the request_permission command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "notification:deny-show",
+          "markdownDescription": "Denies the show command without any pre-configured scope."
+        },
         {
           "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
           "type": "string",

desktop/src-tauri/src/android_audio.rs

@@ -57,11 +57,37 @@ fn audio_manager<'local>(
     Ok(am)
 }
 
+/// Set `AudioManager.MODE_IN_COMMUNICATION`. Call when a VoIP call starts.
+/// This tells the audio policy to route through the communication device
+/// path (earpiece/BT SCO) instead of the media path (speaker/BT A2DP).
+pub fn set_audio_mode_communication() -> Result<(), String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+    // MODE_IN_COMMUNICATION = 3
+    env.call_method(&am, "setMode", "(I)V", &[JValue::Int(3)])
+        .map_err(|e| format!("setMode(MODE_IN_COMMUNICATION): {e}"))?;
+    tracing::info!("AudioManager: mode set to MODE_IN_COMMUNICATION");
+    Ok(())
+}
+
+/// Restore `AudioManager.MODE_NORMAL`. Call when a VoIP call ends.
+pub fn set_audio_mode_normal() -> Result<(), String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+    // MODE_NORMAL = 0
+    env.call_method(&am, "setMode", "(I)V", &[JValue::Int(0)])
+        .map_err(|e| format!("setMode(MODE_NORMAL): {e}"))?;
+    tracing::info!("AudioManager: mode set to MODE_NORMAL");
+    Ok(())
+}
+
 /// Switch between loud speaker (`true`) and earpiece/handset (`false`).
-///
-/// Calls `AudioManager.setSpeakerphoneOn(on)` on the JVM. Requires that
-/// the audio mode is already `MODE_IN_COMMUNICATION` — MainActivity.kt
-/// sets this at startup, so by the time a call is up this is always true.
 pub fn set_speakerphone(on: bool) -> Result<(), String> {
     let (vm, activity) = jvm_and_activity()?;
     let mut env = vm
@@ -96,3 +122,238 @@ pub fn is_speakerphone_on() -> Result<bool, String> {
         .map_err(|e| format!("isSpeakerphoneOn: {e}"))?;
     Ok(on)
 }
+
+// ─── Bluetooth SCO routing ──────────────────────────────────────────────────
+
+/// Start Bluetooth SCO audio routing.
+///
+/// On API 31+ uses `setCommunicationDevice()` which is the modern way to
+/// route voice audio to a specific device. Falls back to the deprecated
+/// `startBluetoothSco()` path on older APIs.
+///
+/// The caller must restart Oboe streams after this call.
+pub fn start_bluetooth_sco() -> Result<(), String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+
+    // Ensure speaker is off — mutually exclusive with BT.
+    env.call_method(
+        &am,
+        "setSpeakerphoneOn",
+        "(Z)V",
+        &[JValue::Bool(0)],
+    )
+    .map_err(|e| format!("setSpeakerphoneOn(false): {e}"))?;
+
+    // Try modern API first (API 31+): setCommunicationDevice(AudioDeviceInfo)
+    // Find a BT SCO or BLE device from getAvailableCommunicationDevices()
+    let used_modern = try_set_communication_device(&mut env, &am, true)?;
+
+    if !used_modern {
+        // Fallback: deprecated startBluetoothSco (API < 31)
+        tracing::info!("start_bluetooth_sco: falling back to deprecated startBluetoothSco");
+        env.call_method(&am, "startBluetoothSco", "()V", &[])
+            .map_err(|e| format!("startBluetoothSco: {e}"))?;
+    }
+
+    tracing::info!(used_modern, "AudioManager: Bluetooth SCO started");
+    Ok(())
+}
+
+/// Stop Bluetooth SCO audio routing, returning audio to the earpiece.
+///
+/// The caller must restart Oboe streams after this call.
+pub fn stop_bluetooth_sco() -> Result<(), String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+
+    // Modern API: clearCommunicationDevice() (API 31+)
+    let cleared = try_set_communication_device(&mut env, &am, false)?;
+
+    if !cleared {
+        // Fallback: deprecated stopBluetoothSco
+        env.call_method(&am, "stopBluetoothSco", "()V", &[])
+            .map_err(|e| format!("stopBluetoothSco: {e}"))?;
+    }
+
+    tracing::info!(cleared, "AudioManager: Bluetooth SCO stopped");
+    Ok(())
+}
+
+/// Try to use the modern `setCommunicationDevice` / `clearCommunicationDevice`
+/// API (Android 12 / API 31+). Returns `true` if the modern API was used.
+fn try_set_communication_device(
+    env: &mut jni::AttachGuard<'_>,
+    am: &JObject<'_>,
+    enable: bool,
+) -> Result<bool, String> {
+    // Check SDK_INT >= 31 (Android 12)
+    let sdk_int = env
+        .get_static_field(
+            "android/os/Build$VERSION",
+            "SDK_INT",
+            "I",
+        )
+        .and_then(|v| v.i())
+        .unwrap_or(0);
+
+    if sdk_int < 31 {
+        return Ok(false);
+    }
+
+    if !enable {
+        // clearCommunicationDevice()
+        env.call_method(am, "clearCommunicationDevice", "()V", &[])
+            .map_err(|e| format!("clearCommunicationDevice: {e}"))?;
+        tracing::info!("clearCommunicationDevice: done");
+        return Ok(true);
+    }
+
+    // getAvailableCommunicationDevices() → List<AudioDeviceInfo>
+    let device_list = env
+        .call_method(
+            am,
+            "getAvailableCommunicationDevices",
+            "()Ljava/util/List;",
+            &[],
+        )
+        .and_then(|v| v.l())
+        .map_err(|e| format!("getAvailableCommunicationDevices: {e}"))?;
+
+    let size = env
+        .call_method(&device_list, "size", "()I", &[])
+        .and_then(|v| v.i())
+        .unwrap_or(0);
+
+    // Find first BT device: TYPE_BLUETOOTH_SCO (7), TYPE_BLUETOOTH_A2DP (8),
+    // TYPE_BLE_HEADSET (26), TYPE_BLE_SPEAKER (27)
+    for i in 0..size {
+        let device = env
+            .call_method(
+                &device_list,
+                "get",
+                "(I)Ljava/lang/Object;",
+                &[JValue::Int(i)],
+            )
+            .and_then(|v| v.l())
+            .map_err(|e| format!("list.get({i}): {e}"))?;
+
+        let device_type = env
+            .call_method(&device, "getType", "()I", &[])
+            .and_then(|v| v.i())
+            .unwrap_or(0);
+
+        // BT SCO = 7, A2DP = 8, BLE headset = 26, BLE speaker = 27
+        if matches!(device_type, 7 | 8 | 26 | 27) {
+            let ok = env
+                .call_method(
+                    am,
+                    "setCommunicationDevice",
+                    "(Landroid/media/AudioDeviceInfo;)Z",
+                    &[JValue::Object(&device)],
+                )
+                .and_then(|v| v.z())
+                .unwrap_or(false);
+
+            tracing::info!(
+                device_type,
+                ok,
+                "setCommunicationDevice: set BT device"
+            );
+            return Ok(ok);
+        }
+    }
+
+    tracing::warn!("setCommunicationDevice: no BT device in available list");
+    Ok(false)
+}
+
+/// Query whether Bluetooth audio is currently the active communication device.
+///
+/// On API 31+ checks `getCommunicationDevice()` type. Falls back to the
+/// deprecated `isBluetoothScoOn()` on older APIs.
+pub fn is_bluetooth_sco_on() -> Result<bool, String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+
+    let sdk_int = env
+        .get_static_field("android/os/Build$VERSION", "SDK_INT", "I")
+        .and_then(|v| v.i())
+        .unwrap_or(0);
+
+    if sdk_int >= 31 {
+        // getCommunicationDevice() → AudioDeviceInfo (nullable)
+        let device = env
+            .call_method(am, "getCommunicationDevice", "()Landroid/media/AudioDeviceInfo;", &[])
+            .and_then(|v| v.l())
+            .unwrap_or(JObject::null());
+        if device.is_null() {
+            return Ok(false);
+        }
+        let device_type = env
+            .call_method(&device, "getType", "()I", &[])
+            .and_then(|v| v.i())
+            .unwrap_or(0);
+        // BT SCO = 7, A2DP = 8, BLE headset = 26, BLE speaker = 27
+        return Ok(matches!(device_type, 7 | 8 | 26 | 27));
+    }
+
+    // Fallback: deprecated API
+    env.call_method(&am, "isBluetoothScoOn", "()Z", &[])
+        .and_then(|v| v.z())
+        .map_err(|e| format!("isBluetoothScoOn: {e}"))
+}
+
+/// Check whether a Bluetooth audio device is currently connected.
+///
+/// Iterates `AudioManager.getDevices(GET_DEVICES_OUTPUTS)` and looks for
+/// any Bluetooth device type. Many headsets only register as A2DP until
+/// SCO is explicitly started, so we check for both SCO and A2DP types.
+pub fn is_bluetooth_available() -> Result<bool, String> {
+    let (vm, activity) = jvm_and_activity()?;
+    let mut env = vm
+        .attach_current_thread()
+        .map_err(|e| format!("attach_current_thread: {e}"))?;
+    let am = audio_manager(&mut env, &activity)?;
+
+    // AudioManager.GET_DEVICES_OUTPUTS = 2
+    let devices = env
+        .call_method(
+            &am,
+            "getDevices",
+            "(I)[Landroid/media/AudioDeviceInfo;",
+            &[JValue::Int(2)],
+        )
+        .and_then(|v| v.l())
+        .map_err(|e| format!("getDevices(OUTPUTS): {e}"))?;
+
+    let arr = jni::objects::JObjectArray::from(devices);
+    let len = env
+        .get_array_length(&arr)
+        .map_err(|e| format!("get_array_length: {e}"))?;
+
+    for i in 0..len {
+        let device = env
+            .get_object_array_element(&arr, i)
+            .map_err(|e| format!("get_object_array_element({i}): {e}"))?;
+        let device_type = env
+            .call_method(&device, "getType", "()I", &[])
+            .and_then(|v| v.i())
+            .unwrap_or(0);
+        // TYPE_BLUETOOTH_SCO = 7, TYPE_BLUETOOTH_A2DP = 8
+        if device_type == 7 || device_type == 8 {
+            tracing::info!(device_type, idx = i, "is_bluetooth_available: found BT device");
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}

desktop/src-tauri/src/wzp_native.rs

@@ -26,7 +26,9 @@ static LIB: OnceLock<libloading::Library> = OnceLock::new();
 static VERSION: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
 static HELLO: OnceLock<unsafe extern "C" fn(*mut u8, usize) -> usize> = OnceLock::new();
 static AUDIO_START: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
+static AUDIO_START_BT: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
 static AUDIO_STOP: OnceLock<unsafe extern "C" fn()> = OnceLock::new();
+static AUDIO_CAPTURE_AVAILABLE: OnceLock<extern "C" fn() -> usize> = OnceLock::new();
 static AUDIO_READ_CAPTURE: OnceLock<unsafe extern "C" fn(*mut i16, usize) -> usize> = OnceLock::new();
 static AUDIO_WRITE_PLAYOUT: OnceLock<unsafe extern "C" fn(*const i16, usize) -> usize> = OnceLock::new();
 static AUDIO_IS_RUNNING: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
@@ -65,7 +67,9 @@ pub fn init() -> Result<(), String> {
         resolve!(VERSION, unsafe extern "C" fn() -> i32, b"wzp_native_version");
         resolve!(HELLO, unsafe extern "C" fn(*mut u8, usize) -> usize, b"wzp_native_hello");
         resolve!(AUDIO_START, unsafe extern "C" fn() -> i32, b"wzp_native_audio_start");
+        resolve!(AUDIO_START_BT, unsafe extern "C" fn() -> i32, b"wzp_native_audio_start_bt");
         resolve!(AUDIO_STOP, unsafe extern "C" fn(), b"wzp_native_audio_stop");
+        resolve!(AUDIO_CAPTURE_AVAILABLE, extern "C" fn() -> usize, b"wzp_native_audio_capture_available");
         resolve!(AUDIO_READ_CAPTURE, unsafe extern "C" fn(*mut i16, usize) -> usize, b"wzp_native_audio_read_capture");
         resolve!(AUDIO_WRITE_PLAYOUT, unsafe extern "C" fn(*const i16, usize) -> usize, b"wzp_native_audio_write_playout");
         resolve!(AUDIO_IS_RUNNING, unsafe extern "C" fn() -> i32, b"wzp_native_audio_is_running");
@@ -104,6 +108,14 @@ pub fn audio_start() -> Result<(), i32> {
     if ret == 0 { Ok(()) } else { Err(ret) }
 }
 
+/// Start Oboe in Bluetooth SCO mode — capture skips sample rate and
+/// input preset so the system routes to the BT SCO device natively.
+pub fn audio_start_bt() -> Result<(), i32> {
+    let f = AUDIO_START_BT.get().ok_or(-100_i32)?;
+    let ret = unsafe { f() };
+    if ret == 0 { Ok(()) } else { Err(ret) }
+}
+
 /// Stop both streams. Safe to call even if not running.
 pub fn audio_stop() {
     if let Some(f) = AUDIO_STOP.get() {
@@ -111,6 +123,12 @@ pub fn audio_stop() {
     }
 }
 
+/// Number of capture samples available to read without blocking.
+pub fn audio_capture_available() -> usize {
+    let Some(f) = AUDIO_CAPTURE_AVAILABLE.get() else { return 0; };
+    f()
+}
+
 /// Read captured i16 PCM into `out`. Returns bytes actually copied.
 pub fn audio_read_capture(out: &mut [i16]) -> usize {
     let Some(f) = AUDIO_READ_CAPTURE.get() else { return 0; };

desktop/src/style.css

@@ -32,7 +32,401 @@ body {
 
 .hidden { display: none !important; }
 
-/* ── Connect screen ── */
+/* ── Lobby screen (IRC-style) ── */
+#lobby-screen {
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  gap: 0;
+  max-width: 480px;
+  margin: 0 auto;
+  width: 100%;
+}
+
+.lobby-header {
+  padding: 12px 0;
+  border-bottom: 1px solid var(--surface2);
+}
+
+.lobby-title-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.lobby-title-row h1 {
+  font-size: 20px;
+  font-weight: 700;
+  letter-spacing: 0.5px;
+}
+
+.lobby-status-row {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-top: 6px;
+  font-size: 12px;
+  color: var(--text-dim);
+}
+
+.lobby-relay { opacity: 0.7; }
+.lobby-room { color: var(--green); font-weight: 500; }
+
+.lobby-identity {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-top: 6px;
+  font-size: 11px;
+  opacity: 0.5;
+}
+
+/* User list */
+.lobby-users-section {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  margin-top: 8px;
+  min-height: 0;
+}
+
+.lobby-users-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 0;
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text-dim);
+  text-transform: uppercase;
+  letter-spacing: 1px;
+}
+
+.badge {
+  background: var(--surface2);
+  color: var(--text-dim);
+  font-size: 11px;
+  padding: 1px 7px;
+  border-radius: 10px;
+  font-weight: 600;
+}
+
+.lobby-user-list {
+  flex: 1;
+  overflow-y: auto;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.lobby-empty {
+  color: var(--text-dim);
+  font-size: 13px;
+  text-align: center;
+  padding: 40px 20px;
+  opacity: 0.6;
+}
+
+/* Single user row */
+.user-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 12px;
+  border-radius: 8px;
+  cursor: pointer;
+  transition: background 0.15s;
+}
+
+.user-row:hover, .user-row:active {
+  background: var(--surface);
+}
+
+.user-identicon {
+  width: 36px;
+  height: 36px;
+  border-radius: 50%;
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.user-info {
+  flex: 1;
+  min-width: 0;
+}
+
+.user-name {
+  font-size: 14px;
+  font-weight: 500;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.user-fp {
+  font-size: 10px;
+  color: var(--text-dim);
+  font-family: ui-monospace, monospace;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.user-status {
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+}
+
+.user-status-icon {
+  font-size: 16px;
+}
+
+/* Speaking indicator */
+.user-row.speaking {
+  background: rgba(74, 222, 128, 0.08);
+}
+
+.user-row.speaking .user-name {
+  color: var(--green);
+}
+
+/* In-voice indicator */
+.user-row.in-voice .user-status-icon {
+  color: var(--green);
+}
+
+/* Voice join FAB */
+.lobby-fab-row {
+  padding: 12px 0;
+  display: flex;
+  justify-content: center;
+}
+
+.fab {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  background: var(--green);
+  color: #111;
+  border: none;
+  padding: 12px 28px;
+  border-radius: 24px;
+  font-size: 15px;
+  font-weight: 600;
+  cursor: pointer;
+  box-shadow: 0 4px 16px rgba(74, 222, 128, 0.3);
+  transition: transform 0.15s, box-shadow 0.15s;
+}
+
+.fab:hover {
+  transform: scale(1.03);
+  box-shadow: 0 6px 20px rgba(74, 222, 128, 0.4);
+}
+
+.fab:active {
+  transform: scale(0.97);
+}
+
+.fab.active {
+  background: var(--red);
+  box-shadow: 0 4px 16px rgba(239, 68, 68, 0.3);
+}
+
+.fab-icon { font-size: 18px; }
+
+/* ── Voice Drawer (bottom bar) ── */
+.voice-drawer {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  background: var(--surface);
+  border-top: 1px solid var(--surface2);
+  padding: 0 16px;
+  padding-bottom: env(safe-area-inset-bottom, 8px);
+  z-index: 50;
+  animation: drawerUp 0.25s ease-out;
+  box-shadow: 0 -4px 20px rgba(0,0,0,0.4);
+}
+@keyframes drawerUp {
+  from { transform: translateY(100%); }
+  to { transform: translateY(0); }
+}
+.voice-drawer-bar {
+  display: flex; flex-direction: column; gap: 6px; padding: 10px 0 6px;
+}
+.vd-info {
+  display: flex; align-items: center; gap: 8px; font-size: 13px;
+}
+.vd-status-dot {
+  width: 8px; height: 8px; border-radius: 50%; background: var(--green); flex-shrink: 0;
+}
+.vd-room { color: var(--green); font-weight: 600; }
+.vd-timer { color: var(--text-dim); font-family: ui-monospace, monospace; font-size: 12px; }
+.vd-badge {
+  font-size: 10px; padding: 1px 6px; border-radius: 6px; font-weight: 500;
+}
+.vd-badge.direct { background: rgba(74,222,128,0.15); color: var(--green); }
+.vd-badge.relay { background: rgba(96,165,250,0.15); color: #60a5fa; }
+.vd-level { height: 3px; background: var(--surface2); border-radius: 2px; overflow: hidden; }
+.vd-level-fill {
+  height: 100%; width: 0%; background: var(--green); border-radius: 2px; transition: width 0.1s;
+}
+.vd-controls {
+  display: flex; align-items: center; justify-content: center; gap: 12px; padding: 4px 0;
+}
+.vd-btn {
+  width: 44px; height: 44px; border-radius: 50%; border: none;
+  background: var(--surface2); color: var(--text); font-size: 18px;
+  cursor: pointer; display: flex; align-items: center; justify-content: center;
+  transition: background 0.15s;
+}
+.vd-btn:hover { background: var(--primary); }
+.vd-btn.muted { background: var(--red); color: white; }
+.vd-end { background: var(--red); color: white; }
+.vd-end:hover { background: #dc2626; }
+.vd-direct-info {
+  display: flex; align-items: center; gap: 10px; padding: 8px 0 4px;
+  border-top: 1px solid var(--surface2); margin-top: 4px;
+}
+.vd-dc-identicon { width: 32px; height: 32px; border-radius: 50%; flex-shrink: 0; }
+.vd-dc-name { font-size: 13px; font-weight: 600; }
+.vd-dc-badge {
+  font-size: 10px; padding: 1px 6px; border-radius: 6px;
+}
+.vd-dc-badge.direct { background: rgba(74,222,128,0.15); color: var(--green); }
+.vd-dc-badge.relay { background: rgba(96,165,250,0.15); color: #60a5fa; }
+.vd-dc-badge.connecting { background: rgba(250,204,21,0.15); color: var(--yellow); }
+.vd-stats {
+  font-size: 10px; color: var(--text-dim); font-family: ui-monospace, monospace;
+  padding: 2px 0 4px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+}
+
+/* Incoming call banner */
+.incoming-banner {
+  position: fixed;
+  bottom: 20px;
+  left: 20px;
+  right: 20px;
+  max-width: 440px;
+  margin: 0 auto;
+  background: var(--surface);
+  border: 1px solid var(--green);
+  border-radius: 16px;
+  padding: 16px;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  box-shadow: 0 8px 32px rgba(0,0,0,0.5);
+  z-index: 100;
+  animation: slideUp 0.3s ease-out;
+}
+
+@keyframes slideUp {
+  from { transform: translateY(100%); opacity: 0; }
+  to { transform: translateY(0); opacity: 1; }
+}
+
+.incoming-info {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.incoming-identicon { width: 40px; height: 40px; border-radius: 50%; }
+.incoming-name { font-weight: 600; font-size: 15px; }
+.incoming-subtitle { font-size: 12px; color: var(--green); }
+
+.incoming-actions {
+  display: flex;
+  gap: 8px;
+}
+
+.btn-accept {
+  flex: 1;
+  background: var(--green);
+  color: #111;
+  border: none;
+  padding: 10px;
+  border-radius: 10px;
+  font-weight: 600;
+  cursor: pointer;
+}
+
+.btn-reject {
+  flex: 1;
+  background: var(--red);
+  color: white;
+  border: none;
+  padding: 10px;
+  border-radius: 10px;
+  font-weight: 600;
+  cursor: pointer;
+}
+
+/* Context menu */
+.context-menu {
+  position: fixed;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  background: var(--surface);
+  border: 1px solid var(--surface2);
+  border-radius: 16px;
+  padding: 20px;
+  min-width: 260px;
+  z-index: 200;
+  box-shadow: 0 16px 48px rgba(0,0,0,0.6);
+}
+
+.context-header {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 16px;
+  padding-bottom: 12px;
+  border-bottom: 1px solid var(--surface2);
+}
+
+.ctx-identicon { width: 40px; height: 40px; border-radius: 50%; }
+.ctx-name { font-weight: 600; font-size: 15px; }
+.ctx-fp { font-size: 10px; color: var(--text-dim); font-family: monospace; }
+
+.context-action {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  width: 100%;
+  background: none;
+  border: none;
+  color: var(--text);
+  padding: 10px 8px;
+  border-radius: 8px;
+  font-size: 14px;
+  cursor: pointer;
+  text-align: left;
+}
+
+.context-action:hover:not(:disabled) {
+  background: var(--surface2);
+}
+
+.context-action:disabled {
+  opacity: 0.4;
+  cursor: not-allowed;
+}
+
+.context-action.dim {
+  color: var(--text-dim);
+  font-size: 13px;
+}
+
+/* Legacy compat — keep old connect-screen ID working for JS that
+   references it (the old connect screen is now the lobby). */
 #connect-screen {
   display: flex;
   flex-direction: column;
@@ -371,7 +765,65 @@ button.primary:disabled { opacity: 0.5; cursor: not-allowed; }
   transition: width 0.1s ease-out;
 }
 
-/* ── Participants ── */
+/* ── Direct call phone-style layout ── */
+.direct-call-view {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  flex: 1;
+  padding: 32px 16px;
+  gap: 8px;
+}
+.dc-identicon {
+  width: 96px;
+  height: 96px;
+  border-radius: 50%;
+  overflow: hidden;
+  margin-bottom: 12px;
+  box-shadow: 0 0 24px rgba(74, 222, 128, 0.15);
+}
+.dc-identicon canvas,
+.dc-identicon svg,
+.dc-identicon img {
+  width: 100% !important;
+  height: 100% !important;
+  display: block;
+}
+.dc-name {
+  font-size: 22px;
+  font-weight: 600;
+  color: var(--text);
+  text-align: center;
+}
+.dc-fp {
+  font-size: 11px;
+  font-family: ui-monospace, Menlo, Monaco, 'Courier New', monospace;
+  color: var(--text-dim);
+  text-align: center;
+  word-break: break-all;
+  max-width: 280px;
+}
+.dc-badge {
+  display: inline-block;
+  margin-top: 8px;
+  padding: 4px 12px;
+  border-radius: 12px;
+  font-size: 11px;
+  font-weight: 500;
+  background: rgba(74, 222, 128, 0.12);
+  color: var(--green);
+}
+.dc-badge.relay {
+  background: rgba(96, 165, 250, 0.12);
+  color: #60a5fa;
+}
+.dc-badge.connecting {
+  background: rgba(250, 204, 21, 0.12);
+  color: var(--yellow);
+}
+
+/* ── Participants (group call layout) ── */
 .participants {
   background: var(--surface);
   border-radius: var(--radius);
@@ -1025,7 +1477,10 @@ button.primary:disabled { opacity: 0.5; cursor: not-allowed; }
   color: white;
 }
 
-/* Speaker routing button (non-muted earpiece state should not look red) */
+/* Audio routing button — highlight color depends on active route */
 #spk-btn.speaker-on .icon {
   color: var(--accent);
 }
+#spk-btn.bt-on .icon {
+  color: #60a5fa; /* blue-400 for Bluetooth */
+}

docs/ARCHITECTURE.md

@@ -103,11 +103,13 @@ sequenceDiagram
     participant RNN as RNNoise<br/>(2 x 480)
     participant VAD as SilenceDetector
     participant Codec as Opus / Codec2
+    participant DT as DredTuner<br/>(wzp-proto)
     participant FEC as RaptorQ FEC
     participant INT as Interleaver<br/>(depth=3)
     participant HDR as MediaHeader<br/>(12B or Mini 4B)
     participant Enc as ChaCha20-Poly1305
     participant QUIC as QUIC Datagram
+    participant QPS as QuinnPathSnapshot
 
     Mic->>Ring: f32 x 512 (macOS callback)
     Ring->>Ring: Accumulate to 960 samples
@@ -118,10 +120,19 @@ sequenceDiagram
     else Silence (>100ms)
         VAD->>Codec: ComfortNoise (every 200ms)
     end
-    Codec->>FEC: Compressed bytes (pad to 256B symbol)
-    FEC->>FEC: Accumulate block (5-10 symbols)
-    FEC->>INT: Source + repair symbols
-    INT->>HDR: Interleaved packets
+
+    Note over QPS,DT: Every 25 frames (~500ms)
+    QPS->>DT: loss_pct, rtt_ms, jitter_ms
+    DT->>Codec: set_dred_duration() + set_expected_loss()
+
+    alt Opus tier (any bitrate)
+        Codec->>HDR: Compressed bytes + DRED side-channel (no RaptorQ)
+    else Codec2 tier
+        Codec->>FEC: Compressed bytes (pad to 256B symbol)
+        FEC->>FEC: Accumulate block (5-10 symbols)
+        FEC->>INT: Source + repair symbols
+        INT->>HDR: Interleaved packets
+    end
     HDR->>Enc: Header as AAD
     Enc->>QUIC: Encrypted payload + 16B tag
 ```
@@ -134,6 +145,9 @@ sequenceDiagram
 - Silence detection uses VAD + 100ms hangover before switching to ComfortNoise
 - FEC symbols are padded to **256 bytes** with a 2-byte LE length prefix
 - MiniHeaders (4 bytes) replace full headers (12 bytes) for 49 of every 50 frames
+- DRED tuner polls quinn path stats every 25 frames (~500ms) and adjusts DRED lookback duration continuously
+- Opus tiers bypass RaptorQ entirely -- DRED handles loss recovery at the codec layer
+- Opus6k DRED window: 1040ms (maximum libopus allows)
 
 ## Audio Decode Pipeline
 
@@ -154,13 +168,30 @@ sequenceDiagram
     Dec->>AR: Decrypt (header = AAD)
     AR->>AR: Check seq window (reject replay)
     AR->>HDR: Verified packet
-    HDR->>DEINT: MediaHeader + payload
-    DEINT->>FEC: Reordered symbols by block
-    FEC->>FEC: Attempt decode (need K of K+R)
-    FEC->>JIT: Recovered audio frames
+
+    alt Opus packet
+        HDR->>JIT: Direct to jitter buffer (no FEC/interleave)
+    else Codec2 packet
+        HDR->>DEINT: MediaHeader + payload
+        DEINT->>FEC: Reordered symbols by block
+        FEC->>FEC: Attempt decode (need K of K+R)
+        FEC->>JIT: Recovered audio frames
+    end
+
     JIT->>JIT: BTreeMap ordered by seq
     JIT->>JIT: Wait until depth >= target
-    JIT->>Codec: Pop lowest seq frame
+
+    alt Packet present
+        JIT->>Codec: Pop lowest seq frame
+    else Packet missing (Opus)
+        JIT->>Codec: DRED reconstruction (neural)
+        alt DRED fails or unavailable
+            Codec->>Codec: Classical PLC fallback
+        end
+    else Packet missing (Codec2)
+        Codec->>Codec: Classical PLC
+    end
+
     Codec->>Ring: PCM i16 x 960
     Ring->>SPK: Audio callback pulls samples
 ```
@@ -172,6 +203,8 @@ sequenceDiagram
 - Jitter buffer target: **10 packets (200ms)** for client, **50 packets (1s)** for relay
 - Desktop client uses **direct playout** (no jitter buffer) with lock-free ring
 - Codec2 frames at 8 kHz are resampled to 48 kHz transparently
+- DRED reconstruction: on packet loss, decoder tries neural DRED reconstruction before falling back to classical PLC
+- Jitter-spike detection pre-emptively boosts DRED to ceiling when jitter variance spikes >30%
 
 ## Relay SFU Forwarding
 
@@ -211,6 +244,7 @@ graph TB
 3. If one send fails, the relay continues to the next participant (best-effort)
 4. The relay never decodes or re-encodes audio (preserves E2E encryption)
 5. With trunking enabled, packets to the same receiver are batched into TrunkFrames (flushed every 5ms)
+6. Relay tracks per-participant quality from QualityReport trailers and broadcasts `QualityDirective` when the room-wide tier degrades (coordinated codec switching)
 
 ## Federation Topology
 
@@ -348,7 +382,7 @@ Used for 49 of every 50 frames (~1s cycle). Saves 8 bytes per packet (67% header
   [session_id: 2][len: u16][payload: len]  x count
 ```
 
-Packs multiple session packets into one QUIC datagram. Maximum 10 entries or 1200 bytes, flushed every 5ms.
+Packs multiple session packets into one QUIC datagram. Maximum 10 entries or PMTUD-discovered MTU (starts at 1200, grows to ~1452 on Ethernet), flushed every 5ms.
 
 ### QualityReport (4 bytes, optional trailer)
 
@@ -361,6 +395,40 @@ Byte 3: bitrate_cap_kbps (0-255 kbps)
 
 Appended to a media packet when the Q flag is set in the MediaHeader.
 
+## Path MTU Discovery
+
+Quinn's PLPMTUD is enabled with:
+- `initial_mtu`: 1200 bytes (QUIC minimum, always safe)
+- `upper_bound`: 1452 bytes (Ethernet minus IP/UDP/QUIC headers)
+- `interval`: 300s (re-probe every 5 minutes)
+- `black_hole_cooldown`: 30s (faster retry on lossy links)
+
+The discovered MTU is exposed via `QuinnPathSnapshot::current_mtu` and used by:
+- `TrunkedForwarder`: refreshes `max_bytes` on every send to fill larger datagrams
+- Future video framer: larger MTU = fewer application-layer fragments per frame
+
+## Continuous DRED Tuning
+
+Instead of locking DRED duration to 3 discrete quality tiers, the `DredTuner` (in `wzp-proto::dred_tuner`) maps live path quality to a continuous DRED duration:
+
+| Input | Source | Update Rate |
+|-------|--------|-------------|
+| Loss % | `QuinnPathSnapshot::loss_pct` (from quinn ACK frames) | Every 25 packets (~500ms) |
+| RTT ms | `QuinnPathSnapshot::rtt_ms` (quinn congestion controller) | Every 25 packets |
+| Jitter ms | `PathMonitor::jitter_ms` (EWMA of RTT variance) | Every 25 packets |
+
+### Mapping Logic
+
+- **Baseline**: codec-tier default (Studio=100ms, Good=200ms, Degraded=500ms)
+- **Ceiling**: codec-tier max (Studio=300ms, Good=500ms, Degraded=1040ms)
+- **Continuous**: linear interpolation between baseline and ceiling based on loss (0%->baseline, 40%->ceiling)
+- **RTT phantom loss**: high RTT (>200ms) adds phantom loss contribution to keep DRED generous
+- **Jitter spike**: >30% EWMA spike pre-emptively boosts to ceiling for ~5s cooldown
+
+### Output
+
+`DredTuning { dred_frames: u8, expected_loss_pct: u8 }` -> fed to `CallEncoder::apply_dred_tuning()` -> `OpusEncoder::set_dred_duration()` + `set_expected_loss()`
+
 ## Signal Message Handshake Flow
 
 ```mermaid
@@ -405,6 +473,34 @@ sequenceDiagram
     R->>R: Remove from room, broadcast RoomUpdate
 ```
 
+## Relay Concurrency Model
+
+### Threading
+- Multi-threaded Tokio runtime (all available cores, work-stealing scheduler)
+- Task-per-connection: each QUIC connection gets a dedicated `tokio::spawn`
+- Task-per-participant-per-room: each participant's media forwarding loop is independent
+
+### Shared State & Locking
+
+| Lock | Protected Data | Hold Duration | Contention |
+|------|---------------|---------------|------------|
+| `RoomManager` (Mutex) | Rooms, participants, quality tiers | ~1ms/packet | O(N) per room |
+| `PresenceRegistry` (Mutex) | Fingerprint registrations | ~1ms | Low (join/leave only) |
+| `SessionManager` (Mutex) | Active session tracking | ~1ms | Low |
+| `FederationManager.peer_links` (Mutex) | Peer connections | ~10ms during forward | Per-federation-packet |
+
+### Scaling Characteristics
+
+- **Many small rooms**: Scales well across all cores (rooms are independent)
+- **Large single room (100+ participants)**: Serialized by RoomManager lock
+- **Federation**: Per-peer tasks scale; `peer_links` lock held during send loop
+
+### Primary Bottleneck
+
+The RoomManager Mutex is acquired per-packet by every participant to get the fan-out peer list. Lock is released before I/O (sends happen outside lock), but packet processing is serialized through the lock within a room.
+
+Future optimization: per-room locks or lock-free participant lists via `DashMap`.
+
 ## Client Architecture
 
 ### Desktop Engine (Tauri)
@@ -940,3 +1036,182 @@ The patch introduces an `MSVC_CL` variable that is true only for real `cl.exe` (
 This does not affect macOS or Linux builds — on those platforms `MSVC=0` everywhere so the patched logic behaves identically to upstream.
 
 Upstream tracking: xiph/opus#256, xiph/opus PR #257 (both stale).
+
+## Network Awareness (Android)
+
+The adaptive quality controller (`AdaptiveQualityController` in `wzp-proto`) supports proactive network-aware adaptation via `signal_network_change(NetworkContext)`. On Android, this is fed by `NetworkMonitor.kt` which wraps `ConnectivityManager.NetworkCallback`.
+
+```
+ConnectivityManager
+       │ onCapabilitiesChanged / onLost
+       ▼
+NetworkMonitor.kt  ──classify──►  type: Int (WiFi=0, LTE=1, 5G=2, 3G=3)
+       │ onNetworkChanged(type, bw)
+       ▼
+CallViewModel  ──►  WzpEngine.onNetworkChanged()
+                        │ JNI
+                        ▼
+                    jni_bridge.rs
+                        │
+                        ▼
+                    EngineState.pending_network_type  (AtomicU8, lock-free)
+                        │ polled every ~20ms
+                        ▼
+                    recv task: quality_ctrl.signal_network_change(ctx)
+                        │
+                        ├─ WiFi → Cellular: preemptive 1-tier downgrade
+                        ├─ Any change: 10s FEC boost (+0.2 ratio)
+                        └─ Cellular: faster downgrade thresholds (2 vs 3)
+```
+
+Cellular generation is approximated from `getLinkDownstreamBandwidthKbps()` to avoid requiring `READ_PHONE_STATE` permission.
+
+## Audio Routing (Android)
+
+Both Android app variants support 3-way audio routing: **Earpiece → Speaker → Bluetooth SCO**.
+
+### Audio Mode Lifecycle
+
+`MODE_IN_COMMUNICATION` is set by the Rust call engine (via JNI `AudioManager.setMode()`) right before Oboe streams open — NOT at app launch. Restored to `MODE_NORMAL` when the call ends. This prevents hijacking system audio routing (music, BT A2DP) before a call is active.
+
+### Native Kotlin App
+
+`AudioRouteManager.kt` handles device detection (via `AudioDeviceCallback`), SCO lifecycle, and auto-fallback on BT disconnect. `CallViewModel.cycleAudioRoute()` cycles through available routes.
+
+### Tauri Desktop App
+
+`android_audio.rs` provides JNI bridges to `AudioManager` for speakerphone and Bluetooth SCO control. After each route change, Oboe streams are stopped and restarted via `spawn_blocking`.
+
+```
+User tap ──► cycleAudioRoute()
+                │
+                ├─ Earpiece: setSpeakerphoneOn(false) + clearCommunicationDevice()
+                ├─ Speaker:  setSpeakerphoneOn(true)
+                └─ BT SCO:   setCommunicationDevice(bt_device)  [API 31+]
+                │              fallback: startBluetoothSco()     [API < 31]
+                ▼
+            Oboe stop + start_bt() for BT / start() for others
+```
+
+### BT SCO and Oboe
+
+BT SCO only supports 8/16kHz. When `bt_active=1`, Oboe capture skips `setSampleRate(48000)` and `setInputPreset(VoiceCommunication)`, letting the system choose the native BT rate. Oboe's `SampleRateConversionQuality::Best` bridges to our 48kHz ring buffers. Playout uses `Usage::Media` in BT mode to avoid conflicts with the communication device routing.
+
+### Hangup Signal Fix
+
+`SignalMessage::Hangup` now carries an optional `call_id` field. The relay uses it to end only the specific call instead of broadcasting to all active calls for the user — preventing a race where a hangup for call 1 kills a newly-placed call 2.
+
+## Phase 8: Tailscale-Inspired NAT Traversal (2026-04-14)
+
+Five new modules in `wzp-client` bring NAT traversal capability close to Tailscale's approach:
+
+```
+┌──────────────────────────────────────────────────────────────────────┐
+│  wzp-client NAT Traversal Stack                                      │
+│                                                                      │
+│  ┌─────────────┐  ┌──────────────┐  ┌──────────────────────────┐    │
+│  │  stun.rs    │  │  portmap.rs  │  │  reflect.rs (existing)   │    │
+│  │  RFC 5389   │  │  NAT-PMP     │  │  Relay-based STUN        │    │
+│  │  Public     │  │  PCP         │  │  Multi-relay NAT detect  │    │
+│  │  STUN       │  │  UPnP IGD   │  │                          │    │
+│  └──────┬──────┘  └──────┬───────┘  └────────────┬─────────────┘    │
+│         │                │                        │                  │
+│         └────────────────┼────────────────────────┘                  │
+│                          │                                           │
+│                  ┌───────▼────────┐                                  │
+│                  │  ice_agent.rs  │                                  │
+│                  │  Gather / Re-  │                                  │
+│                  │  gather / Apply│                                  │
+│                  └───────┬────────┘                                  │
+│                          │                                           │
+│              ┌───────────┼───────────┐                               │
+│              │           │           │                               │
+│      ┌───────▼───┐  ┌───▼───┐  ┌───▼──────────┐                    │
+│      │ netcheck  │  │ dual_ │  │ relay_map.rs │                    │
+│      │ .rs       │  │ path  │  │ RTT-sorted   │                    │
+│      │ Diagnostic│  │ .rs   │  │ relay list   │                    │
+│      └───────────┘  │ Race  │  └──────────────┘                    │
+│                     └───────┘                                       │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### Candidate Types
+
+| Type | Source | Priority | When Used |
+|------|--------|----------|-----------|
+| Host | `local_host_candidates()` | 1 (highest) | Same-LAN peers |
+| Port-mapped | `portmap::acquire_port_mapping()` | 2 | Router supports NAT-PMP/PCP/UPnP |
+| Server-reflexive | `stun::discover_reflexive()` or relay Reflect | 3 | Cone NAT |
+| Relay | Relay address (fallback) | 4 (lowest) | Always available |
+
+### Signal Flow for Mid-Call Re-Gathering
+
+```
+Network change (WiFi → cellular)
+    │
+    ▼
+IceAgent::re_gather()
+    ├── stun::discover_reflexive()
+    ├── portmap::acquire_port_mapping()
+    └── local_host_candidates()
+    │
+    ▼
+SignalMessage::CandidateUpdate { generation: N+1, ... }
+    │
+    ▼ (via relay)
+Peer's IceAgent::apply_peer_update()
+    │
+    ▼
+PeerCandidates { reflexive, local, mapped }
+    │
+    ▼
+dual_path::race() with new candidates (TODO: transport hot-swap)
+```
+
+### New SignalMessage Variants & Fields
+
+| Signal | New Fields | Purpose |
+|--------|-----------|---------|
+| `DirectCallOffer` | `caller_mapped_addr` | Port-mapped address from NAT-PMP/PCP/UPnP |
+| `DirectCallAnswer` | `callee_mapped_addr` | Same, callee side |
+| `CallSetup` | `peer_mapped_addr` | Relay cross-wires mapped addr to peer |
+| `CandidateUpdate` | (new variant) | Mid-call candidate re-gathering |
+| `RegisterPresenceAck` | `relay_region`, `available_relays` | Relay mesh metadata for auto-selection |
+
+All new fields use `#[serde(default, skip_serializing_if)]` for backward compatibility with older clients/relays.
+
+### Hard NAT Port Prediction
+
+For symmetric NATs that don't support port mapping, the system detects the NAT's port allocation pattern:
+
+```
+Single socket → 5 STUN servers (sequential probes)
+    │
+    ▼
+Observed ports: [40001, 40002, 40003, 40004, 40005]
+    │
+    ▼
+classify_port_allocation() → Sequential { delta: 1 }
+    │
+    ▼
+predict_ports(last=40005, delta=1, offset=0, spread=2)
+    → [40004, 40005, 40006, 40007, 40008]
+    │
+    ▼
+HardNatProbe signal → peer
+    │
+    ▼
+Peer dials predicted port range in parallel
+```
+
+| Pattern | Detection | Traversal Strategy |
+|---------|-----------|-------------------|
+| Port-preserving | All probes return same port | Standard hole-punch |
+| Sequential (delta=N) | Consistent N-increment | Predict next port, dial range |
+| Random | No pattern | Birthday attack or relay |
+| Unknown | < 3 probes succeeded | Relay fallback |
+
+The classifier tolerates:
+- **Jitter**: ±1 from dominant delta (concurrent flow grabbed a port)
+- **Wraparound**: 65535 → 1 treated as delta=+2, not -65534
+- **Noise**: 60% threshold — if most deltas agree, call it sequential

docs/DESIGN.md

@@ -583,9 +583,79 @@ Signal messages are sent over reliable QUIC streams as length-prefixed JSON:
 | wzp-client | 30 + 2 integration | Encoder/decoder, quality adapter, silence, drift, sweep |
 | wzp-web | 2 | Metrics |
 
+## Audio Routing (Android)
+
+WarzonePhone supports three audio output routes on Android: **Earpiece**, **Speaker**, and **Bluetooth SCO**. The user cycles through available routes with a single button.
+
+### Audio mode lifecycle
+
+`MODE_IN_COMMUNICATION` is set **when the call engine starts** (right before Oboe `audio_start()`), not at app launch. This is critical — setting it early hijacks system audio routing (e.g. music drops from BT A2DP to earpiece). `MODE_NORMAL` is restored when the call engine stops.
+
+```
+App launch  → MODE_NORMAL (other apps' audio unaffected)
+Call start  → set_audio_mode_communication() → MODE_IN_COMMUNICATION
+Call end    → audio_stop() → set_audio_mode_normal() → MODE_NORMAL
+```
+
+### Route lifecycle
+
+1. Call starts → Earpiece (default).
+2. User taps route button → cycles to next available route.
+3. Route change requires Oboe stream restart (~60-400ms) because AAudio silently tears down streams on some OEMs when the routing target changes mid-stream.
+4. Bluetooth disconnect mid-call → `AudioDeviceCallback.onAudioDevicesRemoved` fires → auto-fallback to Earpiece or Speaker.
+
+### Bluetooth SCO
+
+SCO (Synchronous Connection Oriented) is the correct Bluetooth profile for VoIP — it provides bidirectional mono audio at 8/16 kHz with ~30ms latency. A2DP (stereo, high-quality) is unidirectional and adds 100-200ms of buffering, making it unsuitable for real-time voice.
+
+On API 31+ (Android 12), we use the modern `setCommunicationDevice(AudioDeviceInfo)` API to route audio to the BT SCO device. The deprecated `startBluetoothSco()` + `setBluetoothScoOn()` path is used as fallback on older APIs. `setBluetoothScoOn()` is silently rejected on Android 12+ for non-system apps.
+
+BT SCO devices only support 8/16kHz sample rates, but our pipeline runs at 48kHz. When BT is active, Oboe opens in **BT mode** (`bt_active=1`): capture skips `setSampleRate(48000)` and `setInputPreset(VoiceCommunication)`, letting the system open at the device's native rate. Oboe's `SampleRateConversionQuality::Best` resamples to/from 48kHz for our ring buffers.
+
+### Two app variants
+
+Both the native Kotlin app (`AudioRouteManager.kt`) and the Tauri app (`android_audio.rs` JNI bridge) support BT SCO routing. The native app uses `AudioDeviceCallback` for automatic device detection; the Tauri app uses `getAvailableCommunicationDevices()` (API 31+) or `getDevices()` on demand.
+
+## Network Change Response
+
+The `AdaptiveQualityController` in `wzp-proto` reacts to network transport changes signaled via `signal_network_change(NetworkContext)`:
+
+| Transition | Response |
+|-----------|----------|
+| WiFi → Cellular | Preemptive 1-tier quality downgrade + 10s FEC boost |
+| Cellular → WiFi | FEC boost only (quality recovers via normal adaptive logic) |
+| Any change | Reset hysteresis counters to avoid stale state |
+
+On Android, `NetworkMonitor.kt` wraps `ConnectivityManager.NetworkCallback` and classifies the transport type using bandwidth heuristics (no `READ_PHONE_STATE` needed). The classification is delivered to the Rust engine via JNI → `AtomicU8` → recv task polling — the same lock-free cross-task signaling pattern used for adaptive profile switches.
+
+### Cellular generation heuristics
+
+| Downstream bandwidth | Classification |
+|---------------------|---------------|
+| >= 100 Mbps | 5G NR |
+| >= 10 Mbps | LTE |
+| < 10 Mbps | 3G or worse |
+
+These thresholds are conservative. Carriers over-report bandwidth, but for VoIP quality decisions the exact generation matters less than the rough category.
+
 ## Build Requirements
 
 - **Rust** 1.85+ (2024 edition)
 - **Linux**: cmake, pkg-config, libasound2-dev (for audio feature)
 - **macOS**: Xcode command line tools (CoreAudio included)
-- **Android**: NDK r27c, cmake 3.28+ (from pip)
+- **Android**: NDK 26.1 (r26b), cmake 3.25-3.28 (system package)
+
+### Android APK Builds
+
+```bash
+# arm64 only (default, 25MB release APK)
+./scripts/build-tauri-android.sh --init --release --arch arm64
+
+# armv7 only (smaller devices)
+./scripts/build-tauri-android.sh --init --release --arch armv7
+
+# both architectures as separate APKs
+./scripts/build-tauri-android.sh --init --release --arch all
+```
+
+Release APKs are signed with `android/keystore/wzp-release.jks` via `apksigner`. Per-arch builds produce separate APKs (~25MB each vs ~50MB universal) for easier sharing with testers.

docs/PRD-adaptive-quality.md

@@ -61,12 +61,16 @@ Catastrophic       →  Codec2 1.2k (minimum viable voice)
    - Encoder can switch codec mid-stream
    - Decoder already auto-detects incoming codec from packet headers
 
-### What's missing
+### What's been implemented since PRD was written
 
-1. **QualityReport ingestion** — neither Android engine nor desktop engine reads quality reports from the relay
-2. **Profile switch loop** — no periodic check that feeds reports to `QualityAdapter` and applies recommended switches
-3. **Upward adaptation** — `QualityAdapter` only classifies into 3 tiers (GOOD/DEGRADED/CATASTROPHIC). Needs extension to recommend studio tiers when conditions are excellent (loss < 1%, RTT < 50ms)
-4. **Notification to UI** — when quality changes, the UI should show the current active codec
+1. **QualityReport ingestion** — ~~neither Android engine nor desktop engine reads quality reports from the relay~~ **Done**: both Android (`crates/wzp-android/src/engine.rs`) and desktop (`desktop/src-tauri/src/engine.rs`) recv tasks ingest quality reports and feed `AdaptiveQualityController`
+2. **Profile switch loop** — ~~no periodic check~~ **Done**: `pending_profile` AtomicU8 bridges recv→send task in both engines; send task applies profile switch at frame boundary
+3. **Notification to UI** — ~~when quality changes, the UI should show the current active codec~~ **Done**: `tx_codec`/`rx_codec` in desktop `EngineStatus`; `currentCodec`/`peerCodec` in Android `CallStats`
+
+### What's still missing
+
+1. **Upward adaptation** — `QualityAdapter` only classifies into 3 tiers (GOOD/DEGRADED/CATASTROPHIC). Needs extension to recommend studio tiers when conditions are excellent (loss < 1%, RTT < 50ms). See Phase 2 below.
+2. **Relay QualityDirective handling** — relay broadcasts coordinated quality directives but neither engine processes them (signals are silently discarded). See PRD-coordinated-codec.md for details.
 
 ## Requirements
 
@@ -191,11 +195,20 @@ The `CallEncoder` already has `set_profile()`. The `CallDecoder` already auto-sw
 
 ## Milestones
 
-| Phase | Scope | Effort | Dependency |
-|-------|-------|--------|------------|
-| 0 | Verify relay sends QualityReports | 0.5 day | None |
-| 1a | Wire QualityAdapter in Android engine | 1 day | Phase 0 |
-| 1b | Wire QualityAdapter in desktop engine | 1 day | Phase 0 |
-| 1c | UI indicator (current codec) | 0.5 day | Phase 1a/1b |
-| 2 | Extended 5-tier classification | 0.5 day | Phase 1 |
-| 3 | Bandwidth probing | 2 days | Phase 2 |
+| Phase | Scope | Effort | Status |
+|-------|-------|--------|--------|
+| 0 | Verify relay sends QualityReports | 0.5 day | Done |
+| 1a | Wire QualityAdapter in Android engine | 1 day | Done |
+| 1b | Wire QualityAdapter in desktop engine | 1 day | Done |
+| 1c | UI indicator (current codec) | 0.5 day | Done |
+| 2 | Extended 5-tier classification (Studio64k→Catastrophic) | 0.5 day | Done (2026-04-13) |
+| 3 | Bandwidth probing | 2 days | Pending (task #10) |
+
+## Implementation Status Update (2026-04-13)
+
+All phases implemented:
+- Phase 1: QualityAdapter with 3-tier classification — DONE
+- Phase 2: Extended 5-tier (Studio 64k/48k/32k + GOOD + DEGRADED + CATASTROPHIC) — DONE
+- Phase 3: Bandwidth probing — NOT DONE (see remaining tasks)
+- P2P adaptive quality: QualityReport::from_path_stats() + self-observation from quinn stats — DONE
+- Both relay and P2P calls now have full adaptive quality switching

docs/PRD-bluetooth-audio.md

@@ -0,0 +1,105 @@
+# PRD: Bluetooth Audio Routing
+
+> Phase: Implemented  
+> Status: Ready for testing  
+> Platforms: Android (native Kotlin app + Tauri desktop app)
+
+## Problem
+
+WarzonePhone had `AudioRouteManager.kt` with complete Bluetooth SCO support, but it was disconnected from both UIs. Users with Bluetooth headsets had no way to route call audio to them.
+
+## Solution
+
+Wire Bluetooth SCO routing end-to-end through both app variants, replacing the binary speaker toggle with a 3-way audio route cycle: **Earpiece → Speaker → Bluetooth**.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│ Native Kotlin App (com.wzp)                         │
+│                                                     │
+│  InCallScreen ──► CallViewModel ──► AudioRouteManager
+│  (Compose UI)     cycleAudioRoute()  setSpeaker()   │
+│  "Ear/Spk/BT"    audioRoute Flow     setBluetoothSco()
+│                                      isBluetoothAvailable()
+└─────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────┐
+│ Tauri Desktop App (com.wzp.desktop)                 │
+│                                                     │
+│  main.ts ──► Tauri Commands ──► android_audio.rs    │
+│  cycleAudioRoute()  set_bluetooth_sco()  JNI calls  │
+│  "Ear/Spk/BT"      is_bluetooth_available()         │
+│                     get_audio_route()                │
+│                                                     │
+│  After each route change: Oboe stop + start         │
+│  (spawn_blocking to avoid stalling tokio)           │
+└─────────────────────────────────────────────────────┘
+```
+
+## Components Modified
+
+### Native Kotlin App
+
+| File | Change |
+|------|--------|
+| `CallViewModel.kt` | Added `audioRoute: StateFlow<AudioRoute>`, `cycleAudioRoute()`, wired `onRouteChanged` callback |
+| `InCallScreen.kt` | `ControlRow` now takes `audioRoute: AudioRoute` + `onCycleRoute`, displays Ear/Spk/BT with distinct colors |
+
+### Tauri App
+
+| File | Change |
+|------|--------|
+| `android_audio.rs` | `setCommunicationDevice()` (API 31+) with `startBluetoothSco()` fallback; `set_audio_mode_communication/normal()` for call lifecycle |
+| `lib.rs` | `set_bluetooth_sco`, `is_bluetooth_available`, `get_audio_route` Tauri commands; SCO polling + 500ms route delay |
+| `wzp_native.rs` | Added `audio_start_bt()` for BT-mode Oboe (skips 48kHz + VoiceCommunication preset) |
+| `oboe_bridge.cpp` | `bt_active` flag: capture skips sample rate + input preset; playout uses `Usage::Media`; both use `Shared` mode + `SampleRateConversionQuality::Best` |
+| `engine.rs` | `set_audio_mode_communication()` before `audio_start()`; `set_audio_mode_normal()` after `audio_stop()` |
+| `MainActivity.kt` | Removed `MODE_IN_COMMUNICATION` from app launch — deferred to call start |
+| `main.ts` | Replaced `speakerphoneOn` toggle with `currentAudioRoute` cycling logic |
+| `style.css` | Added `.bt-on` CSS class (blue-400 highlight) |
+
+## Audio Route Lifecycle
+
+1. **App launch** → `MODE_NORMAL` (other apps' audio unaffected — BT A2DP music keeps playing)
+2. **Call starts** → `MODE_IN_COMMUNICATION` set via JNI, Oboe opens with earpiece routing
+3. **User taps route button** → cycles to next available route
+4. **Route changes** → `setCommunicationDevice()` (API 31+) + Oboe restart in BT mode or normal mode
+5. **BT device disconnects mid-call** → `AudioDeviceCallback.onAudioDevicesRemoved` fires → auto-fallback to Earpiece/Speaker
+6. **Call ends** → route reset, `MODE_NORMAL` restored
+
+## Route Cycling Logic
+
+```
+Available routes = [Earpiece, Speaker] + [Bluetooth] if SCO device connected
+
+Tap cycle:
+  Earpiece → Speaker → Bluetooth (if available) → Earpiece → ...
+
+If BT not available:
+  Earpiece → Speaker → Earpiece → ...
+```
+
+## Permissions
+
+- `BLUETOOTH_CONNECT` (Android 12+) — already in `AndroidManifest.xml`
+- `MODIFY_AUDIO_SETTINGS` — already in manifest
+
+## Known Limitations
+
+- **SCO only** — no A2DP (stereo music profile). SCO is correct for VoIP (bidirectional mono).
+- **API 31+ required for modern path** — `setCommunicationDevice()` is the primary BT routing API. Fallback to deprecated `startBluetoothSco()` on API < 31 (untested).
+- **BT SCO capture at 8/16kHz** — Oboe resamples to 48kHz via `SampleRateConversionQuality::Best`. Quality is inherently limited by the SCO codec (CVSD at 8kHz or mSBC at 16kHz).
+- **No auto-switch on BT connect** — when a BT device connects mid-call, user must tap the route button.
+- **500ms route switch delay** — after `setCommunicationDevice()` returns, the audio policy needs time to apply the bt-sco route. We wait 500ms before restarting Oboe.
+
+## Testing
+
+1. Pair a Bluetooth SCO headset with Android device
+2. Start call → verify Earpiece is default
+3. Tap route → Speaker (audio moves to loudspeaker, button shows "Spk")
+4. Tap route → BT (audio moves to headset, button shows "BT", blue highlight)
+5. Tap route → Earpiece (audio back to earpiece, button shows "Ear")
+6. Disconnect BT mid-call → verify auto-fallback
+7. Verify both app variants work identically
+8. Verify no audio glitches during route transitions

docs/PRD-coordinated-codec.md

@@ -196,3 +196,26 @@ Implementation strategy: build for P2P first (simpler, 2 parties), then wrap the
 | 4 | Upgrade proposal + negotiation protocol | 2 days |
 | 5 | P2P quality adaptation (direct observation) | 1 day |
 | 6 | Per-participant asymmetric encoding (Option 2) | 1 day |
+
+## Implementation Status (2026-04-13)
+
+Phases 1-2 are implemented. Phase 3 has a critical gap.
+
+### What was built
+
+- **`QualityDirective` signal** (`crates/wzp-proto/src/packet.rs`): New `SignalMessage` variant with `recommended_profile` and optional `reason`
+- **`ParticipantQuality`** (`crates/wzp-relay/src/room.rs`): Per-participant quality tracking using `AdaptiveQualityController`, created on join, removed on leave
+- **Weakest-link broadcast**: `observe_quality()` method computes room-wide worst tier, broadcasts `QualityDirective` to all participants when tier changes
+- **Desktop engine handling** (`desktop/src-tauri/src/engine.rs`): `AdaptiveQualityController` in recv task, `pending_profile` AtomicU8 bridge to send task, auto-mode profile switching based on **inbound quality reports**
+
+### Phase 3 completed (2026-04-13)
+
+Both engines now handle `QualityDirective` signals from the relay:
+- **Desktop** (`engine.rs`): both P2P and relay signal tasks match `QualityDirective`, extract `recommended_profile`, store index via `sig_pending_profile.store(idx, Release)`. Send task picks it up at the next frame boundary.
+- **Android** (`engine.rs`): signal task matches `QualityDirective`, stores via `pending_profile_recv.store(idx, Release)`.
+
+Relay-coordinated codec switching is now end-to-end: relay monitors → broadcasts directive → clients switch.
+
+### Phase remaining
+
+- Phase 4: Upgrade proposal/negotiation protocol for quality recovery (task #28)

docs/PRD-dred-integration.md

@@ -358,3 +358,45 @@ End-to-end testing, in order:
 - **OSCE enable**: opusic-c has an `osce` feature flag for Opus Speech Coding Enhancement, a separate libopus 1.5 neural post-processor. Out of scope for this PRD but should be the next audio-quality follow-up. Probably one-line enable once opusic-c is in.
 - **Upstream PR to opusic-c**: our own `dred_ffi.rs` wrapper should be proven in production first, then the fixes upstreamed to `opusic-c/src/dred.rs` (preserve `dred_end`, fix `dred_offset` double-pass, expose `DredPacket` externally). Follow-up task, not blocking this PRD.
 - **`feat/desktop-audio-rewrite` merge**: the vendored `audiopus_sys` patch on that branch becomes obsolete under this PRD. Coordinate removal with whoever owns that branch.
+
+## Phase A: Continuous DRED Tuning (Implemented 2026-04-12)
+
+Phase A extends the discrete tier-locked DRED durations from Phases 1-3 with continuous, network-driven tuning.
+
+### What was built
+
+- **`DredTuner`** (`crates/wzp-proto/src/dred_tuner.rs`): Maps `(loss_pct, rtt_ms, jitter_ms)` → `(dred_frames, expected_loss_pct)` continuously
+- **Quinn stats exposure** (`crates/wzp-transport/src/quic.rs`): `QuinnPathSnapshot` provides quinn's internal RTT, loss, congestion events — more accurate than sequence-gap heuristics
+- **Jitter variance window** (`crates/wzp-transport/src/path_monitor.rs`): 10-sample sliding window for RTT standard deviation, used for spike detection
+- **`AudioEncoder` trait extensions** (`crates/wzp-proto/src/traits.rs`): `set_expected_loss()` and `set_dred_duration()` with default no-op, overridden by `OpusEncoder` and `AdaptiveEncoder`
+- **Engine integration** (`desktop/src-tauri/src/engine.rs`): Both Android and desktop send tasks poll every 25 frames and apply tuning
+
+### Opus6k DRED extended
+
+`dred_duration_for(Opus6k)` changed from 50 (500ms) to 104 (1040ms) — the maximum libopus 1.5 supports. The RDO-VAE's quality-vs-offset curve makes this nearly free in bitrate terms while doubling burst resilience on the worst links.
+
+### Jitter spike detection ("Sawtooth" prediction)
+
+When instantaneous jitter exceeds the EWMA × 1.3 (asymmetric: fast-up α=0.3, slow-down α=0.05), the tuner enters spike-boost mode:
+- DRED immediately jumps to the codec tier's ceiling
+- Cooldown: 10 cycles (~5 seconds at 25 packets/cycle)
+- Designed for Starlink satellite handover sawtooth jitter pattern
+
+### Test coverage
+
+- 10 unit tests for tuner math (baseline, scaling, spike, cooldown, codec switch, Codec2 no-op)
+- 4 integration tests (encoder adjustment, spike boost, Codec2 no-op, profile switch with encode verification)
+
+### Opus6k Frame Starvation Bug (Fixed 2026-04-13)
+
+During testing of the extended 1040ms DRED window on Opus6k, the 40ms codec produced only ~11 frames/s instead of 25 — making audio choppy regardless of DRED quality.
+
+**Root cause:** The Android capture ring read loop did partial reads that consumed samples from the ring but discarded them when retrying:
+1. Ring has 960 samples (one Oboe burst)
+2. `audio_read_capture(&mut buf[..1920])` reads 960 into `buf[0..960]`, returns 960
+3. Loop sees 960 < 1920, sleeps, retries from `buf[0..]` → overwrites the consumed samples
+4. ~50% of captured audio thrown away per frame
+
+**Fix:** Added `wzp_native_audio_capture_available()` to check ring fill level before reading (same pattern as the desktop CPAL path's `capture_ring.available()`). Also made `frame_samples` mutable so codec switches update the read size.
+
+**Affected codecs:** Only 40ms frame codecs (Opus6k, Codec2_1200). 20ms codecs (Opus24k, etc.) were unaffected because a single Oboe burst fills the entire request.

docs/PRD-engine-dedup.md

@@ -0,0 +1,140 @@
+# PRD: Engine.rs Deduplication — Extract Shared Send/Recv Helpers
+
+## Problem
+
+`desktop/src-tauri/src/engine.rs` is 1,705 lines with two nearly identical `CallEngine::start()` implementations — one for Android (880 lines) and one for desktop (430 lines). ~350 lines are copy-pasted between them. Every change to the encode/decode/adaptive-quality pipeline requires editing both places, and they've already diverged in subtle ways (Android has extensive first-join diagnostics that desktop lacks).
+
+## Scope
+
+Extract the duplicated logic into shared helper functions. The Android and desktop paths should only differ in their audio I/O mechanism (Oboe ring via wzp-native vs CPAL capture_ring/playout_ring).
+
+## What's Duplicated
+
+| Block | Description | Lines (each) |
+|-------|-------------|------|
+| `build_call_config()` | Resolve quality string → CallConfig | 23 |
+| Codec-to-profile match | Map CodecId → QualityProfile for decoder switch | 19 |
+| Adaptive quality switch | Read AtomicU8, index_to_profile, set_profile, update frame_samples + dred_tuner | 15 |
+| DRED tuner poll | Check frame counter, poll quinn stats, apply tuning | 15 |
+| Quality report ingestion | Extract quality_report, feed to AdaptiveQualityController, store to AtomicU8 | 8 |
+| Signal task | Accept signals, handle RoomUpdate/QualityDirective/Hangup | 48 |
+| **Total** | | **~128 lines × 2 = 256 lines eliminated** |
+
+## Implementation
+
+### Phase 1: Top-Level Helper Functions
+
+```rust
+fn build_call_config(quality: &str) -> CallConfig {
+    let profile = resolve_quality(quality);
+    match profile {
+        Some(p) => CallConfig {
+            noise_suppression: false,
+            suppression_enabled: false,
+            ..CallConfig::from_profile(p)
+        },
+        None => CallConfig {
+            noise_suppression: false,
+            suppression_enabled: false,
+            ..CallConfig::default()
+        },
+    }
+}
+
+fn codec_to_profile(codec: CodecId) -> QualityProfile {
+    match codec {
+        CodecId::Opus24k => QualityProfile::GOOD,
+        CodecId::Opus6k => QualityProfile::DEGRADED,
+        CodecId::Opus32k => QualityProfile::STUDIO_32K,
+        CodecId::Opus48k => QualityProfile::STUDIO_48K,
+        CodecId::Opus64k => QualityProfile::STUDIO_64K,
+        CodecId::Codec2_1200 => QualityProfile::CATASTROPHIC,
+        CodecId::Codec2_3200 => QualityProfile {
+            codec: CodecId::Codec2_3200,
+            fec_ratio: 0.5,
+            frame_duration_ms: 20,
+            frames_per_block: 5,
+        },
+        other => QualityProfile { codec: other, ..QualityProfile::GOOD },
+    }
+}
+
+fn check_adaptive_switch(
+    pending: &AtomicU8,
+    encoder: &mut CallEncoder,
+    tuner: &mut wzp_proto::DredTuner,
+    frame_samples: &mut usize,
+    tx_codec: &tokio::sync::Mutex<String>,
+) -> bool {
+    let p = pending.swap(PROFILE_NO_CHANGE, Ordering::Acquire);
+    if p == PROFILE_NO_CHANGE { return false; }
+    if let Some(new_profile) = index_to_profile(p) {
+        let new_fs = (new_profile.frame_duration_ms as usize) * 48;
+        if encoder.set_profile(new_profile).is_ok() {
+            *frame_samples = new_fs;
+            tuner.set_codec(new_profile.codec);
+            // Caller updates tx_codec display string
+            return true;
+        }
+    }
+    false
+}
+```
+
+### Phase 2: Shared Signal Task
+
+Extract the signal task into a standalone async function:
+
+```rust
+async fn run_signal_task(
+    transport: Arc<wzp_transport::QuinnTransport>,
+    running: Arc<AtomicBool>,
+    pending_profile: Arc<AtomicU8>,
+    participants: Arc<Mutex<Vec<ParticipantInfo>>>,
+) {
+    loop {
+        if !running.load(Ordering::Relaxed) { break; }
+        match tokio::time::timeout(
+            Duration::from_millis(SIGNAL_TIMEOUT_MS),
+            transport.recv_signal(),
+        ).await {
+            Ok(Ok(Some(msg))) => {
+                // Handle RoomUpdate, QualityDirective, Hangup...
+            }
+            _ => {}
+        }
+    }
+}
+```
+
+### Phase 3: Shared DRED Poll + Quality Ingestion
+
+These are small blocks but appear in both send and recv tasks. Extract as inline helpers or closures.
+
+## Verification
+
+1. `cargo check --workspace` — must compile
+2. `cargo test -p wzp-proto -p wzp-relay -p wzp-client --lib` — must pass
+3. Manual test: place a call Android↔Desktop, verify audio works in both directions
+4. Verify adaptive quality still switches (set one side to auto, degrade network)
+
+## Effort
+
+- Phase 1: 1 hour (extract 3 functions, update 6 call sites)
+- Phase 2: 30 min (extract signal task, update 2 spawn sites)
+- Phase 3: 30 min (cleanup remaining small duplicates)
+- Total: ~2 hours
+
+## Not In Scope
+
+- Audio I/O trait abstraction (Oboe vs CPAL) — different project, different risk profile
+- Moving Android-specific diagnostics (first-join, PCM recorder) into a feature flag
+- Splitting engine.rs into multiple files
+
+## Implementation Status (2026-04-13)
+
+All phases implemented:
+- build_call_config(): shared CallConfig construction — DONE
+- codec_to_profile(): shared CodecId → QualityProfile mapping — DONE
+- run_signal_task(): shared signal handler — DONE
+- Net reduction: ~39 lines, 6 duplicated blocks → single-line calls

docs/PRD-hard-nat.md

@@ -0,0 +1,220 @@
+# PRD: Hard NAT Traversal (Port Prediction + Birthday Attack)
+
+> Phase: Partial implementation
+> Status: Phase A done, Phase B signal ready, C-D not started (2026-04-14)
+> Crate: wzp-client, wzp-proto, wzp-relay
+
+## Problem
+
+When both peers are behind **symmetric NATs** (endpoint-dependent mapping), standard hole-punching fails because the external port changes per destination. Our Phase 8.2 port mapping (NAT-PMP/PCP/UPnP) solves this when the router supports it (~70% of consumer routers), but the remaining ~30% — plus corporate firewalls, cloud NATs (AWS/Azure), and carrier-grade NATs — fall back to relay.
+
+Tailscale tackles this with two techniques:
+1. **Port prediction** for NATs with sequential allocation patterns
+2. **Birthday attack** for NATs with random allocation
+
+Both are viable when **at least one peer has a predictable NAT** (easy+hard pair). When **both** peers have fully random symmetric NATs, even Tailscale falls back to relay.
+
+## Background: How Symmetric NATs Allocate Ports
+
+| Pattern | Behavior | Prevalence | Traversal |
+|---------|----------|------------|-----------|
+| **Sequential** | port N, N+1, N+2... per new flow | ~40% of symmetric NATs (home routers) | Port prediction viable |
+| **Random** | truly random port per flow | ~50% (enterprise, cloud, CGNAT) | Birthday attack only |
+| **Port-preserving** | same as source port when possible | ~10% (behaves like cone NAT) | Standard hole-punch works |
+
+## Solution Overview
+
+### Phase A: NAT Port Allocation Pattern Detection
+
+Before attempting hard NAT traversal, detect whether the NAT allocates ports sequentially or randomly. This determines which strategy to use.
+
+**Method**: Send 5 STUN Binding Requests from the same source socket to 5 different STUN servers. Collect the 5 observed external ports. Analyze:
+
+```
+Ports: [40001, 40002, 40003, 40004, 40005]  → Sequential (delta=1)
+Ports: [40001, 40003, 40005, 40007, 40009]  → Sequential (delta=2)
+Ports: [40001, 52847, 19432, 61203, 8847]   → Random
+Ports: [4433,  4433,  4433,  4433,  4433]   → Port-preserving (cone-like)
+```
+
+Classification:
+- All same port → `PortPreserving` (use standard hole-punch)
+- Consistent delta between consecutive ports → `Sequential { delta: i16 }`
+- No pattern → `Random`
+
+**New struct**:
+```rust
+pub enum PortAllocation {
+    PortPreserving,
+    Sequential { delta: i16 },
+    Random,
+    Unknown,
+}
+```
+
+Add to `NetcheckReport` and `NatDetection`.
+
+### Phase B: Port Prediction (Sequential NATs)
+
+When the NAT is sequential, we can **predict** the next external port:
+
+1. Client sends a STUN probe → observes external port P
+2. Client knows the NAT will assign P+delta for the next outbound flow
+3. Client tells peer (via relay or chat): "dial me at `my_ip:(P + delta * N)`" where N is the number of flows the client will open before the peer's packet arrives
+4. Client opens a QUIC connection to the peer's predicted port at the same time
+5. If the prediction lands within a small window, the QUIC handshake succeeds
+
+**Timing is critical**: both peers must probe, predict, and dial within a tight window (~500ms) so the port prediction doesn't drift.
+
+**Coordination via relay** (or out-of-band chat):
+```
+SignalMessage::HardNatProbe {
+    call_id: String,
+    /// My observed port sequence (last 3 ports, most recent first)
+    port_sequence: Vec<u16>,
+    /// My detected allocation pattern
+    allocation: PortAllocation,
+    /// Timestamp (ms since epoch) — for synchronization
+    probe_time_ms: u64,
+    /// My external IP (from STUN)
+    external_ip: String,
+}
+```
+
+Both peers exchange `HardNatProbe`, then simultaneously:
+1. Each predicts the other's next port: `peer_ip:(peer_last_port + peer_delta * offset)`
+2. Each opens N parallel QUIC connections to predicted port range: `[predicted - 2, predicted + 2]`
+3. First successful handshake wins
+
+**Expected success rate**: ~80% for sequential NATs with consistent delta, within 2-3 seconds.
+
+### Phase C: Birthday Attack (Random NATs)
+
+When the NAT is random, port prediction is impossible. Instead, exploit the **birthday paradox**:
+
+**Math**: With N ports open on side A and M probes from side B into a 65536-port space:
+- N=256, M=256: P(collision) ≈ 1 - e^(-256*256/65536) ≈ 63%
+- N=256, M=512: P(collision) ≈ 1 - e^(-256*512/65536) ≈ 87%
+- N=256, M=1024: P(collision) ≈ 1 - e^(-256*1024/65536) ≈ 98%
+
+**Implementation**:
+
+1. **Acceptor side** (easy NAT or the side with more ports available):
+   - Open 256 UDP sockets bound to random ports
+   - For each socket, send one STUN probe to learn its external port
+   - Report all 256 external ports to the peer
+
+2. **Dialer side** (hard NAT):
+   - Send 1024 QUIC Initial packets to random ports on the Acceptor's external IP
+   - Rate: 100-200 packets/sec to avoid triggering rate limits
+   - Duration: ~5-10 seconds
+
+3. **Collision detection**:
+   - When one of the Dialer's packets hits one of the Acceptor's open ports, the QUIC handshake begins
+   - The Acceptor sees an incoming Initial on one of its 256 sockets
+
+**Problem for VoIP**: This takes 5-10 seconds even at high probe rates. For a phone call, this means a long "connecting..." phase. Acceptable as a last resort before relay fallback.
+
+### Phase D: Hybrid Strategy
+
+Combine all techniques in a waterfall:
+
+```
+1. Port mapping (NAT-PMP/PCP/UPnP)     → <100ms   [Phase 8.2, done]
+   ↓ failed
+2. Standard hole-punch (cone NAT)       → <500ms   [Phase 3-6, done]
+   ↓ failed (symmetric NAT detected)
+3. Port prediction (sequential NAT)     → <2s      [Phase A+B, new]
+   ↓ failed (random NAT detected)
+4. Birthday attack (one side random)    → <10s     [Phase C, new]
+   ↓ failed (both sides random)
+5. Relay fallback                       → always   [Phase 1, done]
+```
+
+The relay path starts **immediately in parallel** with all direct attempts (existing 500ms head-start architecture). The user hears audio via relay while the harder traversal techniques probe in the background. If a direct path is found, the call seamlessly upgrades (using the Phase 8.3 transport hot-swap mechanism).
+
+## QUIC-Specific Challenges
+
+### 1. Connection ID Mismatch
+QUIC's Initial packet contains a random Destination Connection ID. When birthday-attack probes land on the Acceptor's socket, the CID won't match any expected value. Quinn handles this via its `Endpoint` which accepts any incoming Initial — but we need to ensure the Endpoint is in server mode on all 256 ports.
+
+**Solution**: Use quinn's `Endpoint` with a server config on each socket. Quinn's accept logic handles unknown CIDs correctly.
+
+### 2. Probe Packet Format
+Birthday attack probes must be valid QUIC Initial packets (not raw UDP). Quinn's `Endpoint::connect()` sends a proper Initial, so each probe is a real connection attempt. Failed probes time out naturally.
+
+### 3. Stateful Connections
+Unlike WireGuard (stateless), each QUIC probe creates connection state. With 1024 probes, that's 1024 half-open connections. Must aggressively abort losers once one succeeds.
+
+**Solution**: Use `JoinSet` (existing pattern in `dual_path.rs`) and `abort_all()` on first success.
+
+### 4. NAT Pinhole Lifetime
+QUIC Initial retransmission timer (1s default) may exceed the NAT pinhole lifetime on aggressive NATs. One probe per port may not be enough.
+
+**Solution**: Send 2-3 Initials per predicted port, 200ms apart.
+
+## Signal Protocol
+
+New variants:
+
+```rust
+/// Hard NAT probe coordination — exchanged before birthday attack.
+HardNatProbe {
+    call_id: String,
+    /// Last 5 observed external ports (most recent first).
+    port_sequence: Vec<u16>,
+    /// Detected allocation pattern.
+    allocation: String,  // "sequential:1", "sequential:2", "random", "preserving"
+    /// Probe timestamp for synchronization (ms since epoch).
+    probe_time_ms: u64,
+    /// External IP from STUN.
+    external_ip: String,
+}
+
+/// Hard NAT birthday attack coordination.
+HardNatBirthdayStart {
+    call_id: String,
+    /// Number of ports opened by the acceptor side.
+    acceptor_port_count: u16,
+    /// External ports the acceptor has open (for targeted probing).
+    /// Only sent if port_count is small enough to enumerate.
+    acceptor_ports: Vec<u16>,
+    /// "start probing now" timestamp.
+    start_at_ms: u64,
+}
+```
+
+## Integration with Existing Architecture
+
+- **Netcheck**: `NetcheckReport` gains `port_allocation: PortAllocation` field
+- **IceAgent**: `gather()` includes port allocation detection; `re_gather()` re-probes on network change
+- **dual_path**: `race()` extended with hard-NAT probe phase between standard hole-punch timeout and relay commitment
+- **Desktop**: `place_call` / `answer_call` exchange `HardNatProbe` when both sides report `SymmetricPort` NAT type
+
+## Effort Estimate
+
+| Phase | Scope | Effort | Status |
+|-------|-------|--------|--------|
+| A | Port allocation pattern detection | 1 day | **Done** — `PortAllocation` enum, `detect_port_allocation()`, `classify_port_allocation()`, `predict_ports()`, 17 tests |
+| B | Sequential port prediction + coordination | 2 days | **Signal ready** — `HardNatProbe` signal + relay forwarding done. `dual_path::race()` integration pending |
+| C | Birthday attack (256 sockets + 1024 probes) | 3 days | Not started |
+| D | Hybrid waterfall + background upgrade | 2 days | Not started |
+
+**Total**: ~8 days. Phase A is done and feeds into netcheck. Phase B has signal plumbing complete — needs `dual_path::race()` integration to actually dial predicted ports. Phase C (birthday) is the most complex and lowest ROI.
+
+## Success Criteria
+
+- Port allocation detection correctly classifies sequential vs random on test routers
+- Sequential port prediction achieves >70% direct connection rate on sequential-NAT routers
+- Birthday attack achieves >90% within 10 seconds when one peer has cone NAT
+- Relay-to-direct upgrade is seamless (no audio gap) via Phase 8.3 transport hot-swap
+- No regression in call setup time for cone-NAT pairs (the common case)
+
+## References
+
+- [Tailscale: How NAT traversal works](https://tailscale.com/blog/how-nat-traversal-works)
+- [Tailscale: NAT traversal improvements pt.1](https://tailscale.com/blog/nat-traversal-improvements-pt-1)
+- [Tailscale: NAT traversal improvements pt.2 — cloud environments](https://tailscale.com/blog/nat-traversal-improvements-pt-2-cloud-environments)
+- RFC 4787: NAT Behavioral Requirements for Unicast UDP
+- RFC 5245: ICE (Interactive Connectivity Establishment)
+- Birthday problem: P(collision) = 1 - e^(-n²/2m) where n=probes, m=port space

docs/PRD-ice-regather.md

@@ -0,0 +1,116 @@
+# PRD: Mid-Call ICE Re-Gathering
+
+> Phase: Implemented (signal plane); transport hot-swap deferred
+> Status: Partial (2026-04-14)
+> Crate: wzp-client, wzp-proto, wzp-relay
+
+## Problem
+
+When a mobile device transitions between networks (WiFi -> cellular, IP address change), the active QUIC connection dies. The call stays on a dead path until timeout, then the user experiences silence. There is no mechanism to re-discover candidates and re-establish a direct path mid-call.
+
+Android's `NetworkMonitor.onIpChanged` already fires on `onLinkPropertiesChanged`, but nothing consumes it for candidate re-gathering or path migration.
+
+## Solution
+
+Implement an `IceAgent` that manages the full candidate lifecycle — initial gathering, mid-call re-gathering on network change, and peer candidate application. A new `CandidateUpdate` signal message carries refreshed candidates to the peer through the relay.
+
+## Implementation
+
+### New Module: `crates/wzp-client/src/ice_agent.rs`
+
+**IceAgent struct**:
+- Owns `IceAgentConfig` (STUN config, portmap toggle, gather timeout, local ports)
+- Monotonic `generation: AtomicU32` — incremented on each re-gather, peers reject stale updates
+- `peer_generation: AtomicU32` — tracks last-seen peer generation for ordering
+
+**Public API**:
+- `gather()` -> `CandidateSet` — runs STUN + portmap + host candidates in parallel with timeout
+- `re_gather()` -> `(CandidateSet, SignalMessage)` — increments generation, returns update to send
+- `apply_peer_update(signal)` -> `Option<PeerCandidates>` — parses `CandidateUpdate`, rejects if generation <= last-seen
+
+**CandidateSet**:
+```rust
+pub struct CandidateSet {
+    pub reflexive: Option<SocketAddr>,
+    pub local: Vec<SocketAddr>,
+    pub mapped: Option<SocketAddr>,
+    pub generation: u32,
+}
+```
+
+### New Signal: `CandidateUpdate`
+
+```rust
+CandidateUpdate {
+    call_id: String,
+    reflexive_addr: Option<String>,
+    local_addrs: Vec<String>,
+    mapped_addr: Option<String>,
+    generation: u32,
+}
+```
+
+- All address fields use `#[serde(default, skip_serializing_if)]` for backward compat
+- Generation counter is mandatory — prevents stale updates from network reordering
+
+### Relay Forwarding
+
+`CandidateUpdate` is forwarded to the call peer using the same pattern as `MediaPathReport`:
+1. Look up peer fingerprint + `peer_relay_fp` from `CallRegistry`
+2. If cross-relay: wrap in `FederatedSignalForward` and forward via federation link
+3. If local: send via `signal_hub.send_to()`
+
+### Desktop Handling
+
+Signal recv loop handles `CandidateUpdate`:
+- Logs generation, reflexive, mapped, local count
+- Emits `recv:CandidateUpdate` debug event
+- Emits `signal-event` type `candidate_update` to JS frontend
+- TODO: wire into `IceAgent.apply_peer_update()` + `race_upgrade()` for transport hot-swap
+
+### Deferred: Transport Hot-Swap
+
+The actual mid-call transport replacement is not yet wired. The designed approach:
+- `Arc<RwLock<Arc<QuinnTransport>>>` — send/recv tasks clone inner Arc per frame
+- On upgrade, swap inner Arc under write lock — next frame picks up new transport
+- Android: `pending_ice_regather: AtomicBool` polled in recv task, triggers re-gather + swap
+- Requires live testing to validate seamless audio continuity during swap
+
+## Signal Flow
+
+```
+Network change (WiFi -> cellular)
+    |
+    v
+IceAgent::re_gather()
+    |-- stun::discover_reflexive()
+    |-- portmap::acquire_port_mapping()
+    |-- local_host_candidates()
+    |
+    v
+SignalMessage::CandidateUpdate { generation: N+1 }
+    |
+    v (via relay)
+Peer IceAgent::apply_peer_update()
+    |
+    v
+PeerCandidates { reflexive, local, mapped }
+    |
+    v
+dual_path::race() with new candidates [NOT YET WIRED]
+```
+
+## Files
+
+| File | Change |
+|------|--------|
+| `crates/wzp-client/src/ice_agent.rs` | New — IceAgent + CandidateSet |
+| `crates/wzp-proto/src/packet.rs` | `CandidateUpdate` variant |
+| `crates/wzp-relay/src/main.rs` | Forward `CandidateUpdate` to peer |
+| `crates/wzp-client/src/featherchat.rs` | Map `CandidateUpdate` to `IceCandidate` type |
+| `desktop/src-tauri/src/lib.rs` | Handle `CandidateUpdate` in signal recv loop |
+
+## Testing
+
+- 10 unit tests: generation monotonicity, apply_peer_update (all fields, empty fields, unparseable addrs, stale rejection, wrong signal type), default config, gather with no STUN, re_gather produces signal with incrementing generation
+- 2 protocol roundtrip tests: CandidateUpdate full + minimal

docs/PRD-mtu-discovery.md

@@ -57,3 +57,28 @@ When the path MTU is small, the relay or client should:
 - MTU-based codec selection (future, needs adaptive quality)
 
 ## Effort: 1 day
+
+## Implementation Status (2026-04-12)
+
+Phase 1 is now implemented:
+
+### What was built
+
+- **Transport config** (`crates/wzp-transport/src/config.rs`):
+  - `MtuDiscoveryConfig` with `upper_bound=1452`, `interval=300s`, `black_hole_cooldown=30s`
+  - `initial_mtu=1200` (safe QUIC minimum)
+  - Quinn's PLPMTUD binary-searches from 1200 up to 1452 automatically
+
+- **`QuinnPathSnapshot::current_mtu`** (`crates/wzp-transport/src/quic.rs`):
+  - Reads `connection.max_datagram_size()` which reflects the PMTUD-discovered value
+  - Available to all callers via `transport.quinn_path_stats()`
+
+- **Trunk batcher MTU-aware** (`crates/wzp-relay/src/room.rs`):
+  - `TrunkedForwarder::new()` initializes `max_bytes` from discovered MTU
+  - `send()` refreshes `max_bytes` on every call (cheap atomic read in quinn)
+  - Federation trunk frames grow automatically as PMTUD discovers larger paths
+
+### Phases 2-3 status
+
+- Phase 2 (handle MTU failures): Already handled — `send_media()`/`send_trunk()` check `max_datagram_size()` and return `DatagramTooLarge` errors. These are logged and the packet is dropped gracefully.
+- Phase 3 (codec-aware MTU): Not yet implemented. Future video frames will need application-layer fragmentation when they exceed the discovered MTU.

docs/PRD-netcheck.md

@@ -0,0 +1,77 @@
+# PRD: Network Diagnostic (Netcheck)
+
+> Phase: Implemented
+> Status: Done (2026-04-14)
+> Crate: wzp-client
+
+## Problem
+
+When P2P connections fail or call quality is poor, there is no diagnostic tool to understand why. Users and developers must manually probe STUN, check NAT type, test relay connectivity, and verify port mapping support — all separately. Tailscale's `netcheck` consolidates all of this into a single diagnostic report.
+
+## Solution
+
+A comprehensive `run_netcheck()` function that probes all network capabilities in parallel and produces a structured `NetcheckReport`. Exposed as a CLI subcommand (`wzp-client --netcheck`) and available for in-app diagnostics.
+
+## Implementation
+
+### New Module: `crates/wzp-client/src/netcheck.rs`
+
+**NetcheckReport**:
+```rust
+pub struct NetcheckReport {
+    pub nat_type: NatType,
+    pub reflexive_addr: Option<String>,
+    pub ipv4_reachable: bool,
+    pub ipv6_reachable: bool,
+    pub hairpin_works: Option<bool>,
+    pub port_mapping: Option<PortMapProtocol>,
+    pub relay_latencies: Vec<RelayLatency>,
+    pub preferred_relay: Option<String>,
+    pub stun_latency_ms: Option<u32>,
+    pub upnp_available: bool,
+    pub pcp_available: bool,
+    pub nat_pmp_available: bool,
+    pub gateway: Option<String>,
+    pub duration_ms: u32,
+    pub stun_probes: Vec<NatProbeResult>,
+    pub port_allocation: Option<PortAllocation>,
+}
+```
+
+**Probes (all parallel via `tokio::join!`)**:
+1. **STUN probes** — `probe_stun_servers()` to all configured STUN servers
+2. **Relay latencies** — `probe_reflect_addr()` to each configured relay
+3. **Port mapping** — `acquire_port_mapping()` to detect NAT-PMP/PCP/UPnP
+4. **Gateway** — `default_gateway()` for the router address
+5. **IPv6** — attempt to bind `[::]:0` and send to an IPv6 STUN server
+6. **Port allocation** — `detect_port_allocation()` probes STUN servers from single socket to classify NAT pattern as PortPreserving/Sequential/Random (feeds into hard NAT prediction)
+
+**Derived fields**:
+- `nat_type` / `reflexive_addr` — from `classify_nat()` on STUN probes
+- `ipv4_reachable` — true if any STUN probe succeeded
+- `preferred_relay` — relay with lowest RTT
+- `port_mapping` / `nat_pmp_available` / `pcp_available` / `upnp_available` — from portmap result
+
+**Human-readable output**: `format_report()` produces a formatted text report with sections for NAT info, port mapping, STUN probes, relay latencies.
+
+### CLI Integration
+
+`wzp-client --netcheck <relay-addr>` — runs the diagnostic using the specified relay plus default STUN servers, prints the report, and exits.
+
+### Deferred
+
+- **Hairpin test** — send packet from shared endpoint to own reflexive addr to test NAT hairpinning. Architecture is in place (`hairpin_works: Option<bool>`) but the actual probe is not yet implemented.
+- **Android/Desktop in-app UI** — expose via JNI (Android) and Tauri command (desktop) for user-facing diagnostics.
+
+## Files
+
+| File | Change |
+|------|--------|
+| `crates/wzp-client/src/netcheck.rs` | New — NetcheckReport + run_netcheck + format_report |
+| `crates/wzp-client/src/lib.rs` | Add `pub mod netcheck` |
+| `crates/wzp-client/src/cli.rs` | `--netcheck` flag + handler |
+
+## Testing
+
+- 5 unit tests: default config, report JSON serialization + roundtrip, RelayLatency serialization, format_report with empty relays, format_report with full data (STUN probes, relay latencies, preferred relay, port mapping)
+- 1 integration test (`#[ignore]`): full netcheck run

docs/PRD-network-awareness.md

@@ -0,0 +1,139 @@
+# PRD: Network Awareness
+
+> Phase: Implemented (core path)  
+> Status: Ready for testing  
+> Platform: Android native Kotlin app (com.wzp)
+
+## Problem
+
+WarzonePhone's quality controller (`AdaptiveQualityController`) had a `signal_network_change()` API for proactive adaptation to WiFi↔cellular transitions, but nothing called it. Network handoffs during calls were only detected reactively via jitter spikes — by which time the user had already experienced degraded audio.
+
+## Solution
+
+Integrate Android's `ConnectivityManager.NetworkCallback` to detect network transport changes in real-time and feed them to the quality controller. This enables:
+
+1. **Preemptive quality downgrade** when switching from WiFi to cellular
+2. **FEC boost** (10-second window with +0.2 ratio) after any network change
+3. **Faster downgrade thresholds** on cellular (2 consecutive reports vs 3 on WiFi)
+
+## Architecture
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│ Android                                                      │
+│                                                              │
+│  ConnectivityManager                                         │
+│       │ NetworkCallback                                      │
+│       ▼                                                      │
+│  NetworkMonitor.kt                                           │
+│       │ onNetworkChanged(type, bandwidthKbps)                │
+│       ▼                                                      │
+│  CallViewModel.kt ──► WzpEngine.onNetworkChanged()           │
+│                            │ JNI                             │
+│                            ▼                                 │
+│  jni_bridge.rs: nativeOnNetworkChanged(handle, type, bw)     │
+│                            │                                 │
+│                            ▼                                 │
+│  engine.rs: state.pending_network_type.store(type)           │
+│                            │ AtomicU8 (lock-free)            │
+│                            ▼                                 │
+│  recv task: quality_ctrl.signal_network_change(ctx)          │
+│       │                                                      │
+│       ├─ Preemptive downgrade (WiFi → cellular)              │
+│       ├─ FEC boost 10s                                       │
+│       └─ Faster cellular thresholds                          │
+└──────────────────────────────────────────────────────────────┘
+```
+
+## Network Classification
+
+`NetworkMonitor` classifies the active transport without requiring `READ_PHONE_STATE` permission by using bandwidth heuristics:
+
+| Downstream Bandwidth | Classification | Rust `NetworkContext` |
+|----------------------|---------------|----------------------|
+| N/A (WiFi transport) | WiFi | `WiFi` |
+| >= 100 Mbps | 5G NR | `Cellular5g` |
+| >= 10 Mbps | LTE | `CellularLte` |
+| < 10 Mbps | 3G or worse | `Cellular3g` |
+| Ethernet | WiFi (equivalent) | `WiFi` |
+| Network lost | None | `Unknown` |
+
+## Cross-Task Signaling
+
+The network type is communicated from the JNI thread to the recv task via `AtomicU8` — the same pattern used for `pending_profile` (adaptive quality profile switches):
+
+```
+JNI thread                     recv task (tokio)
+    │                               │
+    │ store(type, Release)          │
+    │──────────────────────────────►│
+    │                               │ swap(0xFF, Acquire)
+    │                               │ if != 0xFF:
+    │                               │   quality_ctrl.signal_network_change(ctx)
+    │                               │
+```
+
+Sentinel value `0xFF` means "no change pending". The recv task polls on every received packet (~20-40ms), so latency is bounded by the inter-packet interval.
+
+## Components
+
+### New File
+
+| File | Purpose |
+|------|---------|
+| `android/.../net/NetworkMonitor.kt` | ConnectivityManager callback, transport classification, deduplication |
+
+### Modified Files
+
+| File | Change |
+|------|--------|
+| `android/.../engine/WzpEngine.kt` | Added `onNetworkChanged()` method + `nativeOnNetworkChanged` external |
+| `android/.../ui/call/CallViewModel.kt` | Instantiates NetworkMonitor, wires callback, register/unregister lifecycle |
+| `crates/wzp-android/src/jni_bridge.rs` | Added `Java_com_wzp_engine_WzpEngine_nativeOnNetworkChanged` JNI entry |
+| `crates/wzp-android/src/engine.rs` | Added `pending_network_type: AtomicU8` to EngineState, recv task polls it |
+
+### Unchanged (already implemented)
+
+| File | API |
+|------|-----|
+| `crates/wzp-proto/src/quality.rs` | `AdaptiveQualityController::signal_network_change(NetworkContext)` |
+| `crates/wzp-transport/src/path_monitor.rs` | `PathMonitor::detect_handoff()` (available for future use) |
+
+## Deferred Work
+
+### Tauri Desktop App (com.wzp.desktop)
+
+~~The Tauri engine doesn't use `AdaptiveQualityController` — quality is resolved once at call start.~~ **Update (2026-04-13):** Desktop now has `AdaptiveQualityController` wired into the recv task with `pending_profile` AtomicU8 bridge. Network monitoring on desktop is now feasible — the blocker was adaptive quality, which is done. Remaining work: platform-specific network change detection (macOS: `SCNetworkReachability` or `NWPathMonitor`; Linux: `netlink` socket).
+
+### Mid-Call ICE Re-gathering — PARTIALLY IMPLEMENTED (2026-04-14)
+
+When the device's IP address changes, the system now:
+1. Re-gather local host candidates (`local_host_candidates()`) ✅
+2. Re-probe STUN (`stun::discover_reflexive()` + `portmap::acquire_port_mapping()`) ✅
+3. Send updated candidates to the peer (`CandidateUpdate` signal message) ✅
+4. Relay forwards `CandidateUpdate` to peer (same pattern as `MediaPathReport`) ✅
+5. Peer receives and can parse via `IceAgent::apply_peer_update()` ✅
+6. Attempt new dual-path race for path upgrade — **NOT YET WIRED** (transport hot-swap)
+
+`NetworkMonitor.onIpChanged` fires on `onLinkPropertiesChanged` — the hook is ready.
+The signaling plane is fully implemented via `IceAgent` + `CandidateUpdate`.
+Remaining: wire `onIpChanged` → JNI → `pending_ice_regather` AtomicBool → recv task → `ice_agent.re_gather()` → transport swap.
+
+New modules added in Phase 8 (Tailscale-inspired):
+- `crates/wzp-client/src/ice_agent.rs` — candidate lifecycle management
+- `crates/wzp-client/src/stun.rs` — public STUN server probing (independent of relay)
+- `crates/wzp-client/src/portmap.rs` — NAT-PMP/PCP/UPnP port mapping
+- `crates/wzp-client/src/netcheck.rs` — comprehensive network diagnostic
+
+## Testing
+
+1. Build native APK
+2. Start a call on WiFi
+3. Verify logcat: `quality controller: network context updated` with `ctx=WiFi`
+4. Disable WiFi → device falls to cellular
+5. Verify logcat: `ctx=CellularLte` (or `Cellular5g`/`Cellular3g`)
+6. Verify FEC boost activates (check quality_ctrl logs)
+7. Verify preemptive quality downgrade (tier drops one level on WiFi→cellular)
+8. Re-enable WiFi → verify transition back
+9. Rapid WiFi toggle (5x in 10s) → verify no crashes, deduplication works
+10. Airplane mode → verify `onLost` fires with `TYPE_NONE`

docs/PRD-p2p-direct.md

@@ -138,9 +138,75 @@ The existing relay connection carries `IceCandidate` signals. No new infrastruct
 
 ## Milestones
 
-| Phase | Scope | Effort |
-|-------|-------|--------|
-| 1 | STUN client + candidate gathering | 2 days |
-| 2 | QUIC hole punching + identity verification | 3 days |
-| 3 | Adaptive quality on P2P connection | 2 days |
-| 4 | Hybrid mode (relay + P2P, seamless migration) | 3 days |
+| Phase | Scope | Effort | Status |
+|-------|-------|--------|--------|
+| 1 | STUN client + candidate gathering | 2 days | Done |
+| 2 | QUIC hole punching + identity verification | 3 days | Done |
+| 3 | Adaptive quality on P2P connection | 2 days | Done (#23) |
+| 4 | Hybrid mode (relay + P2P, seamless migration) | 3 days | Done |
+| 5 | Single-socket Nebula (shared signal+direct endpoint) | 2 days | Done |
+| 6 | ICE path negotiation + dual-path race | 3 days | Done |
+| 7 | IPv6 dual-socket | 2 days | Done (but `dual_path.rs` integration tests broken — missing `ipv6_endpoint` arg) |
+| 8.1 | Public STUN client (RFC 5389) | 1 day | Done |
+| 8.2 | PCP/PMP/UPnP port mapping | 2 days | Done |
+| 8.3 | Mid-call ICE re-gathering + CandidateUpdate signal | 2 days | Done (signal plane; transport hot-swap TODO) |
+| 8.4 | Netcheck diagnostic | 1 day | Done |
+| 8.5 | Region-based relay selection (data model) | 1 day | Done |
+| 8.6a | Hard NAT: port allocation detection | 1 day | Done |
+| 8.6b | Hard NAT: sequential port prediction signal | 1 day | Done (signal + prediction fn; dial integration pending) |
+| 8.6c | Hard NAT: birthday attack (256×1024 probes) | 3 days | Not started |
+| 8.6d | Hard NAT: hybrid waterfall + background upgrade | 2 days | Not started |
+
+## Implementation Status (2026-04-13)
+
+Phases 1-2, 4-7 are implemented. First P2P call completed 2026-04-12.
+
+### Known regression
+
+Phase 7 added `ipv6_endpoint: Option<Endpoint>` parameter to `race()` in `crates/wzp-client/src/dual_path.rs` but the 3 test call sites in `crates/wzp-client/tests/dual_path.rs` (lines 111, 153, 191) were not updated — they pass 6 args instead of 7. Fix: add `None,` after the `shared_endpoint` arg in each call.
+
+## Update (2026-04-13)
+
+P2P adaptive quality (#23) now implemented:
+- Both peers self-observe network quality from QUIC path stats
+- Quality reports generated every ~1s and attached to outgoing packets
+- AdaptiveQualityController drives codec switching on both P2P and relay calls
+
+## Update (2026-04-14): Phase 8 — Tailscale-Inspired Enhancements
+
+Added 5 new modules to bring NAT traversal capability close to Tailscale's:
+
+### Phase 8.1: Public STUN Client (Done)
+- `stun.rs`: RFC 5389 Binding Request/Response over raw UDP
+- Independent reflexive discovery via public STUN servers (Google, Cloudflare)
+- `detect_nat_type_with_stun()` combines relay + STUN probes for higher confidence
+- STUN fallback in desktop's `try_reflect_own_addr()` when relay reflection fails
+
+### Phase 8.2: PCP/PMP/UPnP Port Mapping (Done)
+- `portmap.rs`: NAT-PMP (RFC 6886), PCP (RFC 6887), UPnP IGD
+- Gateway discovery (macOS + Linux), try NAT-PMP → PCP → UPnP in sequence
+- New candidate type: `PeerCandidates.mapped` + signal fields `caller_mapped_addr`/`callee_mapped_addr`/`peer_mapped_addr`
+- Dial order: host → mapped → reflexive (mapped helps on symmetric NATs)
+
+### Phase 8.3: Mid-Call ICE Re-Gathering (Done — signal plane)
+- `ice_agent.rs`: `IceAgent` with `gather()`, `re_gather()`, `apply_peer_update()`
+- `SignalMessage::CandidateUpdate` with monotonic generation counter
+- Relay forwards `CandidateUpdate` like `MediaPathReport`
+- Desktop handles and emits to JS frontend
+- Transport hot-swap: designed but not yet wired into live call engine
+
+### Phase 8.4: Netcheck Diagnostic (Done)
+- `netcheck.rs`: comprehensive network diagnostic (NAT type, reflexive addr, IPv4/v6, port mapping, relay latencies)
+- CLI: `wzp-client --netcheck <relay>`
+
+### Phase 8.5: Region-Based Relay Selection (Done — data model)
+- `relay_map.rs`: `RelayMap` sorted by RTT with `preferred()` selection
+- `RegisterPresenceAck` extended with `relay_region` + `available_relays`
+
+### Phase 8.6: Hard NAT Traversal (Phase A done, B-D pending)
+- **Phase A (Done)**: Port allocation pattern detection — `PortAllocation` enum (`PortPreserving`/`Sequential{delta}`/`Random`/`Unknown`), `detect_port_allocation()` probes N STUN servers from single socket, `classify_port_allocation()` with wraparound + jitter tolerance, `predict_ports()` for sequential NATs
+- **Phase B (signal ready)**: `HardNatProbe` signal message carries `port_sequence`, `allocation`, `external_ip` — relay forwarding implemented. Actual dial-to-predicted-ports integration into `dual_path::race()` pending.
+- **Phase C (not started)**: Birthday attack (256 sockets × 1024 probes) for random NATs
+- **Phase D (not started)**: Hybrid waterfall with background relay-to-direct upgrade
+- `NetcheckReport.port_allocation` populated automatically from `detect_port_allocation()`
+- See `docs/PRD-hard-nat.md` for full design

docs/PRD-portmap.md

@@ -0,0 +1,92 @@
+# PRD: NAT Port Mapping (PCP/PMP/UPnP)
+
+> Phase: Implemented
+> Status: Done (2026-04-14)
+> Crate: wzp-client, wzp-proto, wzp-relay
+
+## Problem
+
+WarzonePhone falls back to relay-only when the client is behind a symmetric NAT (different external port per destination). The STUN-discovered reflexive address won't match what a peer sees, so direct hole-punching fails. Tailscale reports ~70% of consumer routers support NAT-PMP, PCP, or UPnP — protocols that let clients request explicit port mappings, making symmetric NATs traversable.
+
+## Solution
+
+Implement all three port mapping protocols, tried in sequence (NAT-PMP -> PCP -> UPnP). When a mapping is acquired, advertise the mapped address as a new candidate type alongside reflexive and host candidates. The relay cross-wires it into `CallSetup.peer_mapped_addr` so the peer can dial it.
+
+## Implementation
+
+### New Module: `crates/wzp-client/src/portmap.rs`
+
+**NAT-PMP (RFC 6886)**:
+- UDP to gateway:5351
+- External address request (opcode 0) -> returns router's public IP
+- Map UDP request (opcode 1) -> returns mapped external port + lifetime
+- 12-byte request, 16-byte response
+
+**PCP (RFC 6887)**:
+- Same gateway:5351, version 2
+- MAP opcode with client IP as IPv4-mapped IPv6
+- 60-byte request/response with 12-byte nonce for anti-spoofing
+- Superset of NAT-PMP, supports IPv6
+
+**UPnP IGD**:
+- SSDP M-SEARCH to 239.255.255.250:1900 for InternetGatewayDevice discovery
+- Parse LOCATION header -> fetch device description XML -> find WANIPConnection controlURL
+- SOAP `GetExternalIPAddress` -> router's public IP
+- SOAP `AddPortMapping` -> maps the QUIC port
+
+**Gateway discovery**:
+- macOS: `route -n get default` (parse `gateway:` line)
+- Linux/Android: `/proc/net/route` (parse hex gateway for 00000000 destination)
+
+**Public API**:
+- `acquire_port_mapping(internal_port, local_ip)` -> tries all 3, first success wins
+- `release_port_mapping(mapping)` -> best-effort cleanup (lifetime=0 for NAT-PMP)
+- `spawn_refresh(mapping)` -> background task renewing at half-lifetime
+- `default_gateway()` -> cross-platform gateway discovery
+
+### Signal Protocol Extensions
+
+| Message | New Field | Purpose |
+|---------|-----------|---------|
+| `DirectCallOffer` | `caller_mapped_addr: Option<String>` | Caller's port-mapped address |
+| `DirectCallAnswer` | `callee_mapped_addr: Option<String>` | Callee's port-mapped address |
+| `CallSetup` | `peer_mapped_addr: Option<String>` | Relay cross-wires peer's mapped addr |
+
+All fields use `#[serde(default, skip_serializing_if)]` for backward compatibility.
+
+### Relay Cross-Wiring
+
+`CallRegistry` extended with `caller_mapped_addr` / `callee_mapped_addr` fields + setter methods. The relay:
+1. Extracts `caller_mapped_addr` from `DirectCallOffer`, stores in registry
+2. Extracts `callee_mapped_addr` from `DirectCallAnswer`, stores in registry
+3. Cross-wires into `CallSetup`: caller gets callee's mapped addr as `peer_mapped_addr`, and vice versa
+
+### Candidate Priority
+
+`PeerCandidates.mapped` added to `dual_path.rs`. Dial order:
+1. Host (LAN) candidates — fastest on same-LAN
+2. **Port-mapped** — stable even behind symmetric NATs
+3. Server-reflexive (STUN) — standard hole-punching
+4. Relay — always-available fallback
+
+### Desktop Integration
+
+Both `place_call()` and `answer_call()` call `acquire_port_mapping()` using the signal endpoint's local port. Privacy-mode answers (`AcceptGeneric`) skip portmap to keep the address hidden.
+
+## Files
+
+| File | Change |
+|------|--------|
+| `crates/wzp-client/src/portmap.rs` | New — NAT-PMP/PCP/UPnP client |
+| `crates/wzp-client/src/dual_path.rs` | `PeerCandidates.mapped` field + dial_order update |
+| `crates/wzp-proto/src/packet.rs` | `caller/callee_mapped_addr` + `peer_mapped_addr` fields |
+| `crates/wzp-relay/src/call_registry.rs` | `caller/callee_mapped_addr` fields + setters |
+| `crates/wzp-relay/src/main.rs` | Extract, store, cross-wire mapped addrs |
+| `desktop/src-tauri/src/lib.rs` | Call portmap in place_call/answer_call |
+
+## Testing
+
+- 18 unit tests: NAT-PMP encoding, UPnP XML parsing (5 variants including real-world router XML), URL host extraction, error Display, protocol serde, PortMapping serialization, gateway detection, constants verification
+- 2 integration tests (`#[ignore]`): gateway discovery, acquire_mapping
+- 9 PeerCandidates tests: dial_order with all types, dedup, is_empty edge cases
+- 12 protocol roundtrip tests: offer/answer/setup with mapped addr, backward compat without

docs/PRD-protocol-analyzer.md

@@ -62,6 +62,16 @@ if debug_tap_enabled {
 
 ### Effort: 0.5 day
 
+### Implementation Status (2026-04-13)
+
+Fully implemented. `--debug-tap <room>` (or `*` for all rooms) logs:
+
+- **Per-packet metadata** (`TAP`): direction, addr, seq, codec, timestamp, FEC fields, payload size, fan_out
+- **Signal events** (`TAP SIGNAL`): `RoomUpdate` (count + participant names), `QualityDirective` (codec + reason), other signals by discriminant
+- **Lifecycle events** (`TAP EVENT`): participant join (id, addr, alias), participant leave (id, addr, forwarded count, or room closed)
+
+All output uses tracing `target: "debug_tap"` so it can be filtered with `RUST_LOG=debug_tap=info`.
+
 ---
 
 ## 2. Full Protocol Analyzer (Standalone Tool)
@@ -176,3 +186,15 @@ wzp-analyzer --replay capture.wzp --report report.html
 - Modifying packets in transit
 - Automated quality scoring (MOS estimation)
 - Video support
+
+## Implementation Status (2026-04-13)
+
+All phases implemented:
+- Phase 1 (Observer + stats): wzp-analyzer binary, passive room observer, per-participant stats — DONE
+- Phase 2 (TUI): ratatui display with color-coded loss severity — DONE
+- Phase 3 (Capture/Replay): Binary .wzp format + CaptureReader for offline replay — DONE
+- Phase 4 (HTML report): Self-contained with Chart.js loss/jitter timelines — DONE
+- Phase 5 (Encrypted decode): Stub — SFU E2E encryption requires session context. Header-only analysis works. — PARTIAL
+
+Binary: `cargo build --bin wzp-analyzer`
+Usage: `wzp-analyzer relay:4433 --room test [--capture out.wzp] [--html report.html] [--no-tui]`

docs/PRD-public-stun.md

@@ -0,0 +1,68 @@
+# PRD: Public STUN Client
+
+> Phase: Implemented
+> Status: Done (2026-04-14)
+> Crate: wzp-client
+
+## Problem
+
+WarzonePhone's reflexive address discovery depends entirely on relay-based `Reflect` messages over an authenticated QUIC signal channel. If the relay is unreachable, overloaded, or not yet connected, the client cannot discover its public IP:port for P2P hole-punching. This single point of failure means call setup is delayed or falls back to relay-only unnecessarily.
+
+Tailscale solves this by querying multiple public STUN servers in parallel, independent of its DERP relay infrastructure.
+
+## Solution
+
+Implement a minimal RFC 5389 STUN Binding client over raw UDP that queries public STUN servers (Google, Cloudflare) in parallel. This provides:
+
+1. **Independent reflexive discovery** — works without any relay connection
+2. **Redundancy** — STUN fallback when relay reflection fails
+3. **Better NAT classification** — more probes = higher confidence in Cone vs Symmetric detection
+4. **Faster call setup** — STUN can run before signal registration completes
+
+## Implementation
+
+### New Module: `crates/wzp-client/src/stun.rs`
+
+**Wire format** (RFC 5389):
+- 20-byte header: type (u16) + length (u16) + magic cookie (0x2112A442) + transaction ID (12 bytes)
+- Binding Request (0x0001): no attributes, just the header
+- Binding Response (0x0101): parses XOR-MAPPED-ADDRESS (0x0020, preferred) and MAPPED-ADDRESS (0x0001, fallback)
+- XOR decoding: port XOR'd with top 16 bits of magic cookie, IPv4 XOR'd with cookie, IPv6 XOR'd with cookie || txn ID
+
+**Public API**:
+- `stun_reflect(socket, server, timeout)` — single-server probe with one retry on first-packet timeout
+- `discover_reflexive(config)` — parallel probe of N servers, first success wins
+- `probe_stun_servers(config)` — all-server probe returning `Vec<NatProbeResult>` for NAT classification
+- `resolve_stun_server(host_port)` — DNS resolution preferring IPv4
+
+**Default servers**: `stun.l.google.com:19302`, `stun1.l.google.com:19302`, `stun.cloudflare.com:3478`
+
+**Error handling**: `StunError` enum — Io, Timeout, Malformed, TxnMismatch, ErrorResponse, NoMappedAddress, DnsError
+
+### Integration Points
+
+1. **`reflect.rs`**: New `detect_nat_type_with_stun()` runs relay probes and STUN probes concurrently via `tokio::join!`, merges results, re-classifies
+2. **Desktop `lib.rs`**: `try_reflect_own_addr()` falls back to `try_stun_fallback()` when relay reflection fails or times out
+3. **Desktop `detect_nat_type` command**: Uses `detect_nat_type_with_stun()` for combined relay + STUN classification
+
+### Design Decisions
+
+- **Separate UDP socket** per STUN probe — can't share the QUIC socket (quinn owns its I/O driver)
+- **No external crate** — RFC 5389 Binding is ~200 lines of code, no need for `stun-rs` or `webrtc-rs`
+- **Retry once** at half-timeout — handles the "first-packet problem" where some NATs drop the initial UDP packet to a new destination
+- **IPv4 preferred** for DNS resolution — Phase 7 IPv6 is still flaky
+
+## Files
+
+| File | Change |
+|------|--------|
+| `crates/wzp-client/src/stun.rs` | New — STUN client |
+| `crates/wzp-client/src/lib.rs` | Add `pub mod stun` |
+| `crates/wzp-client/src/reflect.rs` | Add `detect_nat_type_with_stun()` |
+| `crates/wzp-client/Cargo.toml` | Add `rand` dependency |
+| `desktop/src-tauri/src/lib.rs` | STUN fallback in `try_reflect_own_addr()`, STUN in `detect_nat_type` |
+
+## Testing
+
+- 22 unit tests: encode/decode roundtrips, XOR-MAPPED-ADDRESS (IPv4, IPv6, high port), MAPPED-ADDRESS fallback (IPv4, IPv6), unknown family, attribute padding, unknown attributes skipped, truncated attributes, error response, bad cookie, txn mismatch, too short, no mapped address, XOR preferred over mapped, error Display, default config, empty servers
+- 2 integration tests (`#[ignore]`): query `stun.l.google.com`, multi-server probe

docs/PRD-relay-concurrency.md

@@ -0,0 +1,314 @@
+# PRD: Relay Concurrency — DashMap Room Sharding
+
+## Problem
+
+The relay's media forwarding hot path routes every packet through a single `Arc<Mutex<RoomManager>>`. In a room with N participants, all N per-participant tasks compete for this one lock on every packet. The lock hold time is short (~1ms, no I/O), but the serialization means a 100-participant room effectively runs single-threaded despite having a multi-core tokio runtime.
+
+Separately, the federation manager holds `peer_links` locked across multiple network sends, meaning a slow federation peer blocks all others.
+
+### Measured bottleneck (from code audit)
+
+```
+Per-packet hot path (room.rs:748-757, 968-976):
+  lock(room_mgr)
+    → observe_quality()    O(N) iterate qualities HashMap
+    → others()             O(M) clone Vec<ParticipantSender>
+  unlock
+  → fan-out sends          sequential, no lock held
+```
+
+Lock contention = O(N) per room per packet, where N = participants in the room.
+
+### Current lock inventory (hot path only)
+
+| Lock | Location | Hold Duration | I/O While Locked | Frequency |
+|------|----------|---------------|-------------------|-----------|
+| `RoomManager` | room.rs:749, 968 | ~1ms | No | Every packet, every participant |
+| `RoomManager` | room.rs:845, 1041 | <1ms | No | Every 5s per participant |
+| `RoomManager` | room.rs:870 | ~1ms | No (explicit `drop` before broadcast) | On leave |
+| `peer_links` | federation.rs:409 | N × send latency | **YES** — `send_raw_datagram` in loop | Every federation packet |
+| `peer_links` | federation.rs:216 | N × send latency | **YES** — `send_signal` in loop | Every federation signal |
+| `dedup` | federation.rs:1066 | <1ms | No | Every federation ingress packet |
+| `rate_limiters` | federation.rs:1113 | <1ms | No | Every federation ingress packet |
+
+### Scaling impact
+
+| Room Size | Effective Core Usage | Bottleneck |
+|-----------|---------------------|------------|
+| 3 people × 100 rooms | All cores | None |
+| 10 people × 10 rooms | Most cores | Mild contention per room |
+| 100 people × 1 room | ~1 core | RoomManager lock |
+| 1000 people × 1 room | ~1 core | Severely serialized |
+
+## Goals
+
+- Eliminate the global RoomManager Mutex as a serialization point for media forwarding
+- Allow per-room parallelism: packets in room A don't block packets in room B
+- Fix federation `peer_links` lock held across network sends
+- Maintain correctness: no double-delivery, no stale participant lists
+- Zero-copy or minimal-clone for fan-out participant lists
+- Keep the refactor incremental — each phase independently shippable
+
+## Non-Goals
+
+- Lock-free data structures (overkill for our scale; DashMap or per-room Mutex is sufficient)
+- Changing the SFU forwarding model (no mixing, no transcoding)
+- Optimizing single-room beyond ~1000 participants (conferencing at that scale needs a different architecture)
+- Changing the wire protocol or client behavior
+
+## Design Options Evaluated
+
+### Option A: Per-Room `Arc<Mutex<Room>>`
+
+**Approach:** Replace `HashMap<String, Room>` inside RoomManager with `HashMap<String, Arc<Mutex<Room>>>`. The outer HashMap is protected by a short-lived lock for room lookup only; the per-room lock protects participant state.
+
+```rust
+struct RoomManager {
+    rooms: Mutex<HashMap<String, Arc<Mutex<Room>>>>,  // outer: room lookup
+    // ...
+}
+
+// Hot path becomes:
+let room_arc = {
+    let rooms = room_mgr.rooms.lock().await;
+    rooms.get(&room_name).cloned()  // Arc clone, <1ns
+};  // outer lock released
+
+if let Some(room) = room_arc {
+    let room = room.lock().await;  // per-room lock
+    let others = room.others(participant_id);
+    drop(room);
+    // fan-out sends...
+}
+```
+
+**Pros:**
+- Rooms are fully independent — room A's lock doesn't block room B
+- Minimal code change (~50 lines)
+- Per-room lock contention = O(participants in that room), not O(total participants)
+- Outer lock held for <1μs (just a HashMap get + Arc clone)
+
+**Cons:**
+- Two-level locking (room lookup + room lock) — slightly more complex
+- Room creation/deletion still serialized through outer lock (acceptable, rare operation)
+- Quality tracking needs to move into the Room struct
+
+**Verdict: Best option. Biggest win for least effort.**
+
+### Option B: `DashMap<String, Room>`
+
+**Approach:** Replace `Mutex<HashMap<String, Room>>` with `dashmap::DashMap<String, Room>`. DashMap uses internal sharding (default 64 shards) with per-shard RwLocks.
+
+```rust
+struct RoomManager {
+    rooms: DashMap<String, Room>,
+}
+
+// Hot path:
+if let Some(room) = room_mgr.rooms.get(&room_name) {
+    let others = room.others(participant_id);  // read lock on shard
+    drop(room);  // release shard lock
+    // fan-out sends...
+}
+```
+
+**Pros:**
+- No explicit locking in user code
+- Built-in sharding (64 shards by default)
+- Read-heavy workload benefits from RwLock per shard
+
+**Cons:**
+- New dependency (`dashmap` crate)
+- DashMap guards can't be held across `.await` points (not `Send`)
+- Mutable operations (join/leave/quality update) need `get_mut()` which takes exclusive shard lock
+- Less control over lock granularity than Option A
+- Quality tracking across rooms becomes awkward (can't iterate all rooms while holding one shard)
+
+**Verdict: Good but Option A is simpler and more explicit.**
+
+### Option C: Channel-Based Fan-Out
+
+**Approach:** Replace direct `send_media()` calls with per-participant `mpsc::Sender` channels. Room join registers a sender; the forwarding loop just does `tx.send(pkt)` which is lock-free.
+
+```rust
+struct Room {
+    participants: Vec<(ParticipantId, mpsc::Sender<MediaPacket>)>,
+}
+
+// Each participant's task:
+let (tx, mut rx) = mpsc::channel(64);
+room_mgr.join(room, participant_id, tx);
+
+// Forwarding in recv loop:
+let senders = room.others(participant_id);  // Vec<mpsc::Sender> clone
+for tx in &senders {
+    let _ = tx.try_send(pkt.clone());  // non-blocking, no lock
+}
+```
+
+**Pros:**
+- Fan-out is completely lock-free (channel send is atomic)
+- Backpressure per participant (full channel = drop packet, not block others)
+- Natural decoupling: recv task → channel → send task
+
+**Cons:**
+- Requires cloning MediaPacket per participant (currently we clone ParticipantSender Arc, much cheaper)
+- Additional memory: 64-packet channel buffer × N participants
+- Still need a lock to get the sender list (unless we snapshot on join/leave)
+- Adds latency: channel hop + wake adds ~1-5μs vs direct send
+
+**Verdict: Over-engineered for current scale. Consider for 1000+ participant rooms.**
+
+### Option D: Snapshot-on-Change (Optimistic Read)
+
+**Approach:** Maintain a read-optimized `Arc<Vec<ParticipantSender>>` snapshot per room. Updated atomically on join/leave (rare). Readers just `Arc::clone()` — no lock at all.
+
+```rust
+struct Room {
+    participants: Vec<Participant>,
+    /// Atomically-updated snapshot of all senders (rebuilt on join/leave).
+    sender_snapshot: Arc<ArcSwap<Vec<ParticipantSender>>>,
+}
+
+// Hot path (zero locking!):
+let senders = room.sender_snapshot.load();  // atomic load, ~1ns
+for sender in senders.iter() {
+    if sender.id != participant_id { ... }
+}
+```
+
+**Pros:**
+- Zero lock contention on hot path — just an atomic pointer load
+- Rebuild cost amortized over all packets between joins/leaves
+- `arc-swap` crate is battle-tested and tiny
+
+**Cons:**
+- New dependency (`arc-swap`)
+- Quality tracking still needs a mutable path (separate concern)
+- Snapshot doesn't include mutable room state (quality tiers)
+- More complex join/leave (must rebuild snapshot atomically)
+
+**Verdict: Best theoretical performance, but adds complexity. Consider if DashMap proves insufficient.**
+
+## Recommended Implementation: Option B (DashMap) + Federation Fix
+
+DashMap is the right tool here. The original objections don't hold up:
+
+- "Guards can't be held across `.await`" — we already drop locks before any async sends
+- "Less control" — DashMap's 64 internal shards give finer granularity than manual per-room locks
+- "New dependency" — one crate, battle-tested, widely used in the Rust ecosystem
+
+DashMap's advantages over manual per-room `Arc<Mutex<Room>>`:
+- **No two-level locking** — single `rooms.get()` vs outer-lock → Arc clone → drop → inner-lock
+- **Read/write separation** — `get()` is a shared shard lock, multiple rooms on the same shard can read concurrently
+- **Less code** — no manual Arc/Mutex wrapping, no explicit lock choreography
+- **Iteration without global lock** — federation room announcements don't block media forwarding
+
+### Phase 1: DashMap Room Storage (Biggest Win)
+
+1. Add `dashmap` dependency to `wzp-relay`
+2. Replace `rooms: HashMap<String, Room>` with `rooms: DashMap<String, Room>`
+3. Move `qualities` and `room_tiers` into the `Room` struct (per-room state, not global)
+4. RoomManager no longer needs a wrapping Mutex — it becomes `Arc<RoomManager>` directly
+5. Per-packet hot path: `rooms.get(&name)` takes a shared shard lock, releases on drop
+
+```rust
+pub struct RoomManager {
+    rooms: DashMap<String, Room>,
+    acl: Option<HashMap<String, HashSet<String>>>,  // read-only after init
+    event_tx: broadcast::Sender<RoomEvent>,
+}
+
+struct Room {
+    participants: Vec<Participant>,
+    qualities: HashMap<ParticipantId, ParticipantQuality>,
+    current_tier: Tier,
+}
+
+// Hot path becomes:
+let (others, directive) = if let Some(mut room) = room_mgr.rooms.get_mut(&room_name) {
+    let directive = if let Some(ref qr) = pkt.quality_report {
+        room.observe_quality(participant_id, qr)
+    } else {
+        None
+    };
+    let o = room.others(participant_id);
+    (o, directive)
+} else {
+    (vec![], None)
+};
+// Shard lock released here — fan-out sends are lock-free
+```
+
+**Files to modify:**
+- `crates/wzp-relay/Cargo.toml` — add `dashmap` dependency
+- `crates/wzp-relay/src/room.rs` — RoomManager struct, Room struct, all methods
+- `crates/wzp-relay/src/lib.rs` — change from `Arc<Mutex<RoomManager>>` to `Arc<RoomManager>`
+- `crates/wzp-relay/src/main.rs` — update RoomManager construction and all `.lock().await` call sites
+- `crates/wzp-relay/src/federation.rs` — update room_mgr usage (no more `.lock().await`)
+
+**Key behavior change:** `Arc<Mutex<RoomManager>>` → `Arc<RoomManager>`. Every call site that does `room_mgr.lock().await.some_method()` becomes `room_mgr.some_method()` directly. The DashMap handles internal locking.
+
+**Concurrency improvement:**
+- Before: 100 rooms × 10 people = all 1000 tasks compete for 1 Mutex
+- After: 100 rooms × 10 people = distributed across 64 shards, ~15 tasks per shard average
+- Within a room: participants still serialize through the shard lock, but hold time is <0.1ms for `get()` and `others()` (just Vec clone of Arcs)
+
+### Phase 2: Federation Lock Fix
+
+Clone the peer list, release lock, then send:
+
+```rust
+pub async fn forward_to_peers(&self, room_hash: &[u8; 8], media_data: &Bytes) {
+    let peers: Vec<_> = {
+        let links = self.peer_links.lock().await;
+        links.values().map(|l| (l.label.clone(), l.transport.clone())).collect()
+    };  // lock released immediately
+    
+    for (label, transport) in &peers {
+        // send without holding lock — slow peer doesn't block others
+    }
+}
+```
+
+Also apply to `broadcast_signal()` and `send_signal_to_peer()`.
+
+**Files to modify:**
+- `crates/wzp-relay/src/federation.rs` — 3 methods
+
+**Concurrency improvement:** A slow federation peer no longer blocks all other peers' media delivery.
+
+### Phase 3: Quality Tracking Optimization (Optional)
+
+With DashMap, quality tracking uses `get_mut()` (exclusive shard lock) on every packet that carries a QualityReport. For rooms where quality reports are frequent, this creates write contention on the shard.
+
+Option: Move quality observation to a background task:
+1. Per-participant `AtomicU8` for latest loss/RTT (lock-free write from hot path)
+2. Background task every 1s reads atomics, computes tiers, broadcasts directives
+3. Hot path becomes read-only: `rooms.get()` (shared lock) → `others()` → done
+
+**Reduces shard lock from exclusive (`get_mut`) to shared (`get`) on every packet.**
+
+## Verification
+
+1. **Correctness:** `cargo test -p wzp-relay` — all existing tests must pass
+2. **Compile check:** `cargo check --workspace` — no regressions
+3. **Load test:** 10 rooms × 10 participants, verify rooms forward concurrently
+4. **Large room:** 1 room × 50 participants, no deadlocks
+5. **Federation:** 3 relays, media bridges correctly with new lock pattern
+6. **Benchmark:** Before/after packets-per-second on multi-core with `wzp-bench`
+
+## Effort
+
+- Phase 1: 1 day (DashMap migration + test updates)
+- Phase 2: 0.5 day (federation clone-and-release)
+- Phase 3: 0.5 day (optional, quality tracking with atomics)
+- Total: 1.5–2 days
+
+## Implementation Status (2026-04-13)
+
+Phase 1 (DashMap): DONE — global Mutex → DashMap<String, Room> with 64 shards
+Phase 2 (Federation clone-before-send): DONE — forward_to_peers, broadcast_signal, send_signal_to_peer
+Phase 3 (Quality atomics): NOT DONE — optional optimization
+
+See also: docs/REFACTOR-relay-concurrency.md for the full post-refactor analysis.

docs/PRD-relay-selection.md

@@ -0,0 +1,88 @@
+# PRD: Region-Based Relay Selection
+
+> Phase: Implemented (data model)
+> Status: Done (2026-04-14)
+> Crate: wzp-client, wzp-proto, wzp-relay
+
+## Problem
+
+Clients are configured with a single relay address. With multiple relays in the federation mesh, the client should automatically discover all available relays and select the lowest-latency one. Currently there is no mechanism for the relay to advertise its mesh peers to clients, and no client-side data structure to track relay health over time.
+
+## Solution
+
+1. Relays advertise their region and mesh peers in `RegisterPresenceAck`
+2. Clients maintain a `RelayMap` sorted by measured RTT
+3. `preferred()` returns the best relay for call setup
+
+## Implementation
+
+### New Module: `crates/wzp-client/src/relay_map.rs`
+
+**RelayEntry**:
+```rust
+pub struct RelayEntry {
+    pub name: String,
+    pub addr: SocketAddr,
+    pub region: Option<String>,
+    pub rtt_ms: Option<u32>,
+    pub last_probed: Option<Instant>,
+    pub reachable: bool,
+}
+```
+
+**RelayMap API**:
+- `upsert(name, addr, region)` — add or update a relay entry
+- `update_rtt(addr, rtt_ms)` — record probe result, marks reachable, re-sorts
+- `mark_unreachable(addr)` — sorts unreachable entries to end
+- `preferred()` -> `Option<&RelayEntry>` — lowest RTT reachable relay
+- `populate_from_ack(relays, region)` — parse `RegisterPresenceAck.available_relays` (format: `"name|addr"`)
+- `needs_reprobe(max_age)` — true if any entry has stale or missing probe
+- `stale_entries(max_age)` — list of entries needing fresh probes
+
+### Signal Protocol Extension
+
+`RegisterPresenceAck` extended:
+```rust
+RegisterPresenceAck {
+    success: bool,
+    error: Option<String>,
+    relay_build: Option<String>,
+    relay_region: Option<String>,           // NEW
+    available_relays: Vec<String>,          // NEW — "name|addr" format
+}
+```
+
+### Relay Config Extension
+
+`RelayConfig` extended:
+```rust
+pub region: Option<String>,          // e.g., "us-east", "eu-west"
+pub advertised_addr: Option<SocketAddr>,  // for available_relays population
+```
+
+### Relay Population
+
+On `RegisterPresenceAck`, the relay populates:
+- `relay_region` from `config.region`
+- `available_relays` from `config.peers` (label|url format)
+
+### Deferred
+
+- **Automatic relay switching** — using `preferred()` to select relay during call setup instead of hardcoded config
+- **Background reprobing** — periodic RTT measurements to keep the relay map fresh
+- **Cross-relay RTT estimation** — using mesh probe data to estimate combined caller-RTT + callee-RTT for optimal relay placement
+
+## Files
+
+| File | Change |
+|------|--------|
+| `crates/wzp-client/src/relay_map.rs` | New — RelayMap + RelayEntry |
+| `crates/wzp-client/src/lib.rs` | Add `pub mod relay_map` |
+| `crates/wzp-proto/src/packet.rs` | `relay_region` + `available_relays` on RegisterPresenceAck |
+| `crates/wzp-relay/src/config.rs` | `region` + `advertised_addr` fields |
+| `crates/wzp-relay/src/main.rs` | Populate RegisterPresenceAck from config + peers |
+
+## Testing
+
+- 15 unit tests: preferred by RTT, unreachable not preferred, preferred empty/all-unreachable, populate_from_ack (valid + malformed entries), upsert updates/preserves region, needs_reprobe (empty/never/fresh), stale_entries, sort stability with equal RTT, mark_unreachable sorts to end, RelayEntry serialization
+- 2 protocol tests: RegisterPresenceAck roundtrip with new fields, backward compat without new fields

docs/PROGRESS.md

@@ -120,7 +120,7 @@
 
 - **Web audio drift**: The browser AudioWorklet playback buffer caps at 200ms, but clock drift between the WebSocket message arrival rate and the AudioContext output rate can cause occasional underruns or accumulation. The cap prevents unbounded growth but may cause glitches.
 
-- **No adaptive loop integration**: The `PathMonitor` feeds and `AdaptiveQualityController` are implemented but not wired together in the client's main loop. Quality reports are consumed when present in packets, but the client does not currently generate periodic quality reports from transport metrics.
+- **Adaptive loop integration (resolved)**: AdaptiveQualityController wired into both desktop and Android send/recv tasks. Relay-coordinated codec switching broadcasts QualityDirective — now handled by both engines (fixed 2026-04-13). 5-tier classification (Studio64k through Catastrophic) with asymmetric hysteresis.
 
 - **Relay FEC pass-through**: In room mode, the relay forwards packets opaquely without FEC decode/re-encode. This means FEC protection is end-to-end only, not per-hop. In forward mode, the relay pipeline does perform FEC decode/re-encode.
 
@@ -128,18 +128,18 @@
 
 ## Test Coverage
 
-119 tests across 7 crates (wzp-web has no Rust tests):
+372+ tests across 7 crates (wzp-web has no Rust tests):
 
-| Crate | Test Files | Test Count |
-|-------|-----------|------------|
-| wzp-proto | 5 | 27 |
-| wzp-codec | 3 | 24 |
-| wzp-fec | 5 | 21 |
-| wzp-crypto | 5 | 21 |
-| wzp-transport | 3 | 12 |
-| wzp-relay | 4 | 10 |
-| wzp-client | 3 | 8 |
-| **Total** | **28** | **119** |
+| Crate | Test Count |
+|-------|------------|
+| wzp-proto | ~84 |
+| wzp-codec | ~69 |
+| wzp-fec | ~21 |
+| wzp-crypto | ~21 |
+| wzp-transport | ~11 |
+| wzp-relay | ~120 |
+| wzp-client | ~57 |
+| **Total** | **372+** |
 
 Tests cover:
 - Wire format roundtrip (header, quality report, full packet)
@@ -191,3 +191,201 @@ Run with `wzp-bench --all`. Representative results (Apple M-series, single core)
 - **Hetzner VPS**: Build script (`scripts/build-linux.sh`) tested for provisioning, building, and downloading Linux binaries
 - **CI**: Gitea workflow defined for amd64/arm64/armv7 builds
 - **Production**: Not yet deployed to production networks
+
+## Recent Changes (2026-04-13)
+
+### P2P Adaptive Quality (#23, 2026-04-13)
+- QualityReport::from_path_stats() — construct reports from local quinn stats
+- CallEncoder.pending_quality_report — one-shot attachment to source packets
+- Send tasks generate quality reports every 50 frames (~1s) from path stats
+- Recv tasks self-observe from own QUIC stats for P2P adaptation
+- Both relay and P2P calls now have full adaptive quality
+
+### Protocol Analyzer (#13-17, 2026-04-13)
+- New binary: wzp-analyzer (crates/wzp-client/src/analyzer.rs, ~900 lines)
+- Passive observer: joins room, receives all media, never sends
+- TUI mode (ratatui): per-participant table with loss%, jitter, codec, color-coded
+- No-TUI mode: stats printed to stderr every 2s
+- Binary capture format (.wzp) with microsecond timestamps
+- Replay mode: offline analysis from capture files
+- HTML report: self-contained with Chart.js loss/jitter timelines
+- Encrypted decode: stub (needs session key + nonce context for SFU E2E)
+
+### Codebase Refactoring (2026-04-13)
+- DashMap relay concurrency: global Mutex → 64-shard DashMap
+- Federation clone-before-send: eliminated last lock-during-I/O
+- Engine deduplication: 3 shared helpers, eliminated 250 lines duplication
+- 29 federation tests (was 0)
+- Clap CLI parser for relay (replaced 154-line manual parser)
+- Magic number constants, error handling helpers, safety docs
+
+### 5-Tier Adaptive Quality Classification (#9)
+- `Tier` enum extended from 3 to 6 levels: Studio64k > Studio48k > Studio32k > Good > Degraded > Catastrophic
+- WiFi thresholds: loss < 1%/RTT < 30ms (Studio64k) through loss >= 15%/RTT >= 200ms (Catastrophic)
+- Cellular stays at Good ceiling (no studio tiers on mobile data)
+- Asymmetric hysteresis: downgrade 3 reports, upgrade 5, studio upgrade 10
+- `Tier` derives `Ord` — ordering matches quality level (Catastrophic=0, Studio64k=5)
+- `weakest_tier()` simplified to `.min()` via Ord
+
+### Client QualityDirective Handling (#27)
+- Both desktop signal tasks (P2P and relay engines) now match `QualityDirective` signals
+- Android signal task matches `QualityDirective` and stores profile index via `pending_profile_recv`
+- Relay-coordinated codec switching now works end-to-end: relay broadcasts → clients react
+- Closes the gap documented in PRD-coordinated-codec.md
+
+### Debug Tap Enhancements (#11, #12)
+- `log_signal()`: logs `RoomUpdate` (count + participant names), `QualityDirective` (codec + reason)
+- `log_event()`: logs participant join/leave lifecycle events
+- `log_stats()`: periodic 5-second summary — packets in/out, fan-out avg, seq gaps, codecs seen
+- `TapStats` struct tracks per-participant metrics across the forwarding loop
+- All output via `target: "debug_tap"` for RUST_LOG filtering
+
+### Bug Fix: dual_path.rs Phase 7 regression
+- Added missing `ipv6_endpoint: None` parameter to 3 `race()` call sites in integration tests
+- Phase 7 IPv6 dual-socket changed the function signature but tests were not updated
+
+### Build: Keystore sync (f17420a)
+- `build.sh` syncs keystores from persistent cache before build
+
+## Previous Changes (2026-04-12)
+
+### Bluetooth Audio Routing
+- 3-way route cycling: Earpiece → Speaker → Bluetooth SCO
+- `setCommunicationDevice()` API 31+ with `startBluetoothSco()` fallback
+- BT-mode Oboe: capture skips 48kHz + VoiceCommunication, Oboe resamples 8/16kHz ↔ 48kHz
+- `MODE_IN_COMMUNICATION` deferred to call start (was at app launch — hijacked system audio)
+
+### Network Change Detection
+- `NetworkMonitor.kt` wraps `ConnectivityManager.NetworkCallback`
+- WiFi/cellular classification via bandwidth heuristics (no READ_PHONE_STATE needed)
+- Feeds `AdaptiveQualityController::signal_network_change()` via JNI → AtomicU8 → recv task
+
+### Hangup Signal Fix
+- `SignalMessage::Hangup` now carries optional `call_id`
+- Relay only ends the named call (not all calls for the user)
+- Fixes race: hangup for call 1 no longer kills newly-placed call 2
+
+### Per-Architecture APK Builds
+- `build-tauri-android.sh --arch arm64|armv7|all`
+- Separate per-arch APKs (~25MB each vs ~50MB universal)
+- Release APKs signed with `wzp-release.jks` via `apksigner`
+
+### Continuous DRED Tuning (Phase A: opus-DRED-v2)
+- `DredTuner` in `wzp-proto::dred_tuner` maps live network metrics to continuous DRED duration
+- Polls quinn path stats every 25 frames (~500ms): loss%, RTT, jitter
+- Linear interpolation between baseline and ceiling per codec tier (not discrete tier jumps)
+- Jitter-spike detection: >30% EWMA spike pre-emptively boosts DRED to ceiling for ~5s
+- RTT phantom loss: high RTT (>200ms) adds phantom contribution to keep DRED generous
+- `set_expected_loss()` and `set_dred_duration()` added to `AudioEncoder` trait
+- Integrated into both Android and desktop send tasks in engine.rs
+
+### Extended DRED Window
+- Opus6k DRED duration increased from 500ms to 1040ms (max libopus 1.5 supports)
+- RDO-VAE naturally degrades quality at longer offsets — extra window costs ~1-2 kbps
+
+### PMTUD (Path MTU Discovery)
+- Quinn's PLPMTUD explicitly configured: initial 1200, upper bound 1452, 300s interval
+- `QuinnPathSnapshot` exposes discovered MTU via `current_mtu` field
+- `TrunkedForwarder` refreshes `max_bytes` from PMTUD (was hard-coded 1200)
+- Federation trunk frames now fill the discovered path MTU automatically
+
+### New Tests
+- 4 DRED tuner integration tests in wzp-client (encoder adjustment, spike boost, Codec2 no-op, profile switch)
+- 10 unit tests in wzp-proto for DredTuner mapping logic
+- Jitter variance window tests in wzp-transport PathMonitor
+- Pre-existing test fixes: added missing `build_version` fields to 7 SignalMessage constructors
+
+### Desktop Adaptive Quality (#7, #31)
+- `AdaptiveQualityController` wired into both Android and desktop send/recv tasks
+- `pending_profile: Arc<AtomicU8>` bridge between recv (writer) and send (reader)
+- Auto mode: ingests QualityReports from relay, switches encoder profile when adapter recommends
+- `tx_codec` display string updated on profile switch for UI indicator
+- `profile_to_index()` / `index_to_profile()` mapping for 6-tier range
+
+### Relay Coordinated Codec Switching (#25, #26)
+- `ParticipantQuality` struct in relay RoomManager tracks per-participant quality
+- Quality reports from forwarded packets feed per-participant `AdaptiveQualityController`
+- `weakest_tier()` computes room-wide worst tier across all participants
+- `QualityDirective` SignalMessage variant: relay broadcasts recommended profile to all participants
+- Triggered on tier change — instant, no negotiation (weakest-link policy)
+
+### Oboe Stream State Polling (#35)
+- C++ polling loop after `requestStart()`: checks `getState()` every 10ms for up to 2s
+- Waits for both capture and playout streams to reach `Started` state
+- Logs initial state, poll count, and final state for HAL debugging
+- Does NOT fail on timeout — Rust-side stall detector remains as safety net
+- Targets Nothing Phone A059 intermittent silent calls on cold start
+
+### Opus6k Frame Starvation Fix (2026-04-13)
+- Root cause: partial reads from capture ring consumed samples that were discarded on retry
+- `audio_read_capture(&mut buf[..1920])` with only 960 available → read 960, loop retried from buf[0], overwriting
+- Added `wzp_native_audio_capture_available()` — check before reading (matches desktop pattern)
+- `frame_samples` made mutable and updated on adaptive profile switch
+- `buf` sized to max frame (1920) with `[..frame_samples]` slices throughout
+- Result: Opus6k frame rate restored from ~11/s to expected 25/s
+
+### Build Script Fixes (2026-04-13)
+- Stale APK cleanup: delete all APKs before build, prefer `*release*.apk` on upload
+- APK signing: added zipalign + apksigner pipeline to `build.sh` (was in `build-tauri-android.sh` only)
+- Keystore persistence: `$BASE_DIR/data/keystore/` cache synced into source tree before build
+- Fixes: 384MB debug APK uploaded instead of 25MB release; unsigned APK on alt server
+
+### Phase 8: Tailscale-Inspired STUN/ICE Enhancements (2026-04-14)
+
+5 new modules in `wzp-client`, 83 new unit tests (588 total across workspace).
+
+#### Public STUN Client (`stun.rs`)
+- Minimal RFC 5389 STUN Binding Request/Response over raw UDP
+- XOR-MAPPED-ADDRESS (preferred) + MAPPED-ADDRESS (fallback) parsing
+- Default servers: `stun.l.google.com:19302`, `stun1.l.google.com:19302`, `stun.cloudflare.com:3478`
+- `discover_reflexive()` — first-success parallel probe across N servers
+- `probe_stun_servers()` — full results for NAT classification
+- Integrated into `detect_nat_type_with_stun()` combining relay + STUN probes
+- Desktop STUN fallback in `try_reflect_own_addr()` when relay reflection fails
+
+#### PCP/PMP/UPnP Port Mapping (`portmap.rs`)
+- **NAT-PMP** (RFC 6886): UDP to gateway:5351, external address + port mapping
+- **PCP** (RFC 6887): PCP MAP opcode, IPv4-mapped IPv6 client address
+- **UPnP IGD**: SSDP M-SEARCH discovery + SOAP `AddPortMapping`/`GetExternalIPAddress`
+- Gateway discovery: macOS (`route -n get default`), Linux (`/proc/net/route`)
+- `acquire_port_mapping()` tries NAT-PMP → PCP → UPnP, first success wins
+- `release_port_mapping()` + `spawn_refresh()` for lifecycle management
+- Signal protocol: `caller_mapped_addr`/`callee_mapped_addr` on offer/answer, `peer_mapped_addr` on CallSetup
+- `PeerCandidates.mapped` — new candidate type in dial order (host → mapped → reflexive)
+
+#### Mid-Call ICE Re-Gathering (`ice_agent.rs`)
+- `IceAgent`: owns candidate lifecycle with `gather()`, `re_gather()`, `apply_peer_update()`
+- Monotonic generation counter prevents stale candidate updates from reordering
+- `SignalMessage::CandidateUpdate` — new signal for mid-call candidate exchange
+- Relay forwards `CandidateUpdate` to call peer (same pattern as `MediaPathReport`)
+- Desktop handles `CandidateUpdate` in signal recv loop, emits to JS frontend
+- Transport hot-swap architecture designed (TODO: wire into live call engine)
+
+#### Netcheck Diagnostic (`netcheck.rs`)
+- `NetcheckReport`: NAT type, reflexive addr, IPv4/v6, port mapping, relay latencies, gateway
+- `run_netcheck()` — parallel probes for STUN + relay + portmap + IPv6
+- `format_report()` — human-readable diagnostic output
+- CLI: `wzp-client --netcheck <relay>` runs diagnostic
+
+#### Region-Based Relay Selection (`relay_map.rs`)
+- `RelayMap` sorted by RTT, `preferred()` returns lowest-latency reachable relay
+- `populate_from_ack()` — parses `RegisterPresenceAck.available_relays`
+- Stale detection (`needs_reprobe()`, `stale_entries()`)
+- `RegisterPresenceAck` extended with `relay_region` and `available_relays`
+
+#### Hard NAT Port Allocation Detection (`stun.rs` Phase A)
+- `PortAllocation` enum: `PortPreserving` / `Sequential { delta }` / `Random` / `Unknown`
+- `detect_port_allocation()` — sequential STUN probes from single socket, analyzes external port sequence
+- `classify_port_allocation()` — pure classifier with wraparound handling, jitter tolerance (±1), 60% threshold for noisy sequences
+- `predict_ports(last_port, delta, offset, spread)` — generates target port range for sequential NATs
+- `HardNatProbe` signal message for peer coordination (carries port_sequence, allocation, external_ip)
+- Relay forwards `HardNatProbe` to call peer
+- `NetcheckReport.port_allocation` field populated automatically
+- 17 new tests for classification, prediction, serde, Display
+
+#### Relay End-to-End Wiring (2026-04-14)
+- `CallRegistry` stores + cross-wires `caller_mapped_addr`/`callee_mapped_addr` into `CallSetup.peer_mapped_addr`
+- `RelayConfig` extended with `region` + `advertised_addr` fields
+- `RegisterPresenceAck` populates `relay_region` from config, `available_relays` from federation peers
+- Desktop `place_call`/`answer_call` call `acquire_port_mapping()` and fill mapped addr fields
+- Legacy `build-android-docker.sh` renamed to `build-android-docker-LEGACY.sh` to prevent accidental use

docs/REFACTOR-codebase-audit.md

@@ -0,0 +1,271 @@
+# Codebase Refactoring Audit (2026-04-13)
+
+> Full analysis of the WarzonePhone codebase after the DashMap relay refactor, DRED continuous tuning, and adaptive quality wiring. The codebase is ~15K lines of Rust across 8 crates plus a 1.7K-line Tauri engine. This document identifies every refactoring opportunity ranked by impact.
+
+## Critical: engine.rs is 1,705 Lines With ~35% Duplication
+
+`desktop/src-tauri/src/engine.rs` has two nearly-identical `CallEngine::start()` implementations:
+- **Android path:** 880 lines (lines 321–1200)
+- **Desktop path:** 430 lines (lines 1203–1633)
+
+### What's Duplicated (350+ lines)
+
+| Block | Android Lines | Desktop Lines | Size | Identical? |
+|-------|--------------|---------------|------|-----------|
+| CallConfig initialization | 529–539 | 1353–1363 | 23 lines | Yes |
+| DRED tuner + frame_samples setup | 541–555 | 1360–1375 | 15 lines | Yes |
+| Adaptive quality profile switch | 651–665 | 1414–1428 | 15 lines | Yes |
+| Codec-to-QualityProfile match | 852–864 | 1488–1500 | 19 lines | Yes |
+| DRED ingest + gap fill | 886–902 | 1511–1528 | 17 lines | Yes |
+| Quality report ingestion | 905–912 | 1531–1538 | 8 lines | Yes |
+| Signal task (entire thing) | 1133–1180 | 1569–1616 | 48 lines | Yes |
+
+### Suggested Fix: Extract Shared Helpers
+
+```rust
+// Top of engine.rs — shared between both platforms
+
+fn build_call_config(quality: &str) -> CallConfig { ... }
+
+fn codec_to_profile(codec: CodecId) -> QualityProfile { ... }
+
+fn check_adaptive_switch(
+    pending: &AtomicU8,
+    encoder: &mut CallEncoder,
+    tuner: &mut DredTuner,
+    frame_samples: &mut usize,
+    tx_codec: &Mutex<String>,
+) { ... }
+
+async fn run_signal_task(
+    transport: Arc<QuinnTransport>,
+    running: Arc<AtomicBool>,
+    pending_profile: Arc<AtomicU8>,
+    participants: Arc<Mutex<Vec<ParticipantInfo>>>,
+) { ... }
+```
+
+This would reduce engine.rs by ~200 lines and make the Android/desktop paths only differ in their audio I/O (Oboe vs CPAL).
+
+**Effort:** 2-3 hours. **Impact:** High — every future change to the send/recv pipeline currently requires editing two places.
+
+---
+
+## High: SignalMessage Enum Has 36 Variants
+
+`crates/wzp-proto/src/packet.rs` (1,727 lines) has a `SignalMessage` enum with 36 variants mixing orthogonal concerns:
+
+- Legacy call signaling (CallOffer, CallAnswer, IceCandidate, Rekey...)
+- Direct calling (RegisterPresence, DirectCallOffer, DirectCallAnswer, CallSetup...)
+- Federation (FederationHello, GlobalRoomActive/Inactive, FederatedSignalForward)
+- Relay control (SessionForward, PresenceUpdate, RouteQuery, RoomUpdate)
+- NAT traversal (Reflect, ReflectResponse, MediaPathReport)
+- Quality (QualityUpdate, QualityDirective)
+- Call control (Ping/Pong, Hold/Unhold, Mute/Unmute, Transfer)
+
+Every new feature adds variants here, and every match on `SignalMessage` must handle all 36 arms (or use `_` wildcard).
+
+### Suggested Fix: Sub-Enum Grouping
+
+```rust
+enum SignalMessage {
+    Call(CallSignal),           // CallOffer, CallAnswer, IceCandidate, Rekey, Hangup...
+    Direct(DirectCallSignal),   // RegisterPresence, DirectCallOffer, CallSetup, MediaPathReport...
+    Federation(FedSignal),      // FederationHello, GlobalRoomActive, FederatedSignalForward...
+    Control(ControlSignal),     // Ping/Pong, Hold/Unhold, Mute/Unmute, QualityDirective...
+    Relay(RelaySignal),         // SessionForward, PresenceUpdate, RouteQuery, RoomUpdate...
+}
+```
+
+**Caution:** This is a wire-format change. Serde serialization must remain backward-compatible with already-deployed relays. Use `#[serde(untagged)]` or versioned deserialization. Consider doing this as a v2 protocol bump.
+
+**Effort:** 1 day. **Impact:** High for maintainability, but risky for wire compatibility.
+
+---
+
+## High: Federation Has Zero Tests
+
+`crates/wzp-relay/src/federation.rs` (1,132 lines) has **no unit tests and no integration tests**. This is the most complex file in the relay crate, handling:
+
+- Peer link management (connect, reconnect, stale sweep)
+- Federation media egress (forward_to_peers)
+- Federation media ingress (handle_datagram: dedup, rate limit, local delivery, multi-hop)
+- Cross-relay signal forwarding
+- Room event subscription and GlobalRoomActive/Inactive broadcasting
+
+The relay crate has 91 tests, but none cover federation. Any refactoring of federation (like the DashMap migration or clone-before-send) is flying blind.
+
+### Suggested Fix
+
+Priority test cases:
+1. `forward_to_peers` with 0, 1, 3 peers — verify datagram construction and label tracking
+2. `handle_datagram` — dedup (same packet twice → second dropped), rate limit (exceed → dropped)
+3. Stale presence sweeper — verify cleanup after timeout
+4. `broadcast_signal` — verify signal reaches all peers
+5. Multi-hop forward — verify source peer excluded from re-forward
+
+**Effort:** 1 day. **Impact:** Critical for safe refactoring.
+
+---
+
+## Medium: Federation `peer_links` Lock-During-Send
+
+`broadcast_signal()` (line 216) holds `peer_links` Mutex **across async `send_signal()` calls**. A slow peer blocks all signal delivery. `forward_to_peers()` (line 406) holds it during sync sends (less severe but still serializes).
+
+### Fix (30 minutes)
+
+```rust
+// Before:
+let links = self.peer_links.lock().await;
+for (fp, link) in links.iter() {
+    link.transport.send_signal(msg).await;  // lock held across await!
+}
+
+// After:
+let peers: Vec<_> = {
+    let links = self.peer_links.lock().await;
+    links.values().map(|l| (l.label.clone(), l.transport.clone())).collect()
+};
+for (label, transport) in &peers {
+    transport.send_signal(msg).await;  // no lock held
+}
+```
+
+Apply to `forward_to_peers()`, `broadcast_signal()`, and `send_signal_to_peer()`.
+
+**Effort:** 30 minutes. **Impact:** Medium — eliminates last lock-during-I/O pattern.
+
+---
+
+## Medium: Magic Numbers Scattered Through engine.rs
+
+```rust
+// These appear as literals in multiple places:
+tokio::time::sleep(Duration::from_millis(5))    // 6 occurrences
+tokio::time::sleep(Duration::from_millis(100))   // 2 occurrences
+Duration::from_millis(200)                        // 2 occurrences (signal timeout)
+Duration::from_secs(10)                           // 1 occurrence (QUIC connect timeout)
+Duration::from_secs(2)                            // 2 occurrences (heartbeat interval)
+const DRED_POLL_INTERVAL: u32 = 25;              // defined twice (Android + desktop)
+vec![0i16; 1920]                                  // 2 occurrences (should use FRAME_SAMPLES_40MS)
+```
+
+### Fix
+
+```rust
+// Top of engine.rs
+const CAPTURE_POLL_MS: u64 = 5;
+const RECV_TIMEOUT_MS: u64 = 100;
+const SIGNAL_TIMEOUT_MS: u64 = 200;
+const CONNECT_TIMEOUT_SECS: u64 = 10;
+const HEARTBEAT_INTERVAL_SECS: u64 = 2;
+const DRED_POLL_INTERVAL: u32 = 25;
+// Already exists: const FRAME_SAMPLES_40MS: usize = 1920;
+```
+
+**Effort:** 15 minutes. **Impact:** Low but prevents bugs from inconsistent values.
+
+---
+
+## Medium: CLI Arg Parsing in Relay main.rs
+
+`parse_args()` in main.rs is 154 lines of manual `while i < args.len()` parsing with `match args[i].as_str()`. Every new flag adds 5-10 lines of boilerplate.
+
+### Suggested Fix
+
+Replace with `clap` derive macro:
+
+```rust
+#[derive(clap::Parser)]
+struct RelayArgs {
+    #[arg(long, default_value = "0.0.0.0:4433")]
+    listen: SocketAddr,
+    #[arg(long)]
+    remote: Option<String>,
+    #[arg(long)]
+    auth_url: Option<String>,
+    // ...
+}
+```
+
+**Effort:** 1 hour. **Impact:** Medium — cleaner, auto-generates `--help`, validates types at parse time.
+
+---
+
+## Medium: Error Handling Inconsistency
+
+13 instances of `.ok()` silently swallowing errors on `transport.close()` across the relay. Federation signal forwarding has inconsistent error handling — some paths log, some don't.
+
+### Fix
+
+```rust
+// Helper at top of main.rs/federation.rs:
+async fn close_transport(t: &impl MediaTransport, context: &str) {
+    if let Err(e) = t.close().await {
+        tracing::debug!(context, error = %e, "transport close error (non-fatal)");
+    }
+}
+```
+
+**Effort:** 30 minutes. **Impact:** Better observability when debugging connection issues.
+
+---
+
+## Low: Unused Crypto Fields
+
+`crates/wzp-crypto/src/handshake.rs` has `x25519_static_secret` and `x25519_static_public` fields marked `#[allow(dead_code)]`. These are derived from the identity seed but never used in any handshake flow.
+
+**Decision needed:** Are these intended for a future feature (static key federation auth)? If not, remove. If yes, document the intended use.
+
+**Effort:** 5 minutes to remove, or 10 minutes to document.
+
+---
+
+## Low: 20 Unsafe Functions Missing Safety Docs
+
+`crates/wzp-native/src/lib.rs` has 20 `unsafe` functions (extern "C" FFI bridge to Oboe) without `/// # Safety` documentation. Clippy flags all of them.
+
+**Effort:** 30 minutes. **Impact:** Clippy clean, better documentation for contributors.
+
+---
+
+## Low: quality.rs vs dred_tuner.rs Overlap
+
+Both files deal with network quality → codec decisions, but they're complementary:
+- `quality.rs`: discrete tier classification (Good/Degraded/Catastrophic) → codec profile
+- `dred_tuner.rs`: continuous DRED frame mapping from loss/RTT/jitter
+
+No consolidation needed, but add cross-references:
+
+```rust
+// In dred_tuner.rs:
+//! See also: `quality.rs` for discrete tier classification that drives
+//! codec switching. DredTuner operates within a tier, adjusting DRED
+//! parameters continuously.
+
+// In quality.rs:
+//! See also: `dred_tuner.rs` for continuous DRED tuning within a tier.
+```
+
+**Effort:** 5 minutes.
+
+---
+
+## Summary: Priority Matrix
+
+| # | Refactor | Effort | Impact | Risk |
+|---|----------|--------|--------|------|
+| 1 | Extract shared engine.rs helpers | 2-3h | High | Low |
+| 2 | Federation tests | 1 day | Critical | None |
+| 3 | Federation clone-before-send | 30 min | Medium | Low |
+| 4 | Extract magic numbers to constants | 15 min | Low | None |
+| 5 | Error handling helpers | 30 min | Medium | None |
+| 6 | CLI parser → clap | 1h | Medium | Low |
+| 7 | SignalMessage sub-enums | 1 day | High | High (wire compat) |
+| 8 | Safety docs on unsafe fns | 30 min | Low | None |
+| 9 | Remove/document dead crypto fields | 5 min | Low | None |
+| 10 | Cross-reference quality.rs ↔ dred_tuner.rs | 5 min | Low | None |
+
+**Recommended order:** 4 → 3 → 5 → 1 → 2 → 6 → 8 → 9 → 10 → 7
+
+Items 4, 3, 5 are quick wins (under 1 hour total). Item 1 is the biggest maintainability win. Item 2 is the most important for safety. Item 7 should wait for a protocol version bump.

docs/REFACTOR-relay-concurrency.md

@@ -0,0 +1,256 @@
+# Relay Concurrency Refactor Guide
+
+> Post-DashMap analysis: what was done, what remains, and what to do next.
+
+## What Was Done (2026-04-13)
+
+Replaced the global `Arc<Mutex<RoomManager>>` with `DashMap<String, Room>` inside `RoomManager`. The relay's media forwarding hot path no longer serializes through a single lock.
+
+### Before
+
+```
+Participant A recv_media()
+  → room_mgr.lock().await          ← ALL participants, ALL rooms compete here
+  → mgr.observe_quality(...)       ← O(N) quality computation inside lock
+  → mgr.others(...)                ← clone Vec<ParticipantSender>
+  → drop(lock)
+  → fan-out sends
+```
+
+One `tokio::sync::Mutex` guarding all rooms, all participants, all quality state. A 100-room relay was effectively single-threaded for media forwarding.
+
+### After
+
+```
+Participant A recv_media()
+  → room_mgr.observe_quality(...)  ← DashMap::get_mut(), per-room shard lock
+  → room_mgr.others(...)           ← DashMap::get(), shared shard lock
+  → fan-out sends                  ← no lock held
+```
+
+64 internal shards. Rooms on different shards are fully parallel. Rooms on the same shard use RwLock semantics — reads (`others()`) are concurrent, writes (`observe_quality()`, `join()`, `leave()`) are exclusive per-shard only.
+
+### Files Changed
+
+| File | Change |
+|------|--------|
+| `crates/wzp-relay/Cargo.toml` | Added `dashmap = "6"` |
+| `crates/wzp-relay/src/room.rs` | `HashMap<String, Room>` → `DashMap<String, Room>`, per-room quality/tier, all methods `&self` |
+| `crates/wzp-relay/src/main.rs` | `Arc<Mutex<RoomManager>>` → `Arc<RoomManager>`, 3 lock sites removed |
+| `crates/wzp-relay/src/federation.rs` | 11 lock sites removed, `room_mgr` field type changed |
+| `crates/wzp-relay/src/ws.rs` | 3 lock sites removed, `room_mgr` field type changed |
+
+### Measured Improvement
+
+| Metric | Before | After |
+|--------|--------|-------|
+| Lock type (rooms) | 1 global `tokio::sync::Mutex` | 64-shard `DashMap` with per-shard RwLock |
+| Cross-room blocking | Yes (all rooms share 1 lock) | No (rooms are independent) |
+| Read concurrency within room | None (Mutex is exclusive) | Yes (`get()` is shared) |
+| `.lock().await` sites | 20 across 4 files | 0 for room operations |
+| Test count | 314 passing | 314 passing (0 regressions) |
+
+---
+
+## Current Lock Inventory
+
+### Tier 0: Eliminated (Room Hot Path)
+
+These are gone — DashMap handles them internally:
+
+- ~~`room_mgr.lock().await` in media forwarding~~ → `room_mgr.others()` (DashMap shard)
+- ~~`room_mgr.lock().await` in quality tracking~~ → `room_mgr.observe_quality()` (DashMap shard)
+- ~~`room_mgr.lock().await` in join/leave~~ → `room_mgr.join()` / `.leave()` (DashMap entry)
+
+### Tier 1: Federation `peer_links` (Medium Priority)
+
+**Location:** `crates/wzp-relay/src/federation.rs:142`
+```rust
+peer_links: Arc<Mutex<HashMap<String, PeerLink>>>
+```
+
+**22 lock sites** across federation.rs. The most important:
+
+| Method | Line | Hold Duration | I/O While Locked | Frequency |
+|--------|------|---------------|-------------------|-----------|
+| `forward_to_peers()` | 406 | 1-5ms (iterate + sync send) | Sync only | Per-packet batch |
+| `broadcast_signal()` | 216 | N × send_signal latency | **YES (async)** | Per-signal |
+| `handle_datagram()` multi-hop | 1123 | 1-2ms (iterate + sync send) | Sync only | Per-federation-packet |
+| `send_signal_to_peer()` | 246 | send_signal latency | **YES (async)** | Per-signal |
+| Stale sweeper | 523 | 1-5ms | No | Every 5s |
+
+**Impact:** Only matters with 5+ federation peers or high federation datagram rates (>1000 pps). For 1-3 peers, contention is negligible.
+
+### Tier 2: Control Plane (Low Priority)
+
+These are on the connection setup / signal path, not the media hot path:
+
+| Lock | Location | Frequency |
+|------|----------|-----------|
+| `session_mgr` | main.rs:450 | Per-connection setup |
+| `signal_hub` | main.rs:453 | Per-signal lookup |
+| `call_registry` | main.rs:454 | Per-call setup |
+| `presence` | main.rs:283 | Per-presence change |
+| `ACL` | room.rs:357 | Per-room join |
+
+**Impact:** None. These handle rare events (connection setup, call signaling) and hold locks for <5ms with no I/O inside.
+
+### Tier 3: Forward Mode Pipeline (Niche)
+
+| Lock | Location | Notes |
+|------|----------|-------|
+| `RelayPipeline` | main.rs:198, 228 | Only used in `--remote` forward mode (relay-to-relay), not SFU room mode |
+
+**Impact:** None for normal operation. Forward mode is a niche deployment.
+
+---
+
+## Suggested Next Refactors (Priority Order)
+
+### 1. Federation `peer_links` Clone-Before-Send
+
+**Effort:** 30 minutes
+**Impact:** Eliminates the lock-held-during-iteration pattern in `forward_to_peers()` and `broadcast_signal()`
+
+**Current:**
+```rust
+pub async fn forward_to_peers(&self, ...) {
+    let links = self.peer_links.lock().await;  // held for entire loop
+    for (_fp, link) in links.iter() {
+        link.transport.send_raw_datagram(&tagged);  // sync, but lock still held
+    }
+}
+```
+
+**Fix:**
+```rust
+pub async fn forward_to_peers(&self, ...) {
+    let peers: Vec<(String, Arc<QuinnTransport>)> = {
+        let links = self.peer_links.lock().await;
+        links.values().map(|l| (l.label.clone(), l.transport.clone())).collect()
+    };  // lock released — hold time: ~1μs for Arc clones
+    
+    for (label, transport) in &peers {
+        transport.send_raw_datagram(&tagged);  // no lock held
+    }
+}
+```
+
+Same treatment for `broadcast_signal()` (line 216) which currently holds the lock across **async** `send_signal()` calls — this is the worst offender since a slow peer blocks all signal delivery.
+
+### 2. Federation `peer_links` → DashMap
+
+**Effort:** 2 hours
+**Impact:** Per-peer sharding, eliminates all cross-peer contention
+
+Only worth doing if:
+- Running 10+ federation peers
+- `forward_to_peers()` shows up in profiling
+- The clone-before-send fix from suggestion 1 is insufficient
+
+```rust
+peer_links: DashMap<String, PeerLink>
+```
+
+Most lock sites become `self.peer_links.get(&fp)` or `.get_mut(&fp)`. The multi-hop forward loop would use `.iter()` which takes temporary shared locks per shard.
+
+### 3. Quality Tracking Out of Hot Path
+
+**Effort:** 1 day
+**Impact:** Reduces per-packet DashMap shard lock from exclusive (`get_mut`) to shared (`get`)
+
+Currently, every packet with a `QualityReport` calls `observe_quality()` which uses `rooms.get_mut()` (exclusive shard lock). This serializes quality-carrying packets within the same DashMap shard.
+
+**Fix:** Use per-participant `AtomicU8` for latest loss/RTT (written lock-free from hot path). A background task (every 1s) reads the atomics, computes tiers via `rooms.get_mut()`, and broadcasts `QualityDirective`. The per-packet hot path becomes purely read-only: `rooms.get()` → `others()`.
+
+```rust
+struct ParticipantQualityAtomic {
+    latest_loss: AtomicU8,      // written per-packet (lock-free)
+    latest_rtt: AtomicU8,       // written per-packet (lock-free)
+}
+
+// Hot path (per-packet):
+if let Some(ref qr) = pkt.quality_report {
+    participant_quality.latest_loss.store(qr.loss_pct, Ordering::Relaxed);
+    participant_quality.latest_rtt.store(qr.rtt_4ms, Ordering::Relaxed);
+}
+let others = room_mgr.others(&room_name, participant_id);  // DashMap::get() — shared lock
+
+// Background task (every 1 second):
+for room in room_mgr.rooms.iter_mut() {  // DashMap::iter_mut() — exclusive per-shard
+    room.recompute_tiers_from_atomics();
+    if tier_changed { broadcast QualityDirective }
+}
+```
+
+### 4. Lock-Free Participant Snapshot (Future)
+
+**Effort:** 0.5 day
+**Impact:** Zero-lock media hot path
+
+Replace `Vec<Participant>` in `Room` with an `arc-swap` snapshot:
+
+```rust
+struct Room {
+    participants: Vec<Participant>,
+    sender_snapshot: arc_swap::ArcSwap<Vec<ParticipantSender>>,
+}
+```
+
+The snapshot is rebuilt on join/leave (rare). The hot path does `sender_snapshot.load()` — an atomic pointer read with zero locking. DashMap wouldn't even be involved in the per-packet path.
+
+Only worth doing if DashMap shard contention becomes measurable in profiling (unlikely for rooms <100 people).
+
+---
+
+## Decision Matrix
+
+| Scenario | Current (DashMap) | + Clone-Before-Send | + Quality Atomics | + arc-swap |
+|----------|-------------------|---------------------|-------------------|-----------|
+| 10 rooms × 5 people | Saturates all cores | Same | Same | Same |
+| 1 room × 100 people | Good (shared read) | Same | Better (no exclusive) | Best |
+| 5 federation peers | 1-5ms contention | <1μs contention | Same | Same |
+| 20 federation peers | 10-20ms contention | <1μs contention | Same | Same |
+| 1000 rooms × 3 people | Excellent | Same | Same | Same |
+
+**Recommendation:** Do suggestion 1 (clone-before-send, 30 min) now. Everything else is future optimization that current workloads don't need.
+
+---
+
+## Concurrency Diagram (Current State)
+
+```
+                        ┌─────────────────────────────────┐
+                        │      tokio multi-threaded        │
+                        │      work-stealing runtime       │
+                        └───────────────┬─────────────────┘
+                                        │
+           ┌────────────────────────────┼────────────────────────────┐
+           │                            │                            │
+    ┌──────▼──────┐             ┌───────▼───────┐            ┌───────▼───────┐
+    │  QUIC Accept │             │  Federation   │            │  Signal Hub   │
+    │  (per-conn   │             │  (per-peer    │            │  (per-client  │
+    │   task)      │             │   task)       │            │   task)       │
+    └──────┬──────┘             └───────┬───────┘            └───────┬───────┘
+           │                            │                            │
+    ┌──────▼──────┐             ┌───────▼───────┐            ┌───────▼───────┐
+    │  Per-Room    │             │  peer_links   │            │  signal_hub   │
+    │  DashMap     │◄──64 shards│  Mutex        │◄──1 lock   │  Mutex        │
+    │  (media hot  │             │  (federation  │            │  (signal      │
+    │   path)      │             │   hot path)   │            │   plane)      │
+    └─────────────┘             └───────────────┘            └───────────────┘
+         │                                                         │
+    No cross-room                                            Low frequency
+    blocking                                                 (<1 call/sec)
+```
+
+## Files Reference
+
+| File | Lines | Role |
+|------|-------|------|
+| `crates/wzp-relay/src/room.rs` | ~1275 | DashMap room storage, participant management, quality tracking, media forwarding loops |
+| `crates/wzp-relay/src/federation.rs` | ~1152 | Peer link management, federation media egress/ingress, signal forwarding |
+| `crates/wzp-relay/src/main.rs` | ~1746 | Connection accept, handshake dispatch, signal handling, room/federation wiring |
+| `crates/wzp-relay/src/ws.rs` | ~250 | WebSocket bridge, room integration |
+| `crates/wzp-relay/src/metrics.rs` | ~200 | Prometheus counters (lock-free atomics) |
+| `crates/wzp-relay/src/trunk.rs` | ~150 | TrunkBatcher (per-instance, no shared state) |

scripts/build-tauri-android.sh

@@ -15,11 +15,14 @@ set -euo pipefail
 #   - Output: desktop/src-tauri/gen/android/.../*.apk
 #
 # Usage:
-#   ./scripts/build-tauri-android.sh                  # full pipeline (debug)
+#   ./scripts/build-tauri-android.sh                  # full pipeline (debug, arm64 only)
 #   ./scripts/build-tauri-android.sh --release        # release APK
 #   ./scripts/build-tauri-android.sh --no-pull        # skip git fetch
 #   ./scripts/build-tauri-android.sh --rust           # force-clean rust target
 #   ./scripts/build-tauri-android.sh --init           # also run `cargo tauri android init`
+#   ./scripts/build-tauri-android.sh --arch arm64     # arm64 only (default)
+#   ./scripts/build-tauri-android.sh --arch armv7     # armv7 only (smaller APK)
+#   ./scripts/build-tauri-android.sh --arch all       # both arm64 + armv7 (separate APKs)
 #
 # Environment:
 #   WZP_BRANCH   Branch to build (default: feat/desktop-audio-rewrite)
@@ -29,27 +32,47 @@ REMOTE_HOST="SepehrHomeserverdk"
 BASE_DIR="/mnt/storage/manBuilder"
 NTFY_TOPIC="https://ntfy.sh/wzp"
 LOCAL_OUTPUT="target/tauri-android-apk"
-BRANCH="${WZP_BRANCH:-feat/desktop-audio-rewrite}"
+BRANCH="${WZP_BRANCH:-$(git -C "$(dirname "$0")/.." branch --show-current 2>/dev/null || echo "")}"
 SSH_OPTS="-o ConnectTimeout=15 -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o LogLevel=ERROR"
 
 REBUILD_RUST=0
 DO_PULL=1
 DO_INIT=0
 BUILD_RELEASE=0
+BUILD_ARCH="arm64"
+NEXT_IS_ARCH=0
 for arg in "$@"; do
+    if [ "$NEXT_IS_ARCH" = "1" ]; then
+        BUILD_ARCH="$arg"
+        NEXT_IS_ARCH=0
+        continue
+    fi
     case "$arg" in
         --rust)     REBUILD_RUST=1 ;;
         --pull)     DO_PULL=1 ;;
         --no-pull)  DO_PULL=0 ;;
         --init)     DO_INIT=1 ;;
         --release)  BUILD_RELEASE=1 ;;
+        --arch)     NEXT_IS_ARCH=1 ;;
         -h|--help)
-            sed -n '3,30p' "$0"
+            sed -n '3,32p' "$0"
             exit 0
             ;;
     esac
 done
 
+# Validate --arch
+case "$BUILD_ARCH" in
+    arm64|armv7|all) ;;
+    *) echo "ERROR: --arch must be arm64, armv7, or all (got: $BUILD_ARCH)"; exit 1 ;;
+esac
+
+if [ -z "$BRANCH" ]; then
+    echo "ERROR: could not determine target branch (detached HEAD?). Pass WZP_BRANCH=name."
+    exit 1
+fi
+echo "Target branch: $BRANCH  arch: $BUILD_ARCH"
+
 log() { echo -e "\033[1;36m>>> $*\033[0m"; }
 ssh_cmd() { ssh -A $SSH_OPTS "$REMOTE_HOST" "$@"; }
 
@@ -69,6 +92,7 @@ DO_PULL="${2:-1}"
 REBUILD_RUST="${3:-0}"
 DO_INIT="${4:-0}"
 BUILD_RELEASE="${5:-0}"
+BUILD_ARCH="${6:-arm64}"
 
 LOG_FILE=/tmp/wzp-tauri-build.log
 GIT_HASH="unknown"  # populated after fetch
@@ -149,10 +173,25 @@ PROFILE_FLAG="--debug"
 mkdir -p "$BASE_DIR/data/cache/android-home"
 chown 1000:1000 "$BASE_DIR/data/cache/android-home" 2>/dev/null || true
 
+# ─── Determine target architectures ──────────────────────────────────────
+# Maps BUILD_ARCH to cargo-ndk ABI names and cargo-tauri target names.
+# BUILD_ARCH=arm64 → one APK; BUILD_ARCH=armv7 → one APK; BUILD_ARCH=all → two APKs.
+case "$BUILD_ARCH" in
+    arm64)  ARCH_LIST="arm64" ;;
+    armv7)  ARCH_LIST="armv7" ;;
+    all)    ARCH_LIST="arm64 armv7" ;;
+esac
+
+# Mapping functions (used inside docker via env vars)
+# cargo-ndk ABI:   arm64-v8a | armeabi-v7a
+# cargo-tauri:     aarch64   | armv7
+# NDK sysroot:     aarch64-linux-android | arm-linux-androideabi
+
 docker run --rm \
     --user 1000:1000 \
     -e DO_INIT="$DO_INIT" \
     -e PROFILE_FLAG="$PROFILE_FLAG" \
+    -e BUILD_ARCH="$BUILD_ARCH" \
     -v "$BASE_DIR/data/source:/build/source" \
     -v "$BASE_DIR/data/cache/cargo-registry:/home/builder/.cargo/registry" \
     -v "$BASE_DIR/data/cache/cargo-git:/home/builder/.cargo/git" \
@@ -179,60 +218,179 @@ if [ "${DO_INIT}" = "1" ] || [ ! -x gen/android/gradlew ]; then
     cargo tauri android init 2>&1 | tail -20
 fi
 
+# ─── Arch list from BUILD_ARCH env var ───────────────────────────────────
+case "${BUILD_ARCH}" in
+    arm64)  ARCHS="arm64" ;;
+    armv7)  ARCHS="armv7" ;;
+    all)    ARCHS="arm64 armv7" ;;
+    *)      ARCHS="arm64" ;;
+esac
+
+ndk_abi() {
+    case "$1" in
+        arm64) echo "arm64-v8a" ;;
+        armv7) echo "armeabi-v7a" ;;
+    esac
+}
+
+tauri_target() {
+    case "$1" in
+        arm64) echo "aarch64" ;;
+        armv7) echo "armv7" ;;
+    esac
+}
+
+ndk_sysroot_dir() {
+    case "$1" in
+        arm64) echo "aarch64-linux-android" ;;
+        armv7) echo "arm-linux-androideabi" ;;
+    esac
+}
+
 # ─── wzp-native standalone cdylib (built with cargo-ndk, not cargo-tauri) ──
 # Produces libwzp_native.so which wzp-desktop dlopens at runtime via
-# libloading. Split exists because cargo-tauri`s linker wiring pulls
+# libloading. Split exists because cargo-tauri linker wiring pulls
 # bionic private symbols into any cdylib with cc::Build C++, causing
 # __init_tcb+4 SIGSEGV. cargo-ndk uses the same linker path as the
 # legacy wzp-android crate which works.
-echo ">>> cargo ndk build -p wzp-native --release"
-JNI_ABI_DIR=gen/android/app/src/main/jniLibs/arm64-v8a
-mkdir -p "$JNI_ABI_DIR"
-(
-    cd /build/source
-    cargo ndk -t arm64-v8a -o desktop/src-tauri/gen/android/app/src/main/jniLibs \
-        build --release -p wzp-native 2>&1 | tail -10
-)
-if [ -f "$JNI_ABI_DIR/libwzp_native.so" ]; then
-    ls -lh "$JNI_ABI_DIR/libwzp_native.so"
-else
-    echo ">>> WARNING: libwzp_native.so not produced"
-fi
+JNILIBS_BASE=gen/android/app/src/main/jniLibs
 
-# ─── libc++_shared.so — required by wzp-native at runtime ──────────────
-# wzp-native/build.rs uses cpp_link_stdlib(Some("c++_shared")) which adds
-# a NEEDED entry for libc++_shared.so to libwzp_native.so. cargo-ndk does
-# NOT copy the actual libc++_shared.so into jniLibs, so unless we copy it
-# explicitly, the APK ships without it and the Android dynamic linker
-# fails the dlopen with "library libc++_shared.so not found" at runtime.
-# Same fix that build-and-notify.sh has had for the legacy wzp-android
-# path (lines 126-134 there) — ported here for the Tauri pipeline.
-# NOTE: no apostrophes in this comment block. The enclosing docker
-# bash -c uses single quotes and a stray apostrophe closes the string
-# prematurely, breaking variable scope for everything below.
-if [ ! -f "$JNI_ABI_DIR/libc++_shared.so" ]; then
-    echo ">>> libc++_shared.so missing, copying from NDK..."
-    NDK_LIBCXX=$(find "$ANDROID_NDK_HOME" -name "libc++_shared.so" -path "*/aarch64-linux-android/*" | head -1)
-    if [ -n "$NDK_LIBCXX" ]; then
-        cp "$NDK_LIBCXX" "$JNI_ABI_DIR/"
-        ls -lh "$JNI_ABI_DIR/libc++_shared.so"
+for ARCH in $ARCHS; do
+    ABI=$(ndk_abi "$ARCH")
+    SYSROOT_DIR=$(ndk_sysroot_dir "$ARCH")
+    JNI_ABI_DIR="$JNILIBS_BASE/$ABI"
+    mkdir -p "$JNI_ABI_DIR"
+
+    echo ">>> cargo ndk build -p wzp-native --release -t $ABI"
+    (
+        cd /build/source
+        cargo ndk -t "$ABI" -o "desktop/src-tauri/$JNILIBS_BASE" \
+            build --release -p wzp-native 2>&1 | tail -10
+    )
+    if [ -f "$JNI_ABI_DIR/libwzp_native.so" ]; then
+        ls -lh "$JNI_ABI_DIR/libwzp_native.so"
     else
-        echo ">>> ERROR: libc++_shared.so not found in NDK — APK will crash at dlopen time"
-        exit 1
+        echo ">>> WARNING: libwzp_native.so not produced for $ABI"
     fi
-fi
 
-echo ">>> cargo tauri android build ${PROFILE_FLAG} --target aarch64 --apk"
-cargo tauri android build ${PROFILE_FLAG} --target aarch64 --apk
+    # ─── libc++_shared.so — required by wzp-native at runtime ────────────
+    # wzp-native/build.rs uses cpp_link_stdlib(Some("c++_shared")) which adds
+    # a NEEDED entry for libc++_shared.so to libwzp_native.so. cargo-ndk does
+    # NOT copy the actual libc++_shared.so into jniLibs, so unless we copy it
+    # explicitly, the APK ships without it and the Android dynamic linker
+    # fails the dlopen with "library libc++_shared.so not found" at runtime.
+    if [ ! -f "$JNI_ABI_DIR/libc++_shared.so" ]; then
+        echo ">>> libc++_shared.so missing for $ABI, copying from NDK..."
+        NDK_LIBCXX=$(find "$ANDROID_NDK_HOME" -name "libc++_shared.so" -path "*/${SYSROOT_DIR}/*" | head -1)
+        if [ -n "$NDK_LIBCXX" ]; then
+            cp "$NDK_LIBCXX" "$JNI_ABI_DIR/"
+            ls -lh "$JNI_ABI_DIR/libc++_shared.so"
+        else
+            echo ">>> ERROR: libc++_shared.so not found in NDK for $ABI — APK will crash at dlopen time"
+            exit 1
+        fi
+    fi
+done
+
+# ─── Build per-arch APKs ────────────────────────────────────────────────
+# When building for a single arch, only that arch jniLibs dir exists so
+# the APK is naturally single-arch and smaller.
+# When building --arch all, we produce SEPARATE per-arch APKs by:
+#   1. Building each target individually with cargo tauri android build
+#   2. Temporarily hiding the other arch jniLibs so the APK only contains one
+# This keeps APKs small (~15-20MB instead of ~30-40MB for universal).
+
+APK_OUTPUT_DIR="/build/source/target/apk-output"
+mkdir -p "$APK_OUTPUT_DIR"
+
+for ARCH in $ARCHS; do
+    TARGET=$(tauri_target "$ARCH")
+    ABI=$(ndk_abi "$ARCH")
+
+    # If building all, temporarily hide other arches to get single-arch APK
+    if [ "${BUILD_ARCH}" = "all" ]; then
+        for OTHER_ARCH in $ARCHS; do
+            OTHER_ABI=$(ndk_abi "$OTHER_ARCH")
+            if [ "$OTHER_ABI" != "$ABI" ] && [ -d "$JNILIBS_BASE/$OTHER_ABI" ]; then
+                mv "$JNILIBS_BASE/$OTHER_ABI" "$JNILIBS_BASE/_hide_$OTHER_ABI"
+            fi
+        done
+    fi
+
+    echo ""
+    echo ">>> cargo tauri android build ${PROFILE_FLAG} --target $TARGET --apk"
+    cargo tauri android build ${PROFILE_FLAG} --target "$TARGET" --apk
+
+    # Copy produced APK with arch suffix
+    BUILT_APK=$(find gen/android -name "*.apk" -newer "$APK_OUTPUT_DIR" -type f 2>/dev/null | head -1)
+    if [ -z "$BUILT_APK" ]; then
+        BUILT_APK=$(find gen/android -name "*.apk" -type f 2>/dev/null | sort -t/ -k1 | tail -1)
+    fi
+    if [ -n "$BUILT_APK" ]; then
+        OUT_APK="$APK_OUTPUT_DIR/wzp-tauri-${ARCH}.apk"
+        cp "$BUILT_APK" "$OUT_APK"
+
+        # ─── Sign release APKs with the project keystore ─────────────
+        # Release builds are unsigned by default. Sign with the release
+        # keystore (checked into the repo at android/keystore/) so the
+        # APK can be installed on real devices.
+        # Pick keystore + credentials (release preferred, debug fallback)
+        KS_RELEASE="/build/source/android/keystore/wzp-release.jks"
+        KS_DEBUG="/build/source/android/keystore/wzp-debug.jks"
+        if [ -f "$KS_RELEASE" ]; then
+            KEYSTORE="$KS_RELEASE"; KS_PASS="wzphone2024"; KS_ALIAS="wzp-release"
+        elif [ -f "$KS_DEBUG" ]; then
+            KEYSTORE="$KS_DEBUG"; KS_PASS="android"; KS_ALIAS="wzp-debug"
+        else
+            KEYSTORE=""
+        fi
+        if [ -n "$KEYSTORE" ]; then
+            ZIPALIGN=$(find "$ANDROID_HOME" -name zipalign -type f 2>/dev/null | head -1)
+            APKSIGNER=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | head -1)
+            if [ -n "$ZIPALIGN" ] && [ -n "$APKSIGNER" ]; then
+                echo ">>> Signing $ARCH APK with $(basename "$KEYSTORE")..."
+                ALIGNED="$APK_OUTPUT_DIR/wzp-tauri-${ARCH}-aligned.apk"
+                "$ZIPALIGN" -f 4 "$OUT_APK" "$ALIGNED"
+                "$APKSIGNER" sign \
+                    --ks "$KEYSTORE" \
+                    --ks-pass "pass:$KS_PASS" \
+                    --ks-key-alias "$KS_ALIAS" \
+                    --key-pass "pass:$KS_PASS" \
+                    "$ALIGNED"
+                mv "$ALIGNED" "$OUT_APK"
+                echo ">>> Signed: $(ls -lh "$OUT_APK" | awk "{print \$5}")"
+            else
+                echo ">>> WARNING: zipalign/apksigner not found — APK is unsigned"
+            fi
+        else
+            echo ">>> WARNING: no keystore found — APK is unsigned"
+        fi
+
+        echo ">>> $ARCH APK: $(ls -lh "$OUT_APK" | awk "{print \$5}")"
+    fi
+
+    # Restore hidden arches
+    if [ "${BUILD_ARCH}" = "all" ]; then
+        for OTHER_ARCH in $ARCHS; do
+            OTHER_ABI=$(ndk_abi "$OTHER_ARCH")
+            if [ "$OTHER_ABI" != "$ABI" ] && [ -d "$JNILIBS_BASE/_hide_$OTHER_ABI" ]; then
+                mv "$JNILIBS_BASE/_hide_$OTHER_ABI" "$JNILIBS_BASE/$OTHER_ABI"
+            fi
+        done
+    fi
+done
 
 echo ""
 echo ">>> Build artifacts:"
-find gen/android -name "*.apk" -exec ls -lh {} \; 2>/dev/null
+ls -lh "$APK_OUTPUT_DIR/"*.apk 2>/dev/null || echo "  (none)"
 '
 
-# Locate the produced APK
-APK=$(find "$BASE_DIR/data/source/desktop/src-tauri/gen/android" -name "*.apk" -type f 2>/dev/null | head -1)
-if [ -z "$APK" ] || [ ! -f "$APK" ]; then
+# ─── Collect and upload APKs ────────────────────────────────────────────
+# target/ is mounted from cache, not source
+APK_OUTPUT="$BASE_DIR/data/cache/target/apk-output"
+APK_LIST=$(find "$APK_OUTPUT" -name "wzp-tauri-*.apk" -type f 2>/dev/null | sort)
+
+if [ -z "$APK_LIST" ]; then
     LOG_URL=$(upload_to_rustypaste "$LOG_FILE" || echo "")
     if [ -n "$LOG_URL" ]; then
         notify "WZP Tauri Android build [$GIT_HASH]: no APK produced
@@ -242,35 +400,56 @@ log: $LOG_URL"
     fi
     exit 1
 fi
-APK_SIZE=$(du -h "$APK" | cut -f1)
 
-RUSTY_URL=$(upload_to_rustypaste "$APK" || echo "")
-if [ -n "$RUSTY_URL" ]; then
-    notify "WZP Tauri Android build OK [$GIT_HASH] ($APK_SIZE)
-$RUSTY_URL"
-else
-    notify "WZP Tauri Android build OK [$GIT_HASH] ($APK_SIZE) — rustypaste upload skipped"
-fi
+# Upload each APK and collect URLs
+NOTIFY_MSG="WZP Tauri Android build OK [$GIT_HASH] ($BUILD_ARCH)"
+APK_PATHS=""
+for APK in $APK_LIST; do
+    APK_NAME=$(basename "$APK")
+    APK_SIZE=$(du -h "$APK" | cut -f1)
+    RUSTY_URL=$(upload_to_rustypaste "$APK" || echo "")
+    if [ -n "$RUSTY_URL" ]; then
+        NOTIFY_MSG="$NOTIFY_MSG
+$APK_NAME ($APK_SIZE): $RUSTY_URL"
+    else
+        NOTIFY_MSG="$NOTIFY_MSG
+$APK_NAME ($APK_SIZE) — upload skipped"
+    fi
+    APK_PATHS="$APK_PATHS $APK"
+done
+notify "$NOTIFY_MSG"
 
-# Print path so the local script can grab it
-echo "APK_REMOTE_PATH=$APK"
+# Print paths so the local script can grab them
+for APK in $APK_LIST; do
+    echo "APK_REMOTE_PATH=$APK"
+done
 REMOTE_SCRIPT
 
 ssh_cmd "chmod +x /tmp/wzp-tauri-build.sh"
 
-notify_local "WZP Tauri Android build dispatched (branch=$BRANCH, release=$BUILD_RELEASE)"
-log "Triggering remote build (branch=$BRANCH)..."
+notify_local "WZP Tauri Android build dispatched (branch=$BRANCH, arch=$BUILD_ARCH, release=$BUILD_RELEASE)"
+log "Triggering remote build (branch=$BRANCH, arch=$BUILD_ARCH)..."
 
-# Run; capture full output, last line is APK_REMOTE_PATH=...
-REMOTE_OUTPUT=$(ssh_cmd "/tmp/wzp-tauri-build.sh '$BRANCH' '$DO_PULL' '$REBUILD_RUST' '$DO_INIT' '$BUILD_RELEASE'" || true)
+# Run; last lines are APK_REMOTE_PATH=...  (one per arch)
+REMOTE_OUTPUT=$(ssh_cmd "/tmp/wzp-tauri-build.sh '$BRANCH' '$DO_PULL' '$REBUILD_RUST' '$DO_INIT' '$BUILD_RELEASE' '$BUILD_ARCH'" || true)
 echo "$REMOTE_OUTPUT" | tail -60
 
-APK_REMOTE=$(echo "$REMOTE_OUTPUT" | grep '^APK_REMOTE_PATH=' | tail -1 | cut -d= -f2-)
-if [ -n "$APK_REMOTE" ]; then
-    log "Downloading APK to $LOCAL_OUTPUT/wzp-tauri.apk..."
-    scp $SSH_OPTS "$REMOTE_HOST:$APK_REMOTE" "$LOCAL_OUTPUT/wzp-tauri.apk"
-    echo "  $LOCAL_OUTPUT/wzp-tauri.apk ($(du -h "$LOCAL_OUTPUT/wzp-tauri.apk" | cut -f1))"
-else
+# Download all produced APKs
+APK_REMOTES=$(echo "$REMOTE_OUTPUT" | grep '^APK_REMOTE_PATH=' | cut -d= -f2-)
+if [ -z "$APK_REMOTES" ]; then
     log "No APK produced — see ntfy / remote log /tmp/wzp-tauri-build.log"
     exit 1
 fi
+
+DOWNLOADED=0
+echo "$APK_REMOTES" | while IFS= read -r APK_REMOTE; do
+    [ -z "$APK_REMOTE" ] && continue
+    APK_NAME=$(basename "$APK_REMOTE")
+    log "Downloading $APK_NAME..."
+    scp $SSH_OPTS "$REMOTE_HOST:$APK_REMOTE" "$LOCAL_OUTPUT/$APK_NAME"
+    echo "  $LOCAL_OUTPUT/$APK_NAME ($(du -h "$LOCAL_OUTPUT/$APK_NAME" | cut -f1))"
+    DOWNLOADED=$((DOWNLOADED + 1))
+done
+
+log "Done! APKs in $LOCAL_OUTPUT/"
+ls -lh "$LOCAL_OUTPUT"/wzp-tauri-*.apk 2>/dev/null || true

scripts/build.sh

@@ -0,0 +1,421 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# WZ Phone — unified build script
+#
+# Builds Tauri Android APK and/or Linux x86_64 binaries via Docker on a
+# remote build server. Uploads artifacts, notifies via ntfy.sh/wzp.
+#
+# Two servers:
+#   PRIMARY (default)  SepehrHomeserverdk    paste.dk.manko.yoga   origin (gitea)
+#   ALT (--alt)        manwe@172.16.81.175   paste.tbs.amn.gg      fj (forgejo)
+#
+# Usage:
+#   ./scripts/build.sh                       Android APK (current branch, primary)
+#   ./scripts/build.sh --alt                  Android APK on alt server
+#   ./scripts/build.sh --linux               Linux binaries only
+#   ./scripts/build.sh --all                 Android + Linux
+#   ./scripts/build.sh --branch NAME         Override branch
+#   ./scripts/build.sh --rust                Force Rust rebuild
+#   ./scripts/build.sh --no-pull             Skip git pull
+#   ./scripts/build.sh --init                First-time setup (clone + Docker image)
+#   ./scripts/build.sh --install             Download APK + adb install locally
+#   ./scripts/build.sh --release             Release APK (not debug)
+#   ./scripts/build.sh --android64          Release arm64 APK (shorthand for --android --release)
+# =============================================================================
+
+NTFY_TOPIC="https://ntfy.sh/wzp"
+LOCAL_OUTPUT="target/tauri-android-apk"
+SSH_BASE_OPTS="-o ConnectTimeout=15 -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o LogLevel=ERROR"
+
+# ── Server profiles ─────────────────────────────────────────────────────────
+USE_ALT=0
+REBUILD_RUST=0
+DO_PULL=1
+DO_INSTALL=0
+DO_INIT=0
+BUILD_ANDROID=1
+BUILD_LINUX=0
+BUILD_RELEASE=0
+BRANCH=$(git -C "$(dirname "$0")/.." branch --show-current 2>/dev/null || echo "")
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --alt)      USE_ALT=1 ;;
+        --rust)     REBUILD_RUST=1 ;;
+        --pull)     DO_PULL=1 ;;
+        --no-pull)  DO_PULL=0 ;;
+        --install)  DO_INSTALL=1 ;;
+        --init)     DO_INIT=1 ;;
+        --android)  BUILD_ANDROID=1; BUILD_LINUX=0 ;;
+        --android64) BUILD_ANDROID=1; BUILD_LINUX=0; BUILD_RELEASE=1; BRANCH="main" ;;
+        --linux)    BUILD_ANDROID=0; BUILD_LINUX=1 ;;
+        --all)      BUILD_ANDROID=1; BUILD_LINUX=1 ;;
+        --release)  BUILD_RELEASE=1 ;;
+        --branch)   shift; BRANCH="$1" ;;
+        --branch=*) BRANCH="${1#--branch=}" ;;
+        -h|--help)  sed -n '3,22p' "$0"; exit 0 ;;
+        *)          echo "Unknown arg: $1"; exit 1 ;;
+    esac
+    shift
+done
+
+if [ -z "$BRANCH" ]; then
+    echo "ERROR: could not determine target branch (detached HEAD?). Pass --branch NAME."
+    exit 1
+fi
+
+# ── Select server profile ───────────────────────────────────────────────────
+if [ "$USE_ALT" = "1" ]; then
+    SERVER_TAG="ALT"
+    REMOTE_HOST="manwe@172.16.81.175"
+    BASE_DIR="/home/manwe/wzp-builder"
+    SSH_OPTS="$SSH_BASE_OPTS"
+    GIT_ORIGIN="ssh://git@git.tbs.amn.gg:2222/manawenuz/wzp.git"
+    # Alt server uploads directly (no .env file)
+    UPLOAD_MODE="direct"
+    PASTE_URL="https://paste.tbs.manko.yoga"
+    PASTE_AUTH="X2j6szIQaoJGaxZjLkpl3A8IX9/mTkDgdhhgyYFcpaU="
+else
+    SERVER_TAG="PRI"
+    REMOTE_HOST="SepehrHomeserverdk"
+    BASE_DIR="/mnt/storage/manBuilder"
+    SSH_OPTS="-A $SSH_BASE_OPTS"
+    GIT_ORIGIN=""  # uses existing origin on the remote
+    # Primary server uses .env file for rustypaste credentials
+    UPLOAD_MODE="envfile"
+    PASTE_URL=""
+    PASTE_AUTH=""
+fi
+
+TARGETS=""
+[ "$BUILD_ANDROID" = 1 ] && TARGETS="Android"
+[ "$BUILD_LINUX" = 1 ] && TARGETS="${TARGETS:+$TARGETS + }Linux"
+echo "[$SERVER_TAG] branch: $BRANCH | targets: $TARGETS"
+
+log() { echo -e "\033[1;36m>>> $*\033[0m"; }
+ssh_cmd() { ssh $SSH_OPTS "$REMOTE_HOST" "$@"; }
+
+# ── First-time setup (--init) ───────────────────────────────────────────────
+if [ "$DO_INIT" = "1" ]; then
+    log "[$SERVER_TAG] First-time setup..."
+    ssh_cmd "mkdir -p $BASE_DIR/data/{source,cache/target,cache/cargo-registry,cache/cargo-git,cache/gradle,cache/android-home,cache-linux/target,cache-linux/cargo-registry,cache-linux/cargo-git}"
+
+    if [ -n "$GIT_ORIGIN" ]; then
+        log "Cloning from $GIT_ORIGIN..."
+        ssh_cmd "if [ ! -d $BASE_DIR/data/source/.git ]; then git clone $GIT_ORIGIN $BASE_DIR/data/source; else echo 'Repo already cloned'; fi"
+    fi
+
+    log "Uploading Dockerfile..."
+    cat scripts/Dockerfile.android-builder | ssh_cmd "cat > /tmp/Dockerfile.android-builder"
+    log "Building Docker image (10-20 min on first run)..."
+    ssh_cmd "cd /tmp && docker build -t wzp-android-builder -f Dockerfile.android-builder . 2>&1 | tail -20"
+
+    log "[$SERVER_TAG] Init done! Run without --init to build."
+    exit 0
+fi
+
+# ── Upload remote build script ──────────────────────────────────────────────
+log "[$SERVER_TAG] Uploading build script..."
+ssh_cmd "cat > /tmp/wzp-build.sh" <<REMOTE_SCRIPT
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_DIR="$BASE_DIR"
+NTFY_TOPIC="$NTFY_TOPIC"
+REBUILD_RUST="$REBUILD_RUST"
+DO_PULL="$DO_PULL"
+BRANCH="$BRANCH"
+BUILD_ANDROID="$BUILD_ANDROID"
+BUILD_LINUX="$BUILD_LINUX"
+BUILD_RELEASE="$BUILD_RELEASE"
+SERVER_TAG="$SERVER_TAG"
+UPLOAD_MODE="$UPLOAD_MODE"
+PASTE_URL="$PASTE_URL"
+PASTE_AUTH="$PASTE_AUTH"
+
+notify() { curl -s -d "\$1" "\$NTFY_TOPIC" > /dev/null 2>&1 || true; }
+
+# Upload a file; print URL on stdout.
+upload_file() {
+    local file="\$1"
+    if [ "\$UPLOAD_MODE" = "direct" ]; then
+        curl -s -F "file=@\$file" -H "Authorization: \$PASTE_AUTH" "\$PASTE_URL" || echo ""
+    else
+        local env_file="\$BASE_DIR/.env"
+        [ ! -f "\$env_file" ] && { echo ""; return; }
+        source "\$env_file"
+        if [ -n "\${rusty_address:-}" ] && [ -n "\${rusty_auth_token:-}" ]; then
+            curl -s -F "file=@\$file" -H "Authorization: \$rusty_auth_token" "\$rusty_address" || echo ""
+        else
+            echo ""
+        fi
+    fi
+}
+
+trap 'notify "WZP [\$SERVER_TAG] build FAILED [\$BRANCH]! Check /tmp/wzp-build.log"' ERR
+
+# ── Pull source ─────────────────────────────────────────────────────────
+if [ "\$DO_PULL" = "1" ]; then
+    echo ">>> Pulling branch '\$BRANCH' from origin..."
+    cd "\$BASE_DIR/data/source"
+    git reset --hard HEAD 2>/dev/null || true
+    # NOTE: do NOT git clean -fd — it wipes tauri-generated scaffold
+    git fetch origin "\$BRANCH" 2>&1 | tail -3
+    git checkout "\$BRANCH" 2>/dev/null || git checkout -b "\$BRANCH" "origin/\$BRANCH"
+    git reset --hard "origin/\$BRANCH"
+    git submodule update --init || true
+    echo ">>> HEAD: \$(git rev-parse --short HEAD) — \$(git log -1 --format=%s)"
+
+    # Ensure signing keystores exist. They're gitignored so git reset/clean
+    # may delete them. Copy from the persistent cache if available, or warn.
+    KS_DIR="\$BASE_DIR/data/source/android/keystore"
+    KS_CACHE="\$BASE_DIR/data/keystore"
+    mkdir -p "\$KS_DIR"
+    if [ -d "\$KS_CACHE" ] && ls "\$KS_CACHE"/*.jks >/dev/null 2>&1; then
+        cp -n "\$KS_CACHE"/*.jks "\$KS_DIR/" 2>/dev/null || true
+        echo ">>> Keystores synced from cache"
+    elif ! ls "\$KS_DIR"/*.jks >/dev/null 2>&1; then
+        echo ">>> WARNING: no keystores in \$KS_DIR or \$KS_CACHE — APK will be unsigned!"
+    fi
+fi
+
+GIT_HASH=\$(cd "\$BASE_DIR/data/source" && git rev-parse --short HEAD 2>/dev/null || echo unknown)
+GIT_MSG=\$(cd "\$BASE_DIR/data/source" && git log -1 --pretty=%s 2>/dev/null | head -c 60 || echo "?")
+
+# ── Clean Rust if requested ─────────────────────────────────────────────
+if [ "\$REBUILD_RUST" = "1" ]; then
+    echo ">>> Cleaning Rust targets..."
+    rm -rf "\$BASE_DIR/data/cache/target/aarch64-linux-android" \
+           "\$BASE_DIR/data/cache/target/armv7-linux-androideabi" \
+           "\$BASE_DIR/data/cache/target/i686-linux-android" \
+           "\$BASE_DIR/data/cache/target/x86_64-linux-android"
+    rm -rf "\$BASE_DIR/data/cache-linux/target/release"
+fi
+
+# ── Fix perms ───────────────────────────────────────────────────────────
+find "\$BASE_DIR/data/source" "\$BASE_DIR/data/cache" \
+    ! -user 1000 -o ! -group 1000 2>/dev/null | \
+    xargs -r chown 1000:1000 2>/dev/null || true
+if [ -d "\$BASE_DIR/data/cache-linux" ]; then
+    find "\$BASE_DIR/data/cache-linux" \
+        ! -user 1000 -o ! -group 1000 2>/dev/null | \
+        xargs -r chown 1000:1000 2>/dev/null || true
+fi
+
+# ── Tauri Android APK ──────────────────────────────────────────────────
+if [ "\$BUILD_ANDROID" = "1" ]; then
+    notify "WZP [\$SERVER_TAG] Tauri Android build STARTED [\$BRANCH @ \$GIT_HASH] — \$GIT_MSG"
+    echo ">>> Cleaning stale APKs from prior builds..."
+    find "\$BASE_DIR/data/source/desktop/src-tauri/gen/android" -name "*.apk" -type f -delete 2>/dev/null || true
+    echo ">>> Building Tauri Android APK..."
+
+    PROFILE_FLAG="--debug"
+    [ "\$BUILD_RELEASE" = "1" ] && PROFILE_FLAG=""
+
+    mkdir -p "\$BASE_DIR/data/cache/android-home"
+    chown 1000:1000 "\$BASE_DIR/data/cache/android-home" 2>/dev/null || true
+
+    docker run --rm --user 1000:1000 \
+        -e PROFILE_FLAG="\$PROFILE_FLAG" \
+        -v "\$BASE_DIR/data/source:/build/source" \
+        -v "\$BASE_DIR/data/cache/cargo-registry:/home/builder/.cargo/registry" \
+        -v "\$BASE_DIR/data/cache/cargo-git:/home/builder/.cargo/git" \
+        -v "\$BASE_DIR/data/cache/target:/build/source/target" \
+        -v "\$BASE_DIR/data/cache/gradle:/home/builder/.gradle" \
+        -v "\$BASE_DIR/data/cache/android-home:/home/builder/.android" \
+        wzp-android-builder bash -c '
+set -euo pipefail
+cd /build/source/desktop
+
+echo ">>> npm install"
+npm install --silent 2>&1 | tail -5 || npm install 2>&1 | tail -20
+
+cd src-tauri
+
+if [ ! -x gen/android/gradlew ]; then
+    echo ">>> cargo tauri android init"
+    cargo tauri android init 2>&1 | tail -20
+fi
+
+echo ">>> cargo ndk build -p wzp-native --release"
+JNI_ABI_DIR=gen/android/app/src/main/jniLibs/arm64-v8a
+mkdir -p "\$JNI_ABI_DIR"
+(
+    cd /build/source
+    cargo ndk -t arm64-v8a -o desktop/src-tauri/gen/android/app/src/main/jniLibs \
+        build --release -p wzp-native 2>&1 | tail -10
+)
+[ -f "\$JNI_ABI_DIR/libwzp_native.so" ] && ls -lh "\$JNI_ABI_DIR/libwzp_native.so"
+
+if [ ! -f "\$JNI_ABI_DIR/libc++_shared.so" ]; then
+    echo ">>> libc++_shared.so missing, copying from NDK..."
+    NDK_LIBCXX=\$(find "\$ANDROID_NDK_HOME" -name "libc++_shared.so" -path "*/aarch64-linux-android/*" | head -1)
+    if [ -n "\$NDK_LIBCXX" ]; then
+        cp "\$NDK_LIBCXX" "\$JNI_ABI_DIR/"
+    else
+        echo "ERROR: libc++_shared.so not found in NDK"; exit 1
+    fi
+fi
+
+echo ">>> cargo tauri android build \${PROFILE_FLAG} --target aarch64 --apk"
+cargo tauri android build \${PROFILE_FLAG} --target aarch64 --apk
+
+# ─── Sign the APK ────────────────────────────────────────────────
+# Release builds from cargo-tauri are unsigned. Sign with the project
+# keystore so the APK can be installed on real devices.
+BUILT_APK=\$(find gen/android -name "*.apk" -type f 2>/dev/null | sort -t/ -k1 | tail -1)
+if [ -n "\$BUILT_APK" ]; then
+    KS_RELEASE="/build/source/android/keystore/wzp-release.jks"
+    KS_DEBUG="/build/source/android/keystore/wzp-debug.jks"
+    if [ -f "\$KS_RELEASE" ]; then
+        KEYSTORE="\$KS_RELEASE"; KS_PASS="wzphone2024"; KS_ALIAS="wzp-release"
+    elif [ -f "\$KS_DEBUG" ]; then
+        KEYSTORE="\$KS_DEBUG"; KS_PASS="android"; KS_ALIAS="wzp-debug"
+    else
+        KEYSTORE=""
+    fi
+    if [ -n "\$KEYSTORE" ]; then
+        ZIPALIGN=\$(find "\$ANDROID_HOME" -name zipalign -type f 2>/dev/null | head -1)
+        APKSIGNER=\$(find "\$ANDROID_HOME" -name apksigner -type f 2>/dev/null | head -1)
+        if [ -n "\$ZIPALIGN" ] && [ -n "\$APKSIGNER" ]; then
+            echo ">>> Signing APK with \$(basename \$KEYSTORE)..."
+            ALIGNED="\${BUILT_APK%.apk}-aligned.apk"
+            "\$ZIPALIGN" -f 4 "\$BUILT_APK" "\$ALIGNED"
+            "\$APKSIGNER" sign \
+                --ks "\$KEYSTORE" \
+                --ks-pass "pass:\$KS_PASS" \
+                --ks-key-alias "\$KS_ALIAS" \
+                --key-pass "pass:\$KS_PASS" \
+                "\$ALIGNED"
+            mv "\$ALIGNED" "\$BUILT_APK"
+            echo ">>> Signed: \$(ls -lh \$BUILT_APK | awk "{print \\\$5}")"
+        else
+            echo ">>> WARNING: zipalign/apksigner not found — APK is unsigned"
+        fi
+    else
+        echo ">>> WARNING: no keystore found — APK is unsigned"
+    fi
+fi
+
+echo ">>> Build artifacts:"
+find gen/android -name "*.apk" -exec ls -lh {} \; 2>/dev/null
+echo "APK_BUILT"
+'
+
+    echo ">>> Uploading APK..."
+    # Clean stale APKs from prior builds so find doesn't pick an old
+    # debug APK over the fresh release one (or vice versa).
+    find "\$BASE_DIR/data/source/desktop/src-tauri/gen/android" -name "*.apk" -type f \
+        ! -newer "\$BASE_DIR/data/source/desktop/src-tauri/gen/android/app/build/outputs" \
+        -delete 2>/dev/null || true
+    # Prefer release APK if it exists, else fall back to debug.
+    APK=\$(find "\$BASE_DIR/data/source/desktop/src-tauri/gen/android" -name "*release*.apk" -type f 2>/dev/null | head -1)
+    [ -z "\$APK" ] && APK=\$(find "\$BASE_DIR/data/source/desktop/src-tauri/gen/android" -name "*.apk" -type f 2>/dev/null | head -1)
+    if [ -n "\$APK" ]; then
+        APK_SIZE=\$(du -h "\$APK" | cut -f1)
+        URL=\$(upload_file "\$APK")
+        echo "APK_URL=\$URL"
+        notify "WZP [\$SERVER_TAG] Tauri Android OK [\$BRANCH @ \$GIT_HASH] (\$APK_SIZE)
+\$URL"
+        echo ">>> APK: \$URL (\$APK_SIZE)"
+    else
+        notify "WZP [\$SERVER_TAG] Tauri Android FAILED [\$BRANCH @ \$GIT_HASH] - no APK"
+        echo "ERROR: No APK found"; exit 1
+    fi
+fi
+
+# ── Linux x86_64 binaries ───────────────────────────────────────────────
+if [ "\$BUILD_LINUX" = "1" ]; then
+    mkdir -p "\$BASE_DIR/data/cache-linux/target" \
+             "\$BASE_DIR/data/cache-linux/cargo-registry" \
+             "\$BASE_DIR/data/cache-linux/cargo-git"
+
+    notify "WZP [\$SERVER_TAG] Linux x86_64 build STARTED [\$BRANCH @ \$GIT_HASH]..."
+    echo ">>> Building Linux binaries..."
+
+    docker run --rm --user 1000:1000 \
+        -v "\$BASE_DIR/data/source:/build/source" \
+        -v "\$BASE_DIR/data/cache-linux/cargo-registry:/home/builder/.cargo/registry" \
+        -v "\$BASE_DIR/data/cache-linux/cargo-git:/home/builder/.cargo/git" \
+        -v "\$BASE_DIR/data/cache-linux/target:/build/source/target" \
+        wzp-android-builder bash -c '
+set -euo pipefail
+cd /build/source
+
+echo ">>> Building relay + client + web + bench..."
+cargo build --release --bin wzp-relay --bin wzp-client --bin wzp-web --bin wzp-bench 2>&1 | tail -5
+
+echo ">>> Building audio client..."
+cargo build --release --bin wzp-client --features audio 2>&1 | tail -3
+cp target/release/wzp-client target/release/wzp-client-audio
+cargo build --release --bin wzp-client 2>&1 | tail -3
+
+echo ">>> Binaries:"
+ls -lh target/release/wzp-relay target/release/wzp-client target/release/wzp-client-audio target/release/wzp-web target/release/wzp-bench
+
+echo ">>> Packaging..."
+tar czf /tmp/wzp-linux-x86_64.tar.gz \
+    -C target/release wzp-relay wzp-client wzp-client-audio wzp-web wzp-bench
+echo "BINARIES_BUILT"
+'
+
+    echo ">>> Uploading Linux binaries..."
+    docker run --rm \
+        -v "\$BASE_DIR/data/cache-linux/target:/build/target" \
+        wzp-android-builder bash -c \
+        "cp /build/target/release/wzp-relay /build/target/release/wzp-client /build/target/release/wzp-client-audio /build/target/release/wzp-web /build/target/release/wzp-bench /tmp/ && tar czf /tmp/wzp-linux-x86_64.tar.gz -C /tmp wzp-relay wzp-client wzp-client-audio wzp-web wzp-bench && cat /tmp/wzp-linux-x86_64.tar.gz" \
+        > /tmp/wzp-linux-x86_64.tar.gz
+
+    URL=\$(upload_file /tmp/wzp-linux-x86_64.tar.gz)
+    if [ -n "\$URL" ]; then
+        echo "LINUX_URL=\$URL"
+        notify "WZP [\$SERVER_TAG] Linux x86_64 OK [\$BRANCH @ \$GIT_HASH]
+\$URL"
+        echo ">>> Linux binaries: \$URL"
+    else
+        notify "WZP [\$SERVER_TAG] Linux build FAILED - upload error"
+        echo "ERROR: Linux upload failed"; exit 1
+    fi
+fi
+
+echo ">>> All builds complete!"
+REMOTE_SCRIPT
+
+ssh_cmd "chmod +x /tmp/wzp-build.sh"
+
+# Run in tmux
+log "[$SERVER_TAG] Starting build in tmux (branch: $BRANCH)..."
+ssh_cmd "tmux kill-session -t wzp-build 2>/dev/null; true"
+ssh_cmd "tmux new-session -d -s wzp-build '/tmp/wzp-build.sh 2>&1 | tee /tmp/wzp-build.log'"
+
+log "[$SERVER_TAG] Build running! Notification on ntfy.sh/wzp when done."
+echo ""
+echo "  Monitor:  ssh $REMOTE_HOST 'tail -f /tmp/wzp-build.log'"
+echo "  Status:   ssh $REMOTE_HOST 'tail -5 /tmp/wzp-build.log'"
+echo ""
+
+# Optionally wait and install locally
+if [ "$DO_INSTALL" = "1" ]; then
+    log "Waiting for build..."
+    while true; do
+        sleep 15
+        if ssh_cmd "grep -q 'APK_URL\|LINUX_URL\|ERROR\|All builds complete' /tmp/wzp-build.log 2>/dev/null"; then
+            break
+        fi
+    done
+
+    URL=$(ssh_cmd "grep APK_URL /tmp/wzp-build.log | tail -1 | cut -d= -f2")
+    if [ -n "$URL" ]; then
+        log "Downloading APK..."
+        mkdir -p "$LOCAL_OUTPUT"
+        curl -s -o "$LOCAL_OUTPUT/wzp-tauri.apk" "$URL"
+        log "Installing..."
+        adb uninstall com.wzp.phone 2>/dev/null || true
+        adb install "$LOCAL_OUTPUT/wzp-tauri.apk"
+        log "Done!"
+    else
+        log "No APK URL found in log"
+    fi
+fi