fix(build): build-and-notify.sh — parameterize branch, fail loud on pull errors

Two bugs caused the post-Phase-3c APK build to ship from the wrong source:

1. The remote script hardcoded `feat/android-voip-client` as the branch
   to pull — not the current working branch. It was never updated when
   we moved to android-rewrite and then opus-DRED.

2. `git reset --hard origin/feat/android-voip-client 2>/dev/null || true`
   silently swallowed the reset failure when that branch didn't exist on
   the remote's origin, leaving the tree on whatever branch was there
   from a previous session. In our case that was feat/desktop-audio-rewrite
   at d0c1731 — the android-rewrite baseline, missing every Phase 0-4
   commit. The ntfy notification even included the stale commit hash
   d0c1731 but nobody noticed because the hash wasn't being cross-checked
   against the branch the script claimed to be building.

Fix:

Local side (scripts/build-and-notify.sh):
  - Auto-detect the current local branch via `git branch --show-current`
  - Accept `--branch NAME` override for explicit control
  - Pass the branch as a third positional arg to the remote build script
  - Abort early if we can't determine a branch (detached HEAD)
  - Updated usage docs to reflect the "build whatever I'm working on"
    default

Remote side (embedded heredoc):
  - Read BRANCH from $3 and abort if empty
  - `git fetch origin "$BRANCH"` — no piping to /dev/null, errors surface
  - `git reset --hard "origin/$BRANCH"` — no `|| true`, failures abort
  - Print the resolved commit hash + subject line immediately after reset
    so logs cross-reference the source clearly
  - Started/done ntfy notifications now include the branch name alongside
    the commit hash: "WZP Android [opus-DRED @ 953ab71] done! APK: ..."

Result: next build will (a) actually fetch the requested branch from the
remote's gitea origin, (b) fail loudly if the branch doesn't exist or
the reset fails, and (c) surface the branch in the ntfy notifications so
future "wait, which build is this?" confusion is impossible.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cargo.toml

@@ -10,8 +10,6 @@ members = [
     "crates/wzp-client",
     "crates/wzp-web",
     "crates/wzp-android",
-    "crates/wzp-native",
-    "desktop/src-tauri",
 ]
 
 [workspace.package]
@@ -32,7 +30,6 @@ serde = { version = "1", features = ["derive"] }
 
 # Transport
 quinn = "0.11"
-socket2 = "0.5"
 
 # FEC
 raptorq = "2"
@@ -63,29 +60,3 @@ wzp-fec = { path = "crates/wzp-fec" }
 wzp-crypto = { path = "crates/wzp-crypto" }
 wzp-transport = { path = "crates/wzp-transport" }
 wzp-client = { path = "crates/wzp-client" }
-
-# Fast dev profile: optimized but with debug info and incremental compilation.
-# Use with: cargo run --profile dev-fast
-[profile.dev-fast]
-inherits = "dev"
-opt-level = 2
-
-# Optimize heavy compute deps even in debug builds —
-# real-time audio needs < 20ms per frame, impossible unoptimized.
-[profile.dev.package.nnnoiseless]
-opt-level = 3
-[profile.dev.package.opusic-sys]
-opt-level = 3
-[profile.dev.package.raptorq]
-opt-level = 3
-[profile.dev.package.wzp-codec]
-opt-level = 3
-[profile.dev.package.wzp-fec]
-opt-level = 3
-
-# Phase 0 (opus-DRED): removed the [patch.crates-io] audiopus_sys = { path =
-# "vendor/audiopus_sys" } block. That patch existed to fix a Windows clang-cl
-# SIMD compile bug in libopus 1.3.1. With the swap to opusic-sys (libopus
-# 1.5.2), the upstream SIMD gating was fixed and the vendor patch is
-# obsolete. The vendor/audiopus_sys directory itself should be deleted as
-# part of the same cleanup — see the commit that follows this Phase 0.

android/app/src/main/java/com/wzp/engine/SignalManager.kt

@@ -0,0 +1,97 @@
+package com.wzp.engine
+
+import org.json.JSONObject
+
+/**
+ * Persistent signal connection for direct 1:1 calls.
+ * Separate from WzpEngine — survives across calls.
+ *
+ * Lifecycle: connect() → [placeCall/answerCall] → destroy()
+ */
+class SignalManager {
+
+    private var handle: Long = 0L
+
+    val isConnected: Boolean get() = handle != 0L
+
+    /**
+     * Connect to relay and register for direct calls.
+     * MUST be called from a thread with sufficient stack (8MB).
+     * Blocks briefly during QUIC connect + register, then returns.
+     */
+    fun connect(relay: String, seedHex: String): Boolean {
+        if (handle != 0L) return true // already connected
+        handle = nativeSignalConnect(relay, seedHex)
+        return handle != 0L
+    }
+
+    /** Get current signal state as parsed object. Non-blocking. */
+    fun getState(): SignalState {
+        if (handle == 0L) return SignalState()
+        val json = nativeSignalGetState(handle) ?: return SignalState()
+        return try {
+            val obj = JSONObject(json)
+            SignalState(
+                status = obj.optString("status", "idle"),
+                fingerprint = obj.optString("fingerprint", ""),
+                incomingCallId = if (obj.isNull("incoming_call_id")) null else obj.optString("incoming_call_id"),
+                incomingCallerFp = if (obj.isNull("incoming_caller_fp")) null else obj.optString("incoming_caller_fp"),
+                incomingCallerAlias = if (obj.isNull("incoming_caller_alias")) null else obj.optString("incoming_caller_alias"),
+                callSetupRelay = if (obj.isNull("call_setup_relay")) null else obj.optString("call_setup_relay"),
+                callSetupRoom = if (obj.isNull("call_setup_room")) null else obj.optString("call_setup_room"),
+                callSetupId = if (obj.isNull("call_setup_id")) null else obj.optString("call_setup_id"),
+            )
+        } catch (e: Exception) {
+            SignalState()
+        }
+    }
+
+    /** Place a direct call to a target fingerprint. */
+    fun placeCall(targetFp: String): Int {
+        if (handle == 0L) return -1
+        return nativeSignalPlaceCall(handle, targetFp)
+    }
+
+    /** Answer an incoming call. mode: 0=Reject, 1=AcceptTrusted, 2=AcceptGeneric */
+    fun answerCall(callId: String, mode: Int = 2): Int {
+        if (handle == 0L) return -1
+        return nativeSignalAnswerCall(handle, callId, mode)
+    }
+
+    /** Send hangup signal. */
+    fun hangup() {
+        if (handle != 0L) nativeSignalHangup(handle)
+    }
+
+    /** Destroy the signal manager. */
+    fun destroy() {
+        if (handle != 0L) {
+            nativeSignalDestroy(handle)
+            handle = 0L
+        }
+    }
+
+    // JNI native methods
+    private external fun nativeSignalConnect(relay: String, seed: String): Long
+    private external fun nativeSignalGetState(handle: Long): String?
+    private external fun nativeSignalPlaceCall(handle: Long, targetFp: String): Int
+    private external fun nativeSignalAnswerCall(handle: Long, callId: String, mode: Int): Int
+    private external fun nativeSignalHangup(handle: Long)
+    private external fun nativeSignalDestroy(handle: Long)
+
+    companion object {
+        init { System.loadLibrary("wzp_android") }
+    }
+}
+
+/** Signal connection state. */
+data class SignalState(
+    val status: String = "idle",
+    val fingerprint: String = "",
+    val incomingCallId: String? = null,
+    val incomingCallerFp: String? = null,
+    val incomingCallerAlias: String? = null,
+    val callSetupRelay: String? = null,
+    val callSetupRoom: String? = null,
+    val callSetupId: String? = null,
+)

android/app/src/main/java/com/wzp/engine/WzpEngine.kt

@@ -96,17 +96,6 @@ class WzpEngine(private val callback: WzpCallback) {
         if (nativeHandle != 0L) nativeForceProfile(nativeHandle, profile)
     }
 
-    /**
-     * Signal a network transport change (e.g. WiFi → LTE handoff).
-     *
-     * @param networkType matches Rust `NetworkContext` ordinals:
-     *   0=WiFi, 1=LTE, 2=5G, 3=3G, 4=Unknown, 5=None
-     * @param bandwidthKbps reported downstream bandwidth in kbps
-     */
-    fun onNetworkChanged(networkType: Int, bandwidthKbps: Int) {
-        if (nativeHandle != 0L) nativeOnNetworkChanged(nativeHandle, networkType, bandwidthKbps)
-    }
-
     /** Destroy the native engine and free all resources. The instance must not be reused. */
     @Synchronized
     fun destroy() {
@@ -170,11 +159,22 @@ class WzpEngine(private val callback: WzpCallback) {
     private external fun nativeWriteAudioDirect(handle: Long, buffer: java.nio.ByteBuffer, sampleCount: Int): Int
     private external fun nativeReadAudioDirect(handle: Long, buffer: java.nio.ByteBuffer, maxSamples: Int): Int
     private external fun nativeDestroy(handle: Long)
+
+    companion object {
+        init { System.loadLibrary("wzp_android") }
+
+        /** Get the identity fingerprint for a seed hex. No engine needed. */
+        @JvmStatic
+        private external fun nativeGetFingerprint(seedHex: String): String?
+
+        /** Compute the full identity fingerprint (xxxx:xxxx:...) from a seed hex string. */
+        @JvmStatic
+        fun getFingerprint(seedHex: String): String = nativeGetFingerprint(seedHex) ?: ""
+    }
     private external fun nativePingRelay(handle: Long, relay: String): String?
     private external fun nativeStartSignaling(handle: Long, relay: String, seed: String, token: String, alias: String): Int
     private external fun nativePlaceCall(handle: Long, targetFp: String): Int
     private external fun nativeAnswerCall(handle: Long, callId: String, mode: Int): Int
-    private external fun nativeOnNetworkChanged(handle: Long, networkType: Int, bandwidthKbps: Int)
 
     /**
      * Ping a relay server. Requires engine to be initialized.
@@ -220,11 +220,6 @@ class WzpEngine(private val callback: WzpCallback) {
         return nativeAnswerCall(nativeHandle, callId, mode)
     }
 
-    companion object {
-        init {
-            System.loadLibrary("wzp_android")
-        }
-    }
 }
 
 /** Integer constants matching the Rust [CallState] enum ordinals. */

android/app/src/main/java/com/wzp/net/NetworkMonitor.kt

@@ -1,141 +0,0 @@
-package com.wzp.net
-
-import android.content.Context
-import android.net.ConnectivityManager
-import android.net.Network
-import android.net.NetworkCapabilities
-import android.net.NetworkRequest
-import android.os.Handler
-import android.os.Looper
-
-/**
- * Monitors network connectivity changes via [ConnectivityManager.NetworkCallback]
- * and classifies the active transport (WiFi, LTE, 5G, 3G).
- *
- * Callbacks fire on the main looper so callers can safely update UI state or
- * dispatch to a native engine from any callback.
- *
- * Usage:
- * 1. Set [onNetworkChanged] to receive `(type: Int, downlinkKbps: Int)` events
- * 2. Optionally set [onIpChanged] for IP address change events (mid-call ICE refresh)
- * 3. Call [register] when the call starts
- * 4. Call [unregister] when the call ends
- */
-class NetworkMonitor(context: Context) {
-
-    private val cm = context.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
-    private val mainHandler = Handler(Looper.getMainLooper())
-
-    /**
-     * Called when the network transport type or bandwidth changes.
-     * `type` constants match the Rust `NetworkContext` enum ordinals.
-     */
-    var onNetworkChanged: ((type: Int, downlinkKbps: Int) -> Unit)? = null
-
-    /**
-     * Called when the device's IP address changes (link properties changed).
-     * Useful for triggering mid-call ICE candidate re-gathering.
-     */
-    var onIpChanged: (() -> Unit)? = null
-
-    // Track the last emitted type to avoid redundant callbacks
-    @Volatile
-    private var lastEmittedType: Int = TYPE_UNKNOWN
-
-    private val callback = object : ConnectivityManager.NetworkCallback() {
-        override fun onAvailable(network: Network) {
-            classifyAndEmit(network)
-        }
-
-        override fun onCapabilitiesChanged(network: Network, caps: NetworkCapabilities) {
-            classifyFromCaps(caps)
-        }
-
-        override fun onLinkPropertiesChanged(
-            network: Network,
-            linkProperties: android.net.LinkProperties
-        ) {
-            // IP address may have changed — notify for ICE refresh
-            onIpChanged?.invoke()
-            // Also re-classify in case the transport changed simultaneously
-            classifyAndEmit(network)
-        }
-
-        override fun onLost(network: Network) {
-            lastEmittedType = TYPE_NONE
-            onNetworkChanged?.invoke(TYPE_NONE, 0)
-        }
-    }
-
-    // -- Public API -----------------------------------------------------------
-
-    /** Register the network callback. Call when a call starts. */
-    fun register() {
-        val request = NetworkRequest.Builder()
-            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-            .build()
-        cm.registerNetworkCallback(request, callback, mainHandler)
-    }
-
-    /** Unregister the network callback. Call when the call ends. */
-    fun unregister() {
-        try {
-            cm.unregisterNetworkCallback(callback)
-        } catch (_: IllegalArgumentException) {
-            // Already unregistered — safe to ignore
-        }
-    }
-
-    // -- Classification -------------------------------------------------------
-
-    private fun classifyAndEmit(network: Network) {
-        val caps = cm.getNetworkCapabilities(network) ?: return
-        classifyFromCaps(caps)
-    }
-
-    private fun classifyFromCaps(caps: NetworkCapabilities) {
-        val type = when {
-            caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> TYPE_WIFI
-            caps.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> TYPE_WIFI // treat as WiFi
-            caps.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> classifyCellular(caps)
-            else -> TYPE_UNKNOWN
-        }
-        val bw = caps.getLinkDownstreamBandwidthKbps()
-
-        // Deduplicate: only emit when the transport type actually changes
-        if (type != lastEmittedType) {
-            lastEmittedType = type
-            onNetworkChanged?.invoke(type, bw)
-        }
-    }
-
-    /**
-     * Approximate cellular generation from reported downstream bandwidth.
-     * This avoids requiring READ_PHONE_STATE permission (needed for
-     * TelephonyManager.getNetworkType on API 30+).
-     *
-     * Thresholds are conservative — carriers over-report bandwidth, so we
-     * classify based on what's actually usable for VoIP:
-     * - >= 100 Mbps → 5G NR
-     * - >= 10 Mbps  → LTE
-     * - < 10 Mbps   → 3G or worse
-     */
-    private fun classifyCellular(caps: NetworkCapabilities): Int {
-        val bw = caps.getLinkDownstreamBandwidthKbps()
-        return when {
-            bw >= 100_000 -> TYPE_CELLULAR_5G
-            bw >= 10_000 -> TYPE_CELLULAR_LTE
-            else -> TYPE_CELLULAR_3G
-        }
-    }
-
-    companion object {
-        /** Constants matching Rust `NetworkContext` enum ordinals. */
-        const val TYPE_WIFI = 0
-        const val TYPE_CELLULAR_LTE = 1
-        const val TYPE_CELLULAR_5G = 2
-        const val TYPE_CELLULAR_3G = 3
-        const val TYPE_UNKNOWN = 4
-        const val TYPE_NONE = 5
-    }
-}

android/app/src/main/java/com/wzp/ui/call/CallViewModel.kt

@@ -5,7 +5,6 @@ import android.util.Log
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.wzp.audio.AudioPipeline
-import com.wzp.audio.AudioRoute
 import com.wzp.audio.AudioRouteManager
 import com.wzp.data.SettingsRepository
 import com.wzp.debug.DebugReporter
@@ -13,7 +12,6 @@ import com.wzp.engine.CallStats
 import com.wzp.service.CallService
 import com.wzp.engine.WzpCallback
 import com.wzp.engine.WzpEngine
-import com.wzp.net.NetworkMonitor
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.delay
@@ -45,7 +43,6 @@ class CallViewModel : ViewModel(), WzpCallback {
     private var engineInitialized = false
     private var audioPipeline: AudioPipeline? = null
     private var audioRouteManager: AudioRouteManager? = null
-    private var networkMonitor: NetworkMonitor? = null
     private var audioStarted = false
     private var appContext: Context? = null
     private var settings: SettingsRepository? = null
@@ -63,9 +60,6 @@ class CallViewModel : ViewModel(), WzpCallback {
     private val _isSpeaker = MutableStateFlow(false)
     val isSpeaker: StateFlow<Boolean> = _isSpeaker.asStateFlow()
 
-    private val _audioRoute = MutableStateFlow(AudioRoute.EARPIECE)
-    val audioRoute: StateFlow<AudioRoute> = _audioRoute.asStateFlow()
-
     private val _stats = MutableStateFlow(CallStats())
     val stats: StateFlow<CallStats> = _stats.asStateFlow()
 
@@ -147,9 +141,9 @@ class CallViewModel : ViewModel(), WzpCallback {
     private val _targetFingerprint = MutableStateFlow("")
     val targetFingerprint: StateFlow<String> = _targetFingerprint.asStateFlow()
 
-    /** Signal connection state: 0=idle, 5=registered, 6=ringing, 7=incoming */
-    private val _signalState = MutableStateFlow(0)
-    val signalState: StateFlow<Int> = _signalState.asStateFlow()
+    /** Signal state string: "idle", "registered", "ringing", "incoming", "setup" */
+    private val _signalState = MutableStateFlow("idle")
+    val signalState: StateFlow<String> = _signalState.asStateFlow()
 
     /** Incoming call info */
     private val _incomingCallId = MutableStateFlow<String?>(null)
@@ -161,34 +155,82 @@ class CallViewModel : ViewModel(), WzpCallback {
     private val _incomingCallerAlias = MutableStateFlow<String?>(null)
     val incomingCallerAlias: StateFlow<String?> = _incomingCallerAlias.asStateFlow()
 
+    /** Separate signal manager (persistent, survives calls) */
+    private var signalManager: com.wzp.engine.SignalManager? = null
+    private var signalPollJob: Job? = null
+
     fun setCallMode(mode: Int) { _callMode.value = mode }
     fun setTargetFingerprint(fp: String) { _targetFingerprint.value = fp }
 
     /** Register on relay for direct calls */
     fun registerForCalls() {
-        if (engine == null) {
-            engine = WzpEngine(this).also { it.init() }
-        }
         val serverIdx = _selectedServer.value
         val serverList = _servers.value
         if (serverIdx >= serverList.size) return
 
         val relay = serverList[serverIdx].address
-        val seed = _seedHex.value
-        val alias = _alias.value
+        var seed = _seedHex.value
+        // Generate seed if empty (fresh install or cleared storage)
+        if (seed.isEmpty()) {
+            val newSeed = ByteArray(32).also { java.security.SecureRandom().nextBytes(it) }
+            seed = newSeed.joinToString("") { "%02x".format(it) }
+            _seedHex.value = seed
+            settings?.saveSeedHex(seed)
+            Log.i(TAG, "generated new identity seed")
+        }
+        val resolvedRelay = resolveToIp(relay) ?: relay
 
-        viewModelScope.launch(Dispatchers.IO) {
-            val resolvedRelay = resolveToIp(relay) ?: relay
-            val result = engine?.startSignaling(resolvedRelay, seed, "", alias)
-            if (result == 0) {
-                _signalState.value = 5 // Registered
-                startStatsPolling()
-            } else {
-                _errorMessage.value = "Failed to register on relay"
+        // nativeSignalConnect has JNI overhead — must be on a thread with enough stack.
+        // Dispatchers.IO threads overflow. Use explicit Java Thread.
+        Thread(null, {
+            try {
+                val mgr = com.wzp.engine.SignalManager()
+                val ok = mgr.connect(resolvedRelay, seed)
+                viewModelScope.launch {
+                    if (ok) {
+                        signalManager = mgr
+                        startSignalPolling()
+                    } else {
+                        _errorMessage.value = "Failed to register on relay"
+                    }
+                }
+            } catch (e: Exception) {
+                viewModelScope.launch {
+                    _errorMessage.value = "Register error: ${e.message}"
+                }
+            }
+        }, "wzp-signal-init", 8 * 1024 * 1024).start()
+    }
+
+    /** Poll signal manager state every 500ms */
+    private fun startSignalPolling() {
+        signalPollJob?.cancel()
+        signalPollJob = viewModelScope.launch {
+            while (isActive) {
+                val mgr = signalManager
+                if (mgr != null && mgr.isConnected) {
+                    val state = mgr.getState()
+                    _signalState.value = state.status
+                    _incomingCallId.value = state.incomingCallId
+                    _incomingCallerFp.value = state.incomingCallerFp
+                    _incomingCallerAlias.value = state.incomingCallerAlias
+
+                    // Auto-connect to media room when call is set up
+                    if (state.status == "setup" && state.callSetupRelay != null && state.callSetupRoom != null) {
+                        Log.i(TAG, "CallSetup: connecting to ${state.callSetupRelay} room ${state.callSetupRoom}")
+                        startCallInternal(state.callSetupRelay, state.callSetupRoom)
+                    }
+                }
+                delay(500L)
             }
         }
     }
 
+    private fun stopSignalPolling() {
+        signalPollJob?.cancel()
+        signalPollJob = null
+    }
+
     /** Place a direct call to the target fingerprint */
     fun placeDirectCall() {
         val target = _targetFingerprint.value.trim()
@@ -196,24 +238,28 @@ class CallViewModel : ViewModel(), WzpCallback {
             _errorMessage.value = "Enter a fingerprint to call"
             return
         }
-        engine?.placeCall(target)
-        _signalState.value = 6 // Ringing
+        signalManager?.placeCall(target)
     }
 
     /** Answer an incoming direct call */
     fun answerIncomingCall(mode: Int = 2) {
         val callId = _incomingCallId.value ?: return
-        engine?.answerCall(callId, mode)
+        signalManager?.answerCall(callId, mode)
     }
 
     /** Reject an incoming direct call */
     fun rejectIncomingCall() {
         val callId = _incomingCallId.value ?: return
-        engine?.answerCall(callId, 0) // 0 = Reject
-        _signalState.value = 5 // Back to registered
-        _incomingCallId.value = null
-        _incomingCallerFp.value = null
-        _incomingCallerAlias.value = null
+        signalManager?.answerCall(callId, 0)
+    }
+
+    /** Hang up direct call — media ends, signal stays alive */
+    fun hangupDirectCall() {
+        signalManager?.hangup()
+        engine?.stopCall()
+        engine?.destroy()
+        engine = null
+        engineInitialized = false
     }
 
     companion object {
@@ -232,19 +278,7 @@ class CallViewModel : ViewModel(), WzpCallback {
             audioPipeline = AudioPipeline(appCtx)
         }
         if (audioRouteManager == null) {
-            audioRouteManager = AudioRouteManager(appCtx).also { arm ->
-                arm.onRouteChanged = { route ->
-                    _audioRoute.value = route
-                    _isSpeaker.value = (route == AudioRoute.SPEAKER)
-                }
-            }
-        }
-        if (networkMonitor == null) {
-            networkMonitor = NetworkMonitor(appCtx).also { nm ->
-                nm.onNetworkChanged = { type, bw ->
-                    engine?.onNetworkChanged(type, bw)
-                }
-            }
+            audioRouteManager = AudioRouteManager(appCtx)
         }
         if (debugReporter == null) {
             debugReporter = DebugReporter(appCtx)
@@ -625,27 +659,6 @@ class CallViewModel : ViewModel(), WzpCallback {
         audioRouteManager?.setSpeaker(newSpeaker)
     }
 
-    /** Cycle audio output: Earpiece → Speaker → Bluetooth (if available) → Earpiece. */
-    fun cycleAudioRoute() {
-        val routes = audioRouteManager?.availableRoutes() ?: return
-        val currentIdx = routes.indexOf(_audioRoute.value)
-        val next = routes[(currentIdx + 1) % routes.size]
-        when (next) {
-            AudioRoute.EARPIECE -> {
-                audioRouteManager?.setBluetoothSco(false)
-                audioRouteManager?.setSpeaker(false)
-            }
-            AudioRoute.SPEAKER -> {
-                audioRouteManager?.setSpeaker(true)
-            }
-            AudioRoute.BLUETOOTH -> {
-                audioRouteManager?.setBluetoothSco(true)
-            }
-        }
-        _audioRoute.value = next
-        _isSpeaker.value = (next == AudioRoute.SPEAKER)
-    }
-
     fun clearError() { _errorMessage.value = null }
 
     fun sendDebugReport() {
@@ -700,7 +713,6 @@ class CallViewModel : ViewModel(), WzpCallback {
             it.start(e)
         }
         audioRouteManager?.register()
-        networkMonitor?.register()
         audioStarted = true
     }
 
@@ -708,10 +720,8 @@ class CallViewModel : ViewModel(), WzpCallback {
         if (!audioStarted) return
         audioPipeline?.stop()    // sets running=false; DON'T null — teardown needs awaitDrain()
         audioRouteManager?.unregister()
-        networkMonitor?.unregister()
         audioRouteManager?.setSpeaker(false)
         _isSpeaker.value = false
-        _audioRoute.value = AudioRoute.EARPIECE
         audioStarted = false
     }
 
@@ -727,30 +737,10 @@ class CallViewModel : ViewModel(), WzpCallback {
                         val s = CallStats.fromJson(json)
                         lastCallDuration = s.durationSecs
                         _stats.value = s
+                        // Only update callState from media engine stats (not signal)
                         if (s.state != 0) {
                             _callState.value = s.state
                         }
-                        // Track signal state changes for direct calling
-                        if (s.state in 5..7) {
-                            _signalState.value = s.state
-                        }
-                        // Incoming call detection
-                        if (s.state == 7) { // IncomingCall
-                            _incomingCallId.value = s.incomingCallId
-                            _incomingCallerFp.value = s.incomingCallerFp
-                            _incomingCallerAlias.value = s.incomingCallerAlias
-                        }
-                        // CallSetup: auto-connect to media room
-                        if (s.state == 1 && s.incomingCallId != null && s.incomingCallId.contains("|")) {
-                            // Format: "relay_addr|room_name"
-                            val parts = s.incomingCallId.split("|", limit = 2)
-                            if (parts.size == 2) {
-                                val mediaRelay = parts[0]
-                                val mediaRoom = parts[1]
-                                Log.i(TAG, "CallSetup: connecting to $mediaRelay room $mediaRoom")
-                                startCallInternal(mediaRelay, mediaRoom)
-                            }
-                        }
                         if (s.state == 2 && !audioStarted) {
                             startAudio()
                         }

android/app/src/main/java/com/wzp/ui/call/InCallScreen.kt

@@ -49,7 +49,6 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
-import com.wzp.audio.AudioRoute
 import com.wzp.engine.CallStats
 import com.wzp.ui.components.CopyableFingerprint
 import com.wzp.ui.components.Identicon
@@ -75,7 +74,6 @@ fun InCallScreen(
     val callState by viewModel.callState.collectAsState()
     val isMuted by viewModel.isMuted.collectAsState()
     val isSpeaker by viewModel.isSpeaker.collectAsState()
-    val audioRoute by viewModel.audioRoute.collectAsState()
     val stats by viewModel.stats.collectAsState()
     val qualityTier by viewModel.qualityTier.collectAsState()
     val errorMessage by viewModel.errorMessage.collectAsState()
@@ -167,7 +165,7 @@ fun InCallScreen(
                     color = Color.White
                 )
                 Text(
-                    text = "ENCRYPTED VOICE",
+                    text = "ENCRYPTED VOICE  \u2022  direct-call-v1",
                     style = MaterialTheme.typography.labelSmall.copy(letterSpacing = 3.sp),
                     color = TextDim
                 )
@@ -221,7 +219,7 @@ fun InCallScreen(
 
                 // Mode toggle: Room vs Direct Call
                 val callMode by viewModel.callMode.collectAsState()
-                val signalState by viewModel.signalState.collectAsState()
+                val signalState by viewModel.signalState.collectAsState()  // "idle"/"registered"/"ringing"/etc
                 val targetFp by viewModel.targetFingerprint.collectAsState()
                 val incomingCallId by viewModel.incomingCallId.collectAsState()
                 val incomingCallerFp by viewModel.incomingCallerFp.collectAsState()
@@ -311,7 +309,7 @@ fun InCallScreen(
                     }
                 } else {
                     // ── Direct call mode ──
-                    if (signalState < 5) {
+                    if (signalState == "idle") {
                         // Not registered yet
                         SectionLabel("ALIAS")
                         OutlinedTextField(
@@ -335,7 +333,7 @@ fun InCallScreen(
                                 color = Color.White
                             )
                         }
-                    } else if (signalState == 5) {
+                    } else if (signalState == "registered" || signalState == "incoming") {
                         // Registered — show dial pad
                         Text(
                             "\u2705 Registered — waiting for calls",
@@ -405,8 +403,7 @@ fun InCallScreen(
                                 color = Color.White
                             )
                         }
-                    } else if (signalState == 6) {
-                        // Ringing
+                    } else if (signalState == "ringing") {
                         Text(
                             "\uD83D\uDD14 Ringing...",
                             color = Yellow,
@@ -414,11 +411,10 @@ fun InCallScreen(
                             textAlign = TextAlign.Center,
                             modifier = Modifier.fillMaxWidth()
                         )
-                    } else if (signalState == 7) {
-                        // Incoming call (state 7 also handled above in registered view)
+                    } else if (signalState == "setup") {
                         Text(
-                            "\uD83D\uDCDE Incoming call...",
-                            color = Green,
+                            "Connecting to call...",
+                            color = Accent,
                             style = MaterialTheme.typography.titleMedium,
                             textAlign = TextAlign.Center,
                             modifier = Modifier.fillMaxWidth()
@@ -433,14 +429,16 @@ fun InCallScreen(
 
                 Spacer(modifier = Modifier.height(20.dp))
 
-                // Identity
-                val fp = if (seedHex.length >= 16) seedHex.take(16) else ""
+                // Identity — compute real fingerprint from seed
+                val fullFp = remember(seedHex) {
+                    if (seedHex.length >= 64) com.wzp.engine.WzpEngine.getFingerprint(seedHex) else ""
+                }
                 Row(verticalAlignment = Alignment.CenterVertically) {
-                    if (fp.isNotEmpty()) {
-                        Identicon(fingerprint = seedHex, size = 28.dp)
+                    if (fullFp.isNotEmpty()) {
+                        Identicon(fingerprint = fullFp, size = 28.dp)
                         Spacer(modifier = Modifier.width(8.dp))
                         CopyableFingerprint(
-                            fingerprint = fp.chunked(4).joinToString(":"),
+                            fingerprint = fullFp,
                             style = MaterialTheme.typography.bodySmall.copy(fontFamily = FontFamily.Monospace),
                             color = TextDim
                         )
@@ -623,12 +621,12 @@ fun InCallScreen(
 
                 Spacer(modifier = Modifier.height(16.dp))
 
-                // Controls: Mic / End / Route (Ear/Spk/BT)
+                // Controls: Mic / End / Spk
                 ControlRow(
                     isMuted = isMuted,
-                    audioRoute = audioRoute,
+                    isSpeaker = isSpeaker,
                     onToggleMute = viewModel::toggleMute,
-                    onCycleRoute = viewModel::cycleAudioRoute,
+                    onToggleSpeaker = viewModel::toggleSpeaker,
                     onHangUp = { viewModel.stopCall() }
                 )
 
@@ -917,9 +915,9 @@ private fun AudioLevelBar(audioLevel: Int) {
 @Composable
 private fun ControlRow(
     isMuted: Boolean,
-    audioRoute: AudioRoute,
+    isSpeaker: Boolean,
     onToggleMute: () -> Unit,
-    onCycleRoute: () -> Unit,
+    onToggleSpeaker: () -> Unit,
     onHangUp: () -> Unit
 ) {
     Row(
@@ -961,28 +959,22 @@ private fun ControlRow(
             Text("End", style = MaterialTheme.typography.titleMedium.copy(fontWeight = FontWeight.Bold))
         }
 
-        // Audio route: cycles Earpiece → Speaker → Bluetooth (when available)
+        // Speaker
         FilledTonalIconButton(
-            onClick = onCycleRoute,
+            onClick = onToggleSpeaker,
             modifier = Modifier.size(56.dp),
-            colors = when (audioRoute) {
-                AudioRoute.SPEAKER -> IconButtonDefaults.filledTonalIconButtonColors(
+            colors = if (isSpeaker) {
+                IconButtonDefaults.filledTonalIconButtonColors(
                     containerColor = Color(0xFF0F3460), contentColor = Color.White
                 )
-                AudioRoute.BLUETOOTH -> IconButtonDefaults.filledTonalIconButtonColors(
-                    containerColor = Color(0xFF2563EB), contentColor = Color.White
-                )
-                else -> IconButtonDefaults.filledTonalIconButtonColors(
+            } else {
+                IconButtonDefaults.filledTonalIconButtonColors(
                     containerColor = DarkSurface2, contentColor = Color.White
                 )
             }
         ) {
             Text(
-                text = when (audioRoute) {
-                    AudioRoute.EARPIECE -> "Ear"
-                    AudioRoute.SPEAKER -> "Spk"
-                    AudioRoute.BLUETOOTH -> "BT"
-                },
+                text = if (isSpeaker) "Spk\nOn" else "Spk",
                 textAlign = TextAlign.Center,
                 style = MaterialTheme.typography.labelSmall,
                 lineHeight = 12.sp

crates/wzp-android/src/engine.rs

@@ -99,9 +99,6 @@ pub(crate) struct EngineState {
     /// QUIC transport handle — stored so stop_call() can close it immediately,
     /// triggering relay-side leave + RoomUpdate broadcast.
     pub quic_transport: Mutex<Option<Arc<wzp_transport::QuinnTransport>>>,
-    /// Network type from Android ConnectivityManager, polled by recv task.
-    /// 0xFF = no change pending; 0-5 = NetworkContext ordinal.
-    pub pending_network_type: AtomicU8,
 }
 
 pub struct WzpEngine {
@@ -123,7 +120,6 @@ impl WzpEngine {
             playout_ring: AudioRing::new(),
             audio_level_rms: AtomicU32::new(0),
             quic_transport: Mutex::new(None),
-            pending_network_type: AtomicU8::new(PROFILE_NO_CHANGE),
         });
         Self {
             state,
@@ -207,7 +203,6 @@ impl WzpEngine {
     /// Returns JSON `{"rtt_ms":N,"server_fingerprint":"hex"}` or error.
     pub fn ping_relay(&self, address: &str) -> Result<String, anyhow::Error> {
         let addr: SocketAddr = address.parse()?;
-        let _ = rustls::crypto::ring::default_provider().install_default();
 
         let rt = tokio::runtime::Builder::new_current_thread()
             .enable_all()
@@ -251,154 +246,7 @@ impl WzpEngine {
     }
 
     /// Start persistent signaling connection for direct calls.
-    /// Spawns a background task that maintains the `_signal` connection.
-    pub fn start_signaling(
-        &mut self,
-        relay_addr: &str,
-        seed_hex: &str,
-        token: Option<&str>,
-        alias: Option<&str>,
-    ) -> Result<(), anyhow::Error> {
-        use wzp_proto::{MediaTransport, SignalMessage};
-
-        let addr: SocketAddr = relay_addr.parse()?;
-        let seed = if seed_hex.is_empty() {
-            wzp_crypto::Seed::generate()
-        } else {
-            wzp_crypto::Seed::from_hex(seed_hex).map_err(|e| anyhow::anyhow!(e))?
-        };
-        let identity = seed.derive_identity();
-        let pub_id = identity.public_identity();
-        let identity_pub = *pub_id.signing.as_bytes();
-        let fp = pub_id.fingerprint.to_string();
-        let token = token.map(|s| s.to_string());
-        let alias = alias.map(|s| s.to_string());
-        let state = self.state.clone();
-        let seed_bytes = seed.0;
-
-        info!(fingerprint = %fp, relay = %addr, "starting signaling");
-
-        // Create runtime for signaling (separate from call runtime)
-        let rt = tokio::runtime::Builder::new_multi_thread()
-            .worker_threads(1)
-            .enable_all()
-            .build()?;
-
-        let signal_state = state.clone();
-        rt.spawn(async move {
-            let _ = rustls::crypto::ring::default_provider().install_default();
-            let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
-            let endpoint = match wzp_transport::create_endpoint(bind, None) {
-                Ok(e) => e,
-                Err(e) => { error!("signal endpoint: {e}"); return; }
-            };
-            let client_cfg = wzp_transport::client_config();
-            let conn = match wzp_transport::connect(&endpoint, addr, "_signal", client_cfg).await {
-                Ok(c) => c,
-                Err(e) => { error!("signal connect: {e}"); return; }
-            };
-            let transport = std::sync::Arc::new(wzp_transport::QuinnTransport::new(conn));
-
-            // Auth if token provided
-            if let Some(ref tok) = token {
-                let _ = transport.send_signal(&SignalMessage::AuthToken { token: tok.clone() }).await;
-            }
-
-            // Register presence
-            let _ = transport.send_signal(&SignalMessage::RegisterPresence {
-                identity_pub,
-                signature: vec![],
-                alias: alias.clone(),
-            }).await;
-
-            // Wait for ack
-            match transport.recv_signal().await {
-                Ok(Some(SignalMessage::RegisterPresenceAck { success: true, .. })) => {
-                    info!(fingerprint = %fp, "signal: registered");
-                    let mut stats = signal_state.stats.lock().unwrap();
-                    stats.state = crate::stats::CallState::Registered;
-                }
-                other => {
-                    error!("signal registration failed: {other:?}");
-                    return;
-                }
-            }
-
-            // Signal recv loop
-            loop {
-                if !signal_state.running.load(Ordering::Relaxed) {
-                    break;
-                }
-                match transport.recv_signal().await {
-                    Ok(Some(SignalMessage::CallRinging { call_id })) => {
-                        info!(call_id = %call_id, "signal: ringing");
-                        let mut stats = signal_state.stats.lock().unwrap();
-                        stats.state = crate::stats::CallState::Ringing;
-                    }
-                    Ok(Some(SignalMessage::DirectCallOffer { caller_fingerprint, caller_alias, call_id, .. })) => {
-                        info!(from = %caller_fingerprint, call_id = %call_id, "signal: incoming call");
-                        let mut stats = signal_state.stats.lock().unwrap();
-                        stats.state = crate::stats::CallState::IncomingCall;
-                        stats.incoming_call_id = Some(call_id);
-                        stats.incoming_caller_fp = Some(caller_fingerprint);
-                        stats.incoming_caller_alias = caller_alias;
-                    }
-                    Ok(Some(SignalMessage::DirectCallAnswer { call_id, accept_mode, .. })) => {
-                        info!(call_id = %call_id, mode = ?accept_mode, "signal: call answered");
-                    }
-                    Ok(Some(SignalMessage::CallSetup { call_id, room, relay_addr, .. })) => {
-                        info!(call_id = %call_id, room = %room, relay = %relay_addr, "signal: call setup");
-                        // Connect to media room via the existing start_call mechanism
-                        // Store the room info so Kotlin can call startCall with it
-                        let mut stats = signal_state.stats.lock().unwrap();
-                        stats.state = crate::stats::CallState::Connecting;
-                        // Store call setup info for Kotlin to pick up
-                        stats.incoming_call_id = Some(format!("{relay_addr}|{room}"));
-                    }
-                    Ok(Some(SignalMessage::Hangup { reason, .. })) => {
-                        info!(reason = ?reason, "signal: call ended by remote");
-                        let mut stats = signal_state.stats.lock().unwrap();
-                        stats.state = crate::stats::CallState::Closed;
-                        stats.incoming_call_id = None;
-                        stats.incoming_caller_fp = None;
-                        stats.incoming_caller_alias = None;
-                    }
-                    Ok(Some(_)) => {}
-                    Ok(None) => {
-                        info!("signal: connection closed");
-                        break;
-                    }
-                    Err(e) => {
-                        error!("signal recv error: {e}");
-                        break;
-                    }
-                }
-            }
-
-            let mut stats = signal_state.stats.lock().unwrap();
-            stats.state = crate::stats::CallState::Closed;
-        });
-
-        self.tokio_runtime = Some(rt);
-        Ok(())
-    }
-
-    /// Place a direct call to a target fingerprint via the signal connection.
-    pub fn place_call(&self, target_fingerprint: &str) -> Result<(), anyhow::Error> {
-        let _ = self.state.command_tx.send(EngineCommand::PlaceCall {
-            target_fingerprint: target_fingerprint.to_string(),
-        });
-        Ok(())
-    }
-
-    /// Answer an incoming direct call.
-    pub fn answer_call(&self, call_id: &str, mode: wzp_proto::CallAcceptMode) -> Result<(), anyhow::Error> {
-        let _ = self.state.command_tx.send(EngineCommand::AnswerCall {
-            call_id: call_id.to_string(),
-            accept_mode: mode,
-        });
-        Ok(())
-    }
+    // Signal methods (start_signaling, place_call, answer_call) moved to signal_mgr.rs
 
     pub fn set_mute(&self, muted: bool) {
         self.state.muted.store(muted, Ordering::Relaxed);
@@ -408,13 +256,6 @@ impl WzpEngine {
 
     pub fn force_profile(&self, _profile: QualityProfile) {}
 
-    /// Signal a network transport change from Android ConnectivityManager.
-    /// Stores the type atomically; the recv task polls it on each packet.
-    pub fn on_network_changed(&self, network_type: u8, bandwidth_kbps: u32) {
-        info!(network_type, bandwidth_kbps, "on_network_changed");
-        self.state.pending_network_type.store(network_type, Ordering::Release);
-    }
-
     pub fn get_stats(&self) -> CallStats {
         let mut stats = self.state.stats.lock().unwrap().clone();
         if let Some(start) = self.call_start {
@@ -469,7 +310,6 @@ async fn run_call(
     alias: Option<&str>,
     state: Arc<EngineState>,
 ) -> Result<(), anyhow::Error> {
-    let _ = rustls::crypto::ring::default_provider().install_default();
 
     let bind_addr: SocketAddr = "0.0.0.0:0".parse().unwrap();
     let endpoint = wzp_transport::create_endpoint(bind_addr, None)?;
@@ -882,23 +722,6 @@ async fn run_call(
                         );
                     }
 
-                    // Check for network transport change from ConnectivityManager
-                    {
-                        let net = state.pending_network_type.swap(PROFILE_NO_CHANGE, Ordering::Acquire);
-                        if net != PROFILE_NO_CHANGE {
-                            use wzp_proto::NetworkContext;
-                            let ctx = match net {
-                                0 => NetworkContext::WiFi,
-                                1 => NetworkContext::CellularLte,
-                                2 => NetworkContext::Cellular5g,
-                                3 => NetworkContext::Cellular3g,
-                                _ => NetworkContext::Unknown,
-                            };
-                            quality_ctrl.signal_network_change(ctx);
-                            info!(?ctx, "quality controller: network context updated");
-                        }
-                    }
-
                     // Adaptive quality: ingest quality reports from relay
                     if auto_profile {
                         if let Some(ref qr) = pkt.quality_report {

crates/wzp-android/src/jni_bridge.rs

@@ -77,6 +77,9 @@ pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeInit(
 ) -> jlong {
     let result = panic::catch_unwind(|| {
         init_logging();
+        // Install rustls crypto provider ONCE on the main thread.
+        // Must not be called per-thread — conflicts with Android's system libcrypto.so TLS keys.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let handle = Box::new(EngineHandle {
             engine: WzpEngine::new(),
         });
@@ -222,29 +225,6 @@ pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeForceProfile(
     }));
 }
 
-/// Signal a network transport change from the Android ConnectivityManager.
-///
-/// `network_type` matches the Rust `NetworkContext` enum:
-///   0=WiFi, 1=CellularLte, 2=Cellular5g, 3=Cellular3g, 4=Unknown, 5=None
-///
-/// The engine forwards this to the `AdaptiveQualityController` which:
-/// - Preemptively downgrades one tier on WiFi→cellular
-/// - Activates a 10-second FEC boost
-/// - Uses faster downgrade thresholds on cellular
-#[unsafe(no_mangle)]
-pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeOnNetworkChanged(
-    _env: JNIEnv,
-    _class: JClass,
-    handle: jlong,
-    network_type: jint,
-    bandwidth_kbps: jint,
-) {
-    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
-        let h = unsafe { handle_ref(handle) };
-        h.engine.on_network_changed(network_type as u8, bandwidth_kbps as u32);
-    }));
-}
-
 /// Write captured PCM samples from Kotlin AudioRecord into the engine's capture ring.
 /// pcm is a Java short[] array.
 #[unsafe(no_mangle)]
@@ -383,88 +363,149 @@ pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativePingRelay<'a>(
         .unwrap_or(JObject::null().into_raw())
 }
 
+/// Get the identity fingerprint for a seed hex string.
+/// Returns the full fingerprint (xxxx:xxxx:...) or empty string on error.
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeGetFingerprint<'a>(
+    mut env: JNIEnv<'a>,
+    _class: JClass,
+    seed_hex_j: JString,
+) -> jstring {
+    let seed_hex: String = env.get_string(&seed_hex_j).map(|s| s.into()).unwrap_or_default();
+    let fp = if seed_hex.is_empty() {
+        String::new()
+    } else {
+        match wzp_crypto::Seed::from_hex(&seed_hex) {
+            Ok(seed) => {
+                let id = seed.derive_identity();
+                id.public_identity().fingerprint.to_string()
+            }
+            Err(_) => String::new(),
+        }
+    };
+    env.new_string(&fp)
+        .map(|s| s.into_raw())
+        .unwrap_or(JObject::null().into_raw())
+}
+
 // ── Direct calling JNI functions ──
 
-/// Start persistent signaling connection to relay for direct calls.
-/// Returns 0 on success, -1 on error.
+// ── SignalManager JNI functions ──
+
+/// Opaque handle for SignalManager (separate from EngineHandle).
+struct SignalHandle {
+    mgr: crate::signal_mgr::SignalManager,
+}
+
+unsafe fn signal_ref(handle: jlong) -> &'static SignalHandle {
+    unsafe { &*(handle as *const SignalHandle) }
+}
+
+/// Connect to relay for signaling. Returns handle (jlong) or 0 on error.
+/// Blocks up to 10s waiting for the internal signal thread to connect.
 #[unsafe(no_mangle)]
-pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeStartSignaling<'a>(
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalConnect<'a>(
     mut env: JNIEnv<'a>,
     _class: JClass,
-    handle: jlong,
-    relay_addr_j: JString,
-    seed_hex_j: JString,
-    token_j: JString,
-    alias_j: JString,
-) -> jint {
-    let result = panic::catch_unwind(panic::AssertUnwindSafe(|| {
-        let h = unsafe { handle_ref(handle) };
-        let relay_addr: String = env.get_string(&relay_addr_j).map(|s| s.into()).unwrap_or_default();
-        let seed_hex: String = env.get_string(&seed_hex_j).map(|s| s.into()).unwrap_or_default();
-        let token: String = env.get_string(&token_j).map(|s| s.into()).unwrap_or_default();
-        let alias: String = env.get_string(&alias_j).map(|s| s.into()).unwrap_or_default();
+    relay_j: JString,
+    seed_j: JString,
+) -> jlong {
+    info!("nativeSignalConnect: entered");
+    let relay: String = env.get_string(&relay_j).map(|s| s.into()).unwrap_or_default();
+    let seed: String = env.get_string(&seed_j).map(|s| s.into()).unwrap_or_default();
+    info!(relay = %relay, seed_len = seed.len(), "nativeSignalConnect: parsed strings");
 
-        h.engine.start_signaling(
-            &relay_addr,
-            &seed_hex,
-            if token.is_empty() { None } else { Some(&token) },
-            if alias.is_empty() { None } else { Some(&alias) },
-        )
-    }));
-
-    match result {
-        Ok(Ok(())) => 0,
-        Ok(Err(e)) => { error!("start_signaling failed: {e}"); -1 }
-        Err(_) => { error!("start_signaling panicked"); -1 }
+    // start() spawns an internal thread (connect+register+recv, ONE runtime, never dropped).
+    // Blocks up to 10s waiting for the connect+register to complete.
+    match crate::signal_mgr::SignalManager::start(&relay, &seed) {
+        Ok(mgr) => {
+            let handle = Box::new(SignalHandle { mgr });
+            Box::into_raw(handle) as jlong
+        }
+        Err(e) => {
+            error!("signal connect failed: {e}");
+            0
+        }
     }
 }
 
-/// Place a direct call to a target fingerprint.
-/// Returns 0 on success, -1 on error.
+/// Get signal state as JSON string.
 #[unsafe(no_mangle)]
-pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativePlaceCall<'a>(
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalGetState<'a>(
     mut env: JNIEnv<'a>,
     _class: JClass,
     handle: jlong,
-    target_fp_j: JString,
-) -> jint {
-    let result = panic::catch_unwind(panic::AssertUnwindSafe(|| {
-        let h = unsafe { handle_ref(handle) };
-        let target: String = env.get_string(&target_fp_j).map(|s| s.into()).unwrap_or_default();
-        h.engine.place_call(&target)
-    }));
+) -> jstring {
+    if handle == 0 { return JObject::null().into_raw(); }
+    let h = signal_ref(handle);
+    let json = h.mgr.get_state_json();
+    env.new_string(&json)
+        .map(|s| s.into_raw())
+        .unwrap_or(JObject::null().into_raw())
+}
 
-    match result {
-        Ok(Ok(())) => 0,
-        Ok(Err(e)) => { error!("place_call failed: {e}"); -1 }
-        Err(_) => { error!("place_call panicked"); -1 }
+/// Place a direct call.
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalPlaceCall<'a>(
+    mut env: JNIEnv<'a>,
+    _class: JClass,
+    handle: jlong,
+    target_j: JString,
+) -> jint {
+    if handle == 0 { return -1; }
+    let h = signal_ref(handle);
+    let target: String = env.get_string(&target_j).map(|s| s.into()).unwrap_or_default();
+    match h.mgr.place_call(&target) {
+        Ok(()) => 0,
+        Err(e) => { error!("place_call: {e}"); -1 }
     }
 }
 
-/// Answer an incoming direct call.
-/// mode: 0=Reject, 1=AcceptTrusted, 2=AcceptGeneric
+/// Answer an incoming call.
 #[unsafe(no_mangle)]
-pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeAnswerCall<'a>(
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalAnswerCall<'a>(
     mut env: JNIEnv<'a>,
     _class: JClass,
     handle: jlong,
     call_id_j: JString,
     mode: jint,
 ) -> jint {
-    let result = panic::catch_unwind(panic::AssertUnwindSafe(|| {
-        let h = unsafe { handle_ref(handle) };
-        let call_id: String = env.get_string(&call_id_j).map(|s| s.into()).unwrap_or_default();
-        let accept_mode = match mode {
-            0 => wzp_proto::CallAcceptMode::Reject,
-            1 => wzp_proto::CallAcceptMode::AcceptTrusted,
-            _ => wzp_proto::CallAcceptMode::AcceptGeneric,
-        };
-        h.engine.answer_call(&call_id, accept_mode)
-    }));
-
-    match result {
-        Ok(Ok(())) => 0,
-        Ok(Err(e)) => { error!("answer_call failed: {e}"); -1 }
-        Err(_) => { error!("answer_call panicked"); -1 }
+    if handle == 0 { return -1; }
+    let h = signal_ref(handle);
+    let call_id: String = env.get_string(&call_id_j).map(|s| s.into()).unwrap_or_default();
+    let accept_mode = match mode {
+        0 => wzp_proto::CallAcceptMode::Reject,
+        1 => wzp_proto::CallAcceptMode::AcceptTrusted,
+        _ => wzp_proto::CallAcceptMode::AcceptGeneric,
+    };
+    match h.mgr.answer_call(&call_id, accept_mode) {
+        Ok(()) => 0,
+        Err(e) => { error!("answer_call: {e}"); -1 }
     }
 }
+
+/// Send hangup signal.
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalHangup(
+    _env: JNIEnv,
+    _class: JClass,
+    handle: jlong,
+) {
+    if handle == 0 { return; }
+    let h = signal_ref(handle);
+    h.mgr.hangup();
+}
+
+/// Destroy the signal manager and free resources.
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn Java_com_wzp_engine_SignalManager_nativeSignalDestroy(
+    _env: JNIEnv,
+    _class: JClass,
+    handle: jlong,
+) {
+    if handle == 0 { return; }
+    let h = signal_ref(handle);
+    h.mgr.stop();
+    // Reclaim the Box
+    let _ = unsafe { Box::from_raw(handle as *mut SignalHandle) };
+}

crates/wzp-android/src/lib.rs

@@ -8,24 +8,12 @@
 //!
 //! On non-Android targets, the Oboe C++ layer compiles as a stub,
 //! allowing `cargo check` and unit tests on the host.
-//!
-//! ## Status
-//!
-//! **Dead code as of the Tauri mobile rewrite.** The legacy Kotlin+JNI
-//! Android app that consumed this crate was replaced by a Tauri 2.x
-//! Mobile app (see `desktop/src-tauri/src/engine.rs` for the live
-//! Android audio recv path and `crates/wzp-native/` for the Oboe
-//! bridge). We keep this crate in the workspace for reference and to
-//! preserve the commit history, but it is not built by any shipping
-//! target. Allow the accumulated leftover warnings so CI/workspace
-//! checks stay clean — any real cleanup should happen as part of
-//! removing the crate entirely, not piecemeal.
-#![allow(dead_code, unused_imports, unused_variables, unused_mut)]
 
 pub mod audio_android;
 pub mod audio_ring;
 pub mod commands;
 pub mod engine;
 pub mod pipeline;
+pub mod signal_mgr;
 pub mod stats;
 pub mod jni_bridge;

crates/wzp-android/src/signal_mgr.rs

@@ -0,0 +1,288 @@
+//! Persistent signal connection manager for direct 1:1 calls.
+//!
+//! Separate from the media engine — survives across calls.
+//! Connects to relay via `_signal` SNI, registers presence,
+//! and handles call signaling (offer/answer/setup/hangup).
+
+use std::net::SocketAddr;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use tracing::{error, info, warn};
+use wzp_proto::{MediaTransport, SignalMessage};
+
+/// Signal connection status.
+#[derive(Clone, Debug, Default, serde::Serialize)]
+pub struct SignalState {
+    pub status: String, // "idle", "registered", "ringing", "incoming", "setup"
+    pub fingerprint: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub incoming_call_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub incoming_caller_fp: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub incoming_caller_alias: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub call_setup_relay: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub call_setup_room: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub call_setup_id: Option<String>,
+}
+
+/// Manages a persistent `_signal` QUIC connection to a relay.
+pub struct SignalManager {
+    transport: Arc<wzp_transport::QuinnTransport>,
+    state: Arc<Mutex<SignalState>>,
+    running: Arc<AtomicBool>,
+}
+
+impl SignalManager {
+    /// Create SignalManager and start connect+register+recv on a background thread.
+    /// Returns immediately. The internal thread runs forever.
+    /// CRITICAL: tokio runtime must never be dropped on Android (libcrypto TLS conflict).
+    pub fn start(relay_addr: &str, seed_hex: &str) -> Result<Self, anyhow::Error> {
+        let addr: SocketAddr = relay_addr.parse()?;
+        let seed = if seed_hex.is_empty() {
+            wzp_crypto::Seed::generate()
+        } else {
+            wzp_crypto::Seed::from_hex(seed_hex).map_err(|e| anyhow::anyhow!(e))?
+        };
+        let identity = seed.derive_identity();
+        let pub_id = identity.public_identity();
+        let identity_pub = *pub_id.signing.as_bytes();
+        let fp = pub_id.fingerprint.to_string();
+
+        let state = Arc::new(Mutex::new(SignalState {
+            status: "connecting".into(),
+            fingerprint: fp.clone(),
+            ..Default::default()
+        }));
+        let running = Arc::new(AtomicBool::new(true));
+
+        // Channel to receive transport after connect succeeds
+        let (transport_tx, transport_rx) = std::sync::mpsc::channel();
+
+        let bg_state = Arc::clone(&state);
+        let bg_running = Arc::clone(&running);
+        let ret_state = Arc::clone(&state);
+        let ret_running = Arc::clone(&running);
+
+        // ONE thread, ONE runtime, NEVER dropped.
+        // Connect + register + recv loop all happen here.
+        std::thread::Builder::new()
+            .name("wzp-signal".into())
+            .stack_size(4 * 1024 * 1024)
+            .spawn(move || {
+                let rt = tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                    .expect("tokio runtime");
+
+                rt.block_on(async move {
+                    info!(fingerprint = %fp, relay = %addr, "signal: connecting");
+
+                    let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
+                    let endpoint = match wzp_transport::create_endpoint(bind, None) {
+                        Ok(e) => e,
+                        Err(e) => {
+                            error!("signal endpoint: {e}");
+                            bg_state.lock().unwrap().status = "idle".into();
+                            return;
+                        }
+                    };
+                    let client_cfg = wzp_transport::client_config();
+                    let conn = match wzp_transport::connect(&endpoint, addr, "_signal", client_cfg).await {
+                        Ok(c) => c,
+                        Err(e) => {
+                            error!("signal connect: {e}");
+                            bg_state.lock().unwrap().status = "idle".into();
+                            return;
+                        }
+                    };
+                    let transport = Arc::new(wzp_transport::QuinnTransport::new(conn));
+
+                    // Register
+                    if let Err(e) = transport.send_signal(&SignalMessage::RegisterPresence {
+                        identity_pub, signature: vec![], alias: None,
+                    }).await {
+                        error!("signal register: {e}");
+                        bg_state.lock().unwrap().status = "idle".into();
+                        return;
+                    }
+
+                    match transport.recv_signal().await {
+                        Ok(Some(SignalMessage::RegisterPresenceAck { success: true, .. })) => {
+                            info!(fingerprint = %fp, "signal: registered");
+                            bg_state.lock().unwrap().status = "registered".into();
+                            // Send transport to caller
+                            let _ = transport_tx.send(transport.clone());
+                        }
+                        other => {
+                            error!("signal registration failed: {other:?}");
+                            bg_state.lock().unwrap().status = "idle".into();
+                            return;
+                        }
+                    }
+
+                    // Recv loop — runs forever
+            loop {
+                if !running.load(Ordering::Relaxed) { break; }
+
+                match transport.recv_signal().await {
+                    Ok(Some(SignalMessage::CallRinging { call_id })) => {
+                        info!(call_id = %call_id, "signal: ringing");
+                        let mut s = state.lock().unwrap();
+                        s.status = "ringing".into();
+                    }
+                    Ok(Some(SignalMessage::DirectCallOffer { caller_fingerprint, caller_alias, call_id, .. })) => {
+                        info!(from = %caller_fingerprint, call_id = %call_id, "signal: incoming call");
+                        let mut s = state.lock().unwrap();
+                        s.status = "incoming".into();
+                        s.incoming_call_id = Some(call_id);
+                        s.incoming_caller_fp = Some(caller_fingerprint);
+                        s.incoming_caller_alias = caller_alias;
+                    }
+                    Ok(Some(SignalMessage::DirectCallAnswer { call_id, accept_mode, .. })) => {
+                        info!(call_id = %call_id, mode = ?accept_mode, "signal: call answered");
+                    }
+                    Ok(Some(SignalMessage::CallSetup { call_id, room, relay_addr })) => {
+                        info!(call_id = %call_id, room = %room, relay = %relay_addr, "signal: call setup");
+                        let mut s = state.lock().unwrap();
+                        s.status = "setup".into();
+                        s.call_setup_relay = Some(relay_addr);
+                        s.call_setup_room = Some(room);
+                        s.call_setup_id = Some(call_id);
+                    }
+                    Ok(Some(SignalMessage::Hangup { reason })) => {
+                        info!(reason = ?reason, "signal: hangup");
+                        let mut s = state.lock().unwrap();
+                        s.status = "registered".into();
+                        s.incoming_call_id = None;
+                        s.incoming_caller_fp = None;
+                        s.incoming_caller_alias = None;
+                        s.call_setup_relay = None;
+                        s.call_setup_room = None;
+                        s.call_setup_id = None;
+                    }
+                    Ok(Some(_)) => {}
+                    Ok(None) => {
+                        info!("signal: connection closed");
+                        break;
+                    }
+                    Err(e) => {
+                        error!("signal recv error: {e}");
+                        break;
+                    }
+                }
+            }
+
+            bg_state.lock().unwrap().status = "idle".into();
+                }); // block_on
+
+                // Runtime intentionally NOT dropped — lives until thread exits.
+                // This prevents ring/libcrypto TLS cleanup conflict on Android.
+                // The thread is parked here forever (block_on returned = connection lost).
+                std::thread::park();
+            })?; // thread spawn
+
+        // Wait for transport (up to 10s)
+        let transport = transport_rx.recv_timeout(std::time::Duration::from_secs(10))
+            .map_err(|_| anyhow::anyhow!("signal connect timeout — check relay address"))?;
+
+        Ok(Self { transport, state: ret_state, running: ret_running })
+    }
+
+    /// Get current state (non-blocking).
+    pub fn get_state(&self) -> SignalState {
+        self.state.lock().unwrap().clone()
+    }
+
+    /// Get state as JSON string.
+    pub fn get_state_json(&self) -> String {
+        serde_json::to_string(&self.get_state()).unwrap_or_else(|_| "{}".into())
+    }
+
+    /// Place a direct call.
+    pub fn place_call(&self, target_fp: &str) -> Result<(), anyhow::Error> {
+        let fp = self.state.lock().unwrap().fingerprint.clone();
+        let target = target_fp.to_string();
+        let call_id = format!("{:016x}", std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos());
+        let transport = self.transport.clone();
+
+        // Send on a small thread (async send needs a runtime)
+        std::thread::Builder::new()
+            .name("wzp-call-send".into())
+            .spawn(move || {
+                let rt = tokio::runtime::Builder::new_current_thread()
+                    .enable_all().build().expect("rt");
+                rt.block_on(async {
+                    let _ = transport.send_signal(&SignalMessage::DirectCallOffer {
+                        caller_fingerprint: fp,
+                        caller_alias: None,
+                        target_fingerprint: target,
+                        call_id,
+                        identity_pub: [0u8; 32],
+                        ephemeral_pub: [0u8; 32],
+                        signature: vec![],
+                        supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
+                    }).await;
+                });
+            })?;
+        Ok(())
+    }
+
+    /// Answer an incoming call.
+    pub fn answer_call(&self, call_id: &str, mode: wzp_proto::CallAcceptMode) -> Result<(), anyhow::Error> {
+        let call_id = call_id.to_string();
+        let transport = self.transport.clone();
+
+        std::thread::Builder::new()
+            .name("wzp-answer-send".into())
+            .spawn(move || {
+                let rt = tokio::runtime::Builder::new_current_thread()
+                    .enable_all().build().expect("rt");
+                rt.block_on(async {
+                    let _ = transport.send_signal(&SignalMessage::DirectCallAnswer {
+                        call_id,
+                        accept_mode: mode,
+                        identity_pub: None,
+                        ephemeral_pub: None,
+                        signature: None,
+                        chosen_profile: Some(wzp_proto::QualityProfile::GOOD),
+                    }).await;
+                });
+            })?;
+        Ok(())
+    }
+
+    /// Send hangup.
+    pub fn hangup(&self) {
+        let transport = self.transport.clone();
+        let state = self.state.clone();
+        std::thread::spawn(move || {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all().build().expect("rt");
+            rt.block_on(async {
+                let _ = transport.send_signal(&SignalMessage::Hangup {
+                    reason: wzp_proto::HangupReason::Normal,
+                }).await;
+            });
+            let mut s = state.lock().unwrap();
+            s.status = "registered".into();
+            s.incoming_call_id = None;
+            s.incoming_caller_fp = None;
+            s.incoming_caller_alias = None;
+            s.call_setup_relay = None;
+            s.call_setup_room = None;
+            s.call_setup_id = None;
+        });
+    }
+
+    /// Stop the signal connection.
+    pub fn stop(&self) {
+        self.running.store(false, Ordering::Release);
+        self.transport.connection().close(0u32.into(), b"shutdown");
+    }
+}

crates/wzp-client/Cargo.toml

@@ -23,77 +23,10 @@ serde_json = "1"
 chrono = "0.4"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 cpal = { version = "0.15", optional = true }
-libc = "0.2"
-# Phase 5.5 — LAN host-candidate ICE: enumerate local network
-# interface addresses for inclusion in DirectCallOffer/Answer so
-# peers on the same LAN can direct-connect without NAT hairpinning
-# through the WAN reflex addr (which many consumer NATs, including
-# MikroTik's default masquerade, don't support).
-if-addrs = "0.13"
-
-# coreaudio-rs is Apple-framework-only; gate it to macOS so enabling
-# the `vpio` feature from a non-macOS target builds cleanly instead of
-# pulling in a crate that can only link against Apple frameworks.
-[target.'cfg(target_os = "macos")'.dependencies]
-coreaudio-rs = { version = "0.11", optional = true }
-
-# Windows-only: direct WASAPI bindings for the `windows-aec` feature.
-# `windows` is Microsoft's official Rust COM bindings crate. We pull in
-# only the audio + COM subfeatures we need — the crate is organized as
-# a massive optional-feature tree, so enabling just these keeps compile
-# times reasonable (~5s for these features vs ~60s for the full crate).
-[target.'cfg(target_os = "windows")'.dependencies]
-windows = { version = "0.58", optional = true, features = [
-    "Win32_Foundation",
-    "Win32_Media_Audio",
-    "Win32_Security",
-    "Win32_System_Com",
-    "Win32_System_Com_StructuredStorage",
-    "Win32_System_Threading",
-    "Win32_System_Variant",
-] }
-
-# Linux-only: WebRTC AEC (Audio Processing Module) bindings for the
-# `linux-aec` feature. This is the 0.3.x line of the `tonarino/
-# webrtc-audio-processing` crate, which links against Debian's
-# `libwebrtc-audio-processing-dev` apt package (0.3-1+b1 on Bookworm).
-#
-# Note: we attempted the 2.x line with its `bundled` sub-feature first
-# (which would give us AEC3 instead of AEC2), but both the crates.io
-# tarball AND the upstream git `main` branch of webrtc-audio-processing-sys
-# 2.0.3 hit a `meson setup --reconfigure` bug where the build.rs passes
-# --reconfigure unconditionally even on first-run empty build dirs,
-# causing the bundled build to fail with "Directory does not contain a
-# valid build tree". The 0.x line doesn't use bundled mode and sidesteps
-# this entirely by linking the apt-provided library. AEC2 is older than
-# AEC3 but still the same algorithm family — this is what PulseAudio's
-# module-echo-cancel and PipeWire's filter-chain use by default on
-# current Debian-family distros.
-[target.'cfg(target_os = "linux")'.dependencies]
-webrtc-audio-processing = { version = "0.3", optional = true }
 
 [features]
 default = []
 audio = ["cpal"]
-# vpio enables coreaudio-rs but that dep is itself gated to macOS above,
-# so enabling this feature on Windows/Linux is a no-op (the audio_vpio
-# module is also #[cfg(target_os = "macos")] in lib.rs).
-vpio = ["dep:coreaudio-rs"]
-# windows-aec enables a direct WASAPI capture backend that opens the
-# microphone under AudioCategory_Communications, turning on Windows's
-# OS-level communications audio processing (AEC + noise suppression +
-# AGC). The `windows` dep is itself target-gated to Windows above, so
-# enabling this feature on non-Windows targets is a no-op (the
-# audio_wasapi module is also #[cfg(target_os = "windows")] in lib.rs).
-windows-aec = ["dep:windows"]
-# linux-aec enables a CPAL + WebRTC AEC3 capture/playback backend that
-# runs the WebRTC Audio Processing Module (same algo as Chrome / Zoom /
-# Teams) in-process, using the playback PCM as the reference signal for
-# echo cancellation. The webrtc-audio-processing dep is target-gated to
-# Linux above, so enabling this feature on non-Linux targets is a no-op
-# (the audio_linux_aec module is also #[cfg(target_os = "linux")] in
-# lib.rs).
-linux-aec = ["dep:webrtc-audio-processing"]
 
 [[bin]]
 name = "wzp-client"

crates/wzp-client/src/audio_io.rs

@@ -3,10 +3,12 @@
 //! Both structs use 48 kHz, mono, i16 format to match the WarzonePhone codec
 //! pipeline. Frames are 960 samples (20 ms at 48 kHz).
 //!
-//! Audio callbacks are **lock-free**: they read/write directly to an `AudioRing`
-//! (atomic SPSC ring buffer). No Mutex, no channel, no allocation on the hot path.
+//! The cpal `Stream` type is not `Send`, so each struct spawns a dedicated OS
+//! thread that owns the stream. The public API exposes only `Send + Sync`
+//! channel handles.
 
 use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc;
 use std::sync::Arc;
 
 use anyhow::{anyhow, Context};
@@ -14,8 +16,6 @@ use cpal::traits::{DeviceTrait, HostTrait, StreamTrait};
 use cpal::{SampleFormat, SampleRate, StreamConfig};
 use tracing::{info, warn};
 
-use crate::audio_ring::AudioRing;
-
 /// Number of samples per 20 ms frame at 48 kHz mono.
 pub const FRAME_SAMPLES: usize = 960;
 
@@ -23,25 +23,23 @@ pub const FRAME_SAMPLES: usize = 960;
 // AudioCapture
 // ---------------------------------------------------------------------------
 
-/// Captures microphone input via CPAL and writes PCM into a lock-free ring buffer.
+/// Captures microphone input and yields 960-sample PCM frames.
 ///
 /// The cpal stream lives on a dedicated OS thread; this handle is `Send + Sync`.
 pub struct AudioCapture {
-    ring: Arc<AudioRing>,
+    rx: mpsc::Receiver<Vec<i16>>,
     running: Arc<AtomicBool>,
 }
 
 impl AudioCapture {
     /// Create and start capturing from the default input device at 48 kHz mono.
     pub fn start() -> Result<Self, anyhow::Error> {
-        let ring = Arc::new(AudioRing::new());
+        let (tx, rx) = mpsc::sync_channel::<Vec<i16>>(64);
         let running = Arc::new(AtomicBool::new(true));
-
-        let (init_tx, init_rx) = std::sync::mpsc::sync_channel::<Result<(), String>>(1);
-
-        let ring_cb = ring.clone();
         let running_clone = running.clone();
 
+        let (init_tx, init_rx) = mpsc::sync_channel::<Result<(), String>>(1);
+
         std::thread::Builder::new()
             .name("wzp-audio-capture".into())
             .spawn(move || {
@@ -61,51 +59,53 @@ impl AudioCapture {
 
                     let use_f32 = !supports_i16_input(&device)?;
 
+                    let buf = Arc::new(std::sync::Mutex::new(
+                        Vec::<i16>::with_capacity(FRAME_SAMPLES),
+                    ));
                     let err_cb = |e: cpal::StreamError| {
                         warn!("input stream error: {e}");
                     };
 
-                    let logged_cb_size = Arc::new(AtomicBool::new(false));
-
                     let stream = if use_f32 {
-                        let ring = ring_cb.clone();
+                        let buf = buf.clone();
+                        let tx = tx.clone();
                         let running = running_clone.clone();
-                        let logged = logged_cb_size.clone();
                         device.build_input_stream(
                             &config,
                             move |data: &[f32], _: &cpal::InputCallbackInfo| {
                                 if !running.load(Ordering::Relaxed) {
                                     return;
                                 }
-                                if !logged.swap(true, Ordering::Relaxed) {
-                                    eprintln!("[audio] capture callback: {} f32 samples", data.len());
-                                }
-                                let mut tmp = [0i16; FRAME_SAMPLES];
-                                for chunk in data.chunks(FRAME_SAMPLES) {
-                                    let n = chunk.len();
-                                    for i in 0..n {
-                                        tmp[i] = f32_to_i16(chunk[i]);
+                                let mut lock = buf.lock().unwrap();
+                                for &s in data {
+                                    lock.push(f32_to_i16(s));
+                                    if lock.len() == FRAME_SAMPLES {
+                                        let frame = lock.drain(..).collect();
+                                        let _ = tx.try_send(frame);
                                     }
-                                    ring.write(&tmp[..n]);
                                 }
                             },
                             err_cb,
                             None,
                         )?
                     } else {
-                        let ring = ring_cb.clone();
+                        let buf = buf.clone();
+                        let tx = tx.clone();
                         let running = running_clone.clone();
-                        let logged = logged_cb_size.clone();
                         device.build_input_stream(
                             &config,
                             move |data: &[i16], _: &cpal::InputCallbackInfo| {
                                 if !running.load(Ordering::Relaxed) {
                                     return;
                                 }
-                                if !logged.swap(true, Ordering::Relaxed) {
-                                    eprintln!("[audio] capture callback: {} i16 samples", data.len());
+                                let mut lock = buf.lock().unwrap();
+                                for &s in data {
+                                    lock.push(s);
+                                    if lock.len() == FRAME_SAMPLES {
+                                        let frame = lock.drain(..).collect();
+                                        let _ = tx.try_send(frame);
+                                    }
                                 }
-                                ring.write(data);
                             },
                             err_cb,
                             None,
@@ -114,6 +114,7 @@ impl AudioCapture {
 
                     stream.play().context("failed to start input stream")?;
 
+                    // Signal success to the caller before parking.
                     let _ = init_tx.send(Ok(()));
 
                     // Keep stream alive until stopped.
@@ -134,12 +135,15 @@ impl AudioCapture {
             .map_err(|_| anyhow!("capture thread exited before signaling"))?
             .map_err(|e| anyhow!("{e}"))?;
 
-        Ok(Self { ring, running })
+        Ok(Self { rx, running })
     }
 
-    /// Get a reference to the capture ring buffer for direct polling.
-    pub fn ring(&self) -> &Arc<AudioRing> {
-        &self.ring
+    /// Read the next frame of 960 PCM samples (blocking until available).
+    ///
+    /// Returns `None` when the stream has been stopped or the channel is
+    /// disconnected.
+    pub fn read_frame(&self) -> Option<Vec<i16>> {
+        self.rx.recv().ok()
     }
 
     /// Stop capturing.
@@ -148,35 +152,27 @@ impl AudioCapture {
     }
 }
 
-impl Drop for AudioCapture {
-    fn drop(&mut self) {
-        self.stop();
-    }
-}
-
 // ---------------------------------------------------------------------------
 // AudioPlayback
 // ---------------------------------------------------------------------------
 
-/// Plays PCM through the default output device, reading from a lock-free ring buffer.
+/// Plays PCM frames through the default output device at 48 kHz mono.
 ///
 /// The cpal stream lives on a dedicated OS thread; this handle is `Send + Sync`.
 pub struct AudioPlayback {
-    ring: Arc<AudioRing>,
+    tx: mpsc::SyncSender<Vec<i16>>,
     running: Arc<AtomicBool>,
 }
 
 impl AudioPlayback {
     /// Create and start playback on the default output device at 48 kHz mono.
     pub fn start() -> Result<Self, anyhow::Error> {
-        let ring = Arc::new(AudioRing::new());
+        let (tx, rx) = mpsc::sync_channel::<Vec<i16>>(64);
         let running = Arc::new(AtomicBool::new(true));
-
-        let (init_tx, init_rx) = std::sync::mpsc::sync_channel::<Result<(), String>>(1);
-
-        let ring_cb = ring.clone();
         let running_clone = running.clone();
 
+        let (init_tx, init_rx) = mpsc::sync_channel::<Result<(), String>>(1);
+
         std::thread::Builder::new()
             .name("wzp-audio-playback".into())
             .spawn(move || {
@@ -196,40 +192,62 @@ impl AudioPlayback {
 
                     let use_f32 = !supports_i16_output(&device)?;
 
+                    // Shared ring of samples the cpal callback drains from.
+                    let ring = Arc::new(std::sync::Mutex::new(
+                        std::collections::VecDeque::<i16>::with_capacity(FRAME_SAMPLES * 8),
+                    ));
+
+                    // Background drainer: moves frames from the mpsc channel into the ring.
+                    {
+                        let ring = ring.clone();
+                        let running = running_clone.clone();
+                        std::thread::Builder::new()
+                            .name("wzp-playback-drain".into())
+                            .spawn(move || {
+                                while running.load(Ordering::Relaxed) {
+                                    match rx.recv_timeout(std::time::Duration::from_millis(100)) {
+                                        Ok(frame) => {
+                                            let mut lock = ring.lock().unwrap();
+                                            lock.extend(frame);
+                                            while lock.len() > FRAME_SAMPLES * 16 {
+                                                lock.pop_front();
+                                            }
+                                        }
+                                        Err(mpsc::RecvTimeoutError::Timeout) => {}
+                                        Err(mpsc::RecvTimeoutError::Disconnected) => break,
+                                    }
+                                }
+                            })?;
+                    }
+
                     let err_cb = |e: cpal::StreamError| {
                         warn!("output stream error: {e}");
                     };
 
                     let stream = if use_f32 {
-                        let ring = ring_cb.clone();
+                        let ring = ring.clone();
                         device.build_output_stream(
                             &config,
                             move |data: &mut [f32], _: &cpal::OutputCallbackInfo| {
-                                let mut tmp = [0i16; FRAME_SAMPLES];
-                                for chunk in data.chunks_mut(FRAME_SAMPLES) {
-                                    let n = chunk.len();
-                                    let read = ring.read(&mut tmp[..n]);
-                                    for i in 0..read {
-                                        chunk[i] = i16_to_f32(tmp[i]);
-                                    }
-                                    // Fill remainder with silence if ring underran
-                                    for i in read..n {
-                                        chunk[i] = 0.0;
-                                    }
+                                let mut lock = ring.lock().unwrap();
+                                for sample in data.iter_mut() {
+                                    *sample = match lock.pop_front() {
+                                        Some(s) => i16_to_f32(s),
+                                        None => 0.0,
+                                    };
                                 }
                             },
                             err_cb,
                             None,
                         )?
                     } else {
-                        let ring = ring_cb.clone();
+                        let ring = ring.clone();
                         device.build_output_stream(
                             &config,
                             move |data: &mut [i16], _: &cpal::OutputCallbackInfo| {
-                                let read = ring.read(data);
-                                // Fill remainder with silence if ring underran
-                                for sample in &mut data[read..] {
-                                    *sample = 0;
+                                let mut lock = ring.lock().unwrap();
+                                for sample in data.iter_mut() {
+                                    *sample = lock.pop_front().unwrap_or(0);
                                 }
                             },
                             err_cb,
@@ -239,6 +257,7 @@ impl AudioPlayback {
 
                     stream.play().context("failed to start output stream")?;
 
+                    // Signal success to the caller before parking.
                     let _ = init_tx.send(Ok(()));
 
                     // Keep stream alive until stopped.
@@ -259,12 +278,12 @@ impl AudioPlayback {
             .map_err(|_| anyhow!("playback thread exited before signaling"))?
             .map_err(|e| anyhow!("{e}"))?;
 
-        Ok(Self { ring, running })
+        Ok(Self { tx, running })
     }
 
-    /// Get a reference to the playout ring buffer for direct writing.
-    pub fn ring(&self) -> &Arc<AudioRing> {
-        &self.ring
+    /// Write a frame of PCM samples for playback.
+    pub fn write_frame(&self, pcm: &[i16]) {
+        let _ = self.tx.try_send(pcm.to_vec());
     }
 
     /// Stop playback.
@@ -273,16 +292,11 @@ impl AudioPlayback {
     }
 }
 
-impl Drop for AudioPlayback {
-    fn drop(&mut self) {
-        self.stop();
-    }
-}
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
+/// Check if the input device supports i16 at 48 kHz mono.
 fn supports_i16_input(device: &cpal::Device) -> Result<bool, anyhow::Error> {
     let supported = device
         .supported_input_configs()
@@ -299,6 +313,7 @@ fn supports_i16_input(device: &cpal::Device) -> Result<bool, anyhow::Error> {
     Ok(false)
 }
 
+/// Check if the output device supports i16 at 48 kHz mono.
 fn supports_i16_output(device: &cpal::Device) -> Result<bool, anyhow::Error> {
     let supported = device
         .supported_output_configs()

crates/wzp-client/src/audio_linux_aec.rs

@@ -1,537 +0,0 @@
-//! Linux AEC backend: CPAL capture + playback wired through the WebRTC Audio
-//! Processing Module (AEC3 + noise suppression + high-pass filter).
-//!
-//! This is the same algorithm used by Chrome WebRTC, Zoom, Teams, Jitsi, and
-//! any other "serious" Linux VoIP app. It runs in-process — no dependency on
-//! PulseAudio's module-echo-cancel or PipeWire's filter-chain, so it works
-//! identically on ALSA / PulseAudio / PipeWire systems.
-//!
-//! ## Architecture
-//!
-//! A single module-level `Arc<Mutex<Processor>>` is shared between the
-//! capture and playback paths. On each 20 ms frame (960 samples @ 48 kHz
-//! mono):
-//!
-//! - **Playback path**: `LinuxAecPlayback::start` spawns the usual CPAL
-//!   output thread, but wraps each chunk in a call to
-//!   `Processor::process_render_frame` **before** handing it to CPAL. That
-//!   gives APM an authoritative reference of exactly what's going out to
-//!   the speakers (same approach Zoom/Teams/Jitsi use). The AEC then knows
-//!   what to cancel when it sees echo in the capture stream.
-//!
-//! - **Capture path**: `LinuxAecCapture::start` spawns the usual CPAL
-//!   input thread, and runs `Processor::process_capture_frame` on each
-//!   incoming mic chunk **in place** before pushing it into the ring
-//!   buffer. The AEC subtracts the echo using the render reference it
-//!   saw on the playback side.
-//!
-//! APM is strict about frame size: it requires exactly 10 ms = 480 samples
-//! per call at 48 kHz. Our pipeline uses 20 ms = 960 samples, so each 20 ms
-//! frame is split into two 480-sample halves, APM is called twice, and the
-//! halves are stitched back together.
-//!
-//! APM only accepts f32 samples in `[-1.0, 1.0]`, so we convert i16 → f32
-//! before the call and f32 → i16 after (with clamping on the return path).
-//!
-//! ## Stream delay
-//!
-//! AEC needs to know roughly how long it takes between a sample being passed
-//! to `process_render_frame` and its echo showing up at `process_capture_frame`
-//! — i.e. the round trip through CPAL playback → speaker → air → microphone
-//! → CPAL capture. AEC3's internal estimator tracks this within a window
-//! around whatever hint we give it. We hardcode 60 ms as a reasonable
-//! starting point for typical Linux audio stacks; the delay estimator does
-//! the fine-tuning automatically.
-//!
-//! ## Thread safety
-//!
-//! The 0.3.x line of `webrtc-audio-processing` takes `&mut self` on both
-//! `process_capture_frame` and `process_render_frame`, so the `Processor`
-//! needs a `Mutex` around it for cross-thread sharing. The capture and
-//! playback threads each acquire the lock briefly (sub-millisecond per
-//! 10 ms frame) so contention is minimal at our frame rates.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex, OnceLock};
-
-use anyhow::{anyhow, Context};
-use cpal::traits::{DeviceTrait, HostTrait, StreamTrait};
-use cpal::{SampleFormat, SampleRate, StreamConfig};
-use tracing::{info, warn};
-use webrtc_audio_processing::{
-    Config, EchoCancellation, EchoCancellationSuppressionLevel, InitializationConfig,
-    NoiseSuppression, NoiseSuppressionLevel, Processor, NUM_SAMPLES_PER_FRAME,
-};
-
-use crate::audio_ring::AudioRing;
-
-/// 20 ms at 48 kHz, mono — matches the rest of the pipeline and the codec.
-pub const FRAME_SAMPLES: usize = 960;
-/// APM requires strict 10 ms frames at 48 kHz = 480 samples per call.
-/// Imported from the webrtc-audio-processing crate so we can't drift out
-/// of sync with whatever sample rate / frame length the C++ lib is using.
-const APM_FRAME_SAMPLES: usize = NUM_SAMPLES_PER_FRAME as usize;
-const APM_NUM_CHANNELS: usize = 1;
-/// Round-trip delay hint passed to APM; the estimator refines from here.
-/// 60 ms is a reasonable default for CPAL on ALSA / PulseAudio / PipeWire.
-#[allow(dead_code)]
-const STREAM_DELAY_MS: i32 = 60;
-
-// ---------------------------------------------------------------------------
-// Shared APM instance
-// ---------------------------------------------------------------------------
-
-/// Module-level lazily-initialized APM. Shared between capture and playback
-/// so they operate on the same echo-cancellation state — the render frames
-/// pushed by playback are what the capture path subtracts from the mic input.
-/// Wrapped in a Mutex because the 0.3.x Processor takes `&mut self` on both
-/// process_capture_frame and process_render_frame.
-static PROCESSOR: OnceLock<Arc<Mutex<Processor>>> = OnceLock::new();
-
-fn get_or_init_processor() -> anyhow::Result<Arc<Mutex<Processor>>> {
-    if let Some(p) = PROCESSOR.get() {
-        return Ok(p.clone());
-    }
-    let init_config = InitializationConfig {
-        num_capture_channels: APM_NUM_CHANNELS as i32,
-        num_render_channels: APM_NUM_CHANNELS as i32,
-        ..Default::default()
-    };
-    let mut processor = Processor::new(&init_config)
-        .map_err(|e| anyhow!("webrtc APM init failed: {e:?}"))?;
-
-    let config = Config {
-        echo_cancellation: Some(EchoCancellation {
-            suppression_level: EchoCancellationSuppressionLevel::High,
-            stream_delay_ms: Some(STREAM_DELAY_MS),
-            enable_delay_agnostic: true,
-            enable_extended_filter: true,
-        }),
-        noise_suppression: Some(NoiseSuppression {
-            suppression_level: NoiseSuppressionLevel::High,
-        }),
-        enable_high_pass_filter: true,
-        // AGC left off for now — it can fight the Opus encoder's own gain
-        // staging and the adaptive-quality controller. Add later if users
-        // report low mic levels.
-        ..Default::default()
-    };
-    processor.set_config(config);
-
-    let arc = Arc::new(Mutex::new(processor));
-    let _ = PROCESSOR.set(arc.clone());
-    info!(
-        stream_delay_ms = STREAM_DELAY_MS,
-        "webrtc APM initialized (AEC High + NS High + HPF, AGC off)"
-    );
-    Ok(arc)
-}
-
-// ---------------------------------------------------------------------------
-// Helpers: i16 ↔ f32 and APM frame processing
-// ---------------------------------------------------------------------------
-
-#[inline]
-fn i16_to_f32(s: i16) -> f32 {
-    s as f32 / 32768.0
-}
-
-#[inline]
-fn f32_to_i16(s: f32) -> i16 {
-    (s.clamp(-1.0, 1.0) * 32767.0) as i16
-}
-
-/// Feed a 20 ms (960-sample) playback frame to APM as the render reference.
-/// Splits into two 10 ms halves because APM is strict about frame size.
-/// Takes the Mutex-wrapped Processor and locks briefly around each call.
-fn push_render_frame_20ms(apm: &Mutex<Processor>, pcm: &[i16]) {
-    debug_assert_eq!(pcm.len(), FRAME_SAMPLES);
-    let mut buf = [0f32; APM_FRAME_SAMPLES];
-    for half in pcm.chunks_exact(APM_FRAME_SAMPLES) {
-        for (i, &s) in half.iter().enumerate() {
-            buf[i] = i16_to_f32(s);
-        }
-        match apm.lock() {
-            Ok(mut p) => {
-                if let Err(e) = p.process_render_frame(&mut buf) {
-                    warn!("webrtc APM process_render_frame failed: {e:?}");
-                }
-            }
-            Err(_) => {
-                warn!("webrtc APM mutex poisoned in render path");
-                return;
-            }
-        }
-    }
-}
-
-/// Run a 20 ms (960-sample) capture frame through APM's echo cancellation
-/// in place. Splits into two 10 ms halves, runs APM on each, stitches
-/// results back into the caller's buffer. Briefly holds the Mutex once
-/// per 10 ms half.
-fn process_capture_frame_20ms(apm: &Mutex<Processor>, pcm: &mut [i16]) {
-    debug_assert_eq!(pcm.len(), FRAME_SAMPLES);
-    let mut buf = [0f32; APM_FRAME_SAMPLES];
-    for half in pcm.chunks_exact_mut(APM_FRAME_SAMPLES) {
-        for (i, &s) in half.iter().enumerate() {
-            buf[i] = i16_to_f32(s);
-        }
-        match apm.lock() {
-            Ok(mut p) => {
-                if let Err(e) = p.process_capture_frame(&mut buf) {
-                    warn!("webrtc APM process_capture_frame failed: {e:?}");
-                }
-            }
-            Err(_) => {
-                warn!("webrtc APM mutex poisoned in capture path");
-                return;
-            }
-        }
-        for (i, d) in half.iter_mut().enumerate() {
-            *d = f32_to_i16(buf[i]);
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// LinuxAecCapture — CPAL mic + WebRTC AEC capture-side processing
-// ---------------------------------------------------------------------------
-
-/// Microphone capture with WebRTC AEC3 applied in place before the codec
-/// sees the samples. Mirrors the public API of `audio_io::AudioCapture` so
-/// downstream code doesn't change.
-pub struct LinuxAecCapture {
-    ring: Arc<AudioRing>,
-    running: Arc<AtomicBool>,
-}
-
-impl LinuxAecCapture {
-    pub fn start() -> Result<Self, anyhow::Error> {
-        // Eagerly init the APM so the playback side can find it already
-        // configured, and so init errors surface on the caller thread
-        // instead of silently failing inside the capture thread.
-        let apm = get_or_init_processor()?;
-
-        let ring = Arc::new(AudioRing::new());
-        let running = Arc::new(AtomicBool::new(true));
-
-        let (init_tx, init_rx) = std::sync::mpsc::sync_channel::<Result<(), String>>(1);
-
-        let ring_cb = ring.clone();
-        let running_clone = running.clone();
-        let apm_capture = apm.clone();
-
-        std::thread::Builder::new()
-            .name("wzp-audio-capture-linuxaec".into())
-            .spawn(move || {
-                let result = (|| -> Result<(), anyhow::Error> {
-                    let host = cpal::default_host();
-                    let device = host
-                        .default_input_device()
-                        .ok_or_else(|| anyhow!("no default input audio device found"))?;
-                    info!(device = %device.name().unwrap_or_default(), "LinuxAEC: using input device");
-
-                    let config = StreamConfig {
-                        channels: 1,
-                        sample_rate: SampleRate(48_000),
-                        buffer_size: cpal::BufferSize::Default,
-                    };
-
-                    let use_f32 = !supports_i16_input(&device)?;
-
-                    let err_cb = |e: cpal::StreamError| {
-                        warn!("LinuxAEC input stream error: {e}");
-                    };
-
-                    // Leftover buffer for when CPAL gives us partial frames.
-                    // We need exactly 960-sample chunks to feed APM.
-                    let leftover = std::sync::Mutex::new(Vec::<i16>::with_capacity(FRAME_SAMPLES * 4));
-
-                    let stream = if use_f32 {
-                        let ring = ring_cb.clone();
-                        let running = running_clone.clone();
-                        let apm = apm_capture.clone();
-                        device.build_input_stream(
-                            &config,
-                            move |data: &[f32], _: &cpal::InputCallbackInfo| {
-                                if !running.load(Ordering::Relaxed) {
-                                    return;
-                                }
-                                let mut lv = leftover.lock().unwrap();
-                                lv.reserve(data.len());
-                                for &s in data {
-                                    lv.push(f32_to_i16(s));
-                                }
-                                drain_frames_through_apm(&mut lv, &apm, &ring);
-                            },
-                            err_cb,
-                            None,
-                        )?
-                    } else {
-                        let ring = ring_cb.clone();
-                        let running = running_clone.clone();
-                        let apm = apm_capture.clone();
-                        device.build_input_stream(
-                            &config,
-                            move |data: &[i16], _: &cpal::InputCallbackInfo| {
-                                if !running.load(Ordering::Relaxed) {
-                                    return;
-                                }
-                                let mut lv = leftover.lock().unwrap();
-                                lv.extend_from_slice(data);
-                                drain_frames_through_apm(&mut lv, &apm, &ring);
-                            },
-                            err_cb,
-                            None,
-                        )?
-                    };
-
-                    stream.play().context("failed to start LinuxAEC input stream")?;
-                    let _ = init_tx.send(Ok(()));
-                    info!("LinuxAEC capture started (AEC3 active)");
-
-                    while running_clone.load(Ordering::Relaxed) {
-                        std::thread::park_timeout(std::time::Duration::from_millis(200));
-                    }
-                    drop(stream);
-                    Ok(())
-                })();
-
-                if let Err(e) = result {
-                    let _ = init_tx.send(Err(e.to_string()));
-                }
-            })?;
-
-        init_rx
-            .recv()
-            .map_err(|_| anyhow!("LinuxAEC capture thread exited before signaling"))?
-            .map_err(|e| anyhow!("{e}"))?;
-
-        Ok(Self { ring, running })
-    }
-
-    pub fn ring(&self) -> &Arc<AudioRing> {
-        &self.ring
-    }
-
-    pub fn stop(&self) {
-        self.running.store(false, Ordering::Relaxed);
-    }
-}
-
-impl Drop for LinuxAecCapture {
-    fn drop(&mut self) {
-        self.stop();
-    }
-}
-
-/// Pull whole 960-sample frames out of the leftover buffer, run them through
-/// APM's capture-side processing, and push to the ring. Leaves any partial
-/// sub-960 remainder in `leftover` for the next callback.
-fn drain_frames_through_apm(leftover: &mut Vec<i16>, apm: &Mutex<Processor>, ring: &AudioRing) {
-    let mut frame = [0i16; FRAME_SAMPLES];
-    while leftover.len() >= FRAME_SAMPLES {
-        frame.copy_from_slice(&leftover[..FRAME_SAMPLES]);
-        process_capture_frame_20ms(apm, &mut frame);
-        ring.write(&frame);
-        leftover.drain(..FRAME_SAMPLES);
-    }
-}
-
-// ---------------------------------------------------------------------------
-// LinuxAecPlayback — CPAL speaker output + WebRTC AEC render-side tee
-// ---------------------------------------------------------------------------
-
-/// Speaker playback with a render-side tee: each frame written to CPAL is
-/// ALSO fed to APM via `process_render_frame` as the echo-cancellation
-/// reference signal. This is the "tee the playback ring" approach (Zoom,
-/// Teams, Jitsi) — deterministic, does not depend on PulseAudio loopback or
-/// PipeWire monitor sources.
-pub struct LinuxAecPlayback {
-    ring: Arc<AudioRing>,
-    running: Arc<AtomicBool>,
-}
-
-impl LinuxAecPlayback {
-    pub fn start() -> Result<Self, anyhow::Error> {
-        let apm = get_or_init_processor()?;
-
-        let ring = Arc::new(AudioRing::new());
-        let running = Arc::new(AtomicBool::new(true));
-
-        let (init_tx, init_rx) = std::sync::mpsc::sync_channel::<Result<(), String>>(1);
-
-        let ring_cb = ring.clone();
-        let running_clone = running.clone();
-        let apm_render = apm.clone();
-
-        std::thread::Builder::new()
-            .name("wzp-audio-playback-linuxaec".into())
-            .spawn(move || {
-                let result = (|| -> Result<(), anyhow::Error> {
-                    let host = cpal::default_host();
-                    let device = host
-                        .default_output_device()
-                        .ok_or_else(|| anyhow!("no default output audio device found"))?;
-                    info!(device = %device.name().unwrap_or_default(), "LinuxAEC: using output device");
-
-                    let config = StreamConfig {
-                        channels: 1,
-                        sample_rate: SampleRate(48_000),
-                        buffer_size: cpal::BufferSize::Default,
-                    };
-
-                    let use_f32 = !supports_i16_output(&device)?;
-
-                    let err_cb = |e: cpal::StreamError| {
-                        warn!("LinuxAEC output stream error: {e}");
-                    };
-
-                    // Same 960-sample batching approach as the capture side:
-                    // CPAL may ask for N samples in a callback where N doesn't
-                    // divide 960. We accumulate partial frames in a Vec and
-                    // feed APM as soon as we have a whole 20 ms frame.
-                    let carry = std::sync::Mutex::new(Vec::<i16>::with_capacity(FRAME_SAMPLES * 4));
-
-                    let stream = if use_f32 {
-                        let ring = ring_cb.clone();
-                        let apm = apm_render.clone();
-                        device.build_output_stream(
-                            &config,
-                            move |data: &mut [f32], _: &cpal::OutputCallbackInfo| {
-                                fill_output_and_tee_f32(data, &ring, &apm, &carry);
-                            },
-                            err_cb,
-                            None,
-                        )?
-                    } else {
-                        let ring = ring_cb.clone();
-                        let apm = apm_render.clone();
-                        device.build_output_stream(
-                            &config,
-                            move |data: &mut [i16], _: &cpal::OutputCallbackInfo| {
-                                fill_output_and_tee_i16(data, &ring, &apm, &carry);
-                            },
-                            err_cb,
-                            None,
-                        )?
-                    };
-
-                    stream.play().context("failed to start LinuxAEC output stream")?;
-                    let _ = init_tx.send(Ok(()));
-                    info!("LinuxAEC playback started (render tee active)");
-
-                    while running_clone.load(Ordering::Relaxed) {
-                        std::thread::park_timeout(std::time::Duration::from_millis(200));
-                    }
-                    drop(stream);
-                    Ok(())
-                })();
-
-                if let Err(e) = result {
-                    let _ = init_tx.send(Err(e.to_string()));
-                }
-            })?;
-
-        init_rx
-            .recv()
-            .map_err(|_| anyhow!("LinuxAEC playback thread exited before signaling"))?
-            .map_err(|e| anyhow!("{e}"))?;
-
-        Ok(Self { ring, running })
-    }
-
-    pub fn ring(&self) -> &Arc<AudioRing> {
-        &self.ring
-    }
-
-    pub fn stop(&self) {
-        self.running.store(false, Ordering::Relaxed);
-    }
-}
-
-impl Drop for LinuxAecPlayback {
-    fn drop(&mut self) {
-        self.stop();
-    }
-}
-
-fn fill_output_and_tee_i16(
-    data: &mut [i16],
-    ring: &AudioRing,
-    apm: &Mutex<Processor>,
-    carry: &std::sync::Mutex<Vec<i16>>,
-) {
-    let read = ring.read(data);
-    for s in &mut data[read..] {
-        *s = 0;
-    }
-    tee_render_samples(data, apm, carry);
-}
-
-fn fill_output_and_tee_f32(
-    data: &mut [f32],
-    ring: &AudioRing,
-    apm: &Mutex<Processor>,
-    carry: &std::sync::Mutex<Vec<i16>>,
-) {
-    let mut tmp = vec![0i16; data.len()];
-    let read = ring.read(&mut tmp);
-    for s in &mut tmp[read..] {
-        *s = 0;
-    }
-    for (d, &s) in data.iter_mut().zip(tmp.iter()) {
-        *d = i16_to_f32(s);
-    }
-    tee_render_samples(&tmp, apm, carry);
-}
-
-/// Push CPAL-bound samples into APM's render-side input for echo cancellation.
-/// Uses a carry buffer to batch into exact 960-sample (20 ms) frames.
-fn tee_render_samples(samples: &[i16], apm: &Mutex<Processor>, carry: &std::sync::Mutex<Vec<i16>>) {
-    let mut lv = carry.lock().unwrap();
-    lv.extend_from_slice(samples);
-    while lv.len() >= FRAME_SAMPLES {
-        let mut frame = [0i16; FRAME_SAMPLES];
-        frame.copy_from_slice(&lv[..FRAME_SAMPLES]);
-        push_render_frame_20ms(apm, &frame);
-        lv.drain(..FRAME_SAMPLES);
-    }
-}
-
-// ---------------------------------------------------------------------------
-// CPAL format helpers (duplicated from audio_io.rs to keep the modules
-// independent — each backend file is a self-contained unit)
-// ---------------------------------------------------------------------------
-
-fn supports_i16_input(device: &cpal::Device) -> Result<bool, anyhow::Error> {
-    let supported = device
-        .supported_input_configs()
-        .context("failed to query input configs")?;
-    for cfg in supported {
-        if cfg.sample_format() == SampleFormat::I16
-            && cfg.min_sample_rate() <= SampleRate(48_000)
-            && cfg.max_sample_rate() >= SampleRate(48_000)
-            && cfg.channels() >= 1
-        {
-            return Ok(true);
-        }
-    }
-    Ok(false)
-}
-
-fn supports_i16_output(device: &cpal::Device) -> Result<bool, anyhow::Error> {
-    let supported = device
-        .supported_output_configs()
-        .context("failed to query output configs")?;
-    for cfg in supported {
-        if cfg.sample_format() == SampleFormat::I16
-            && cfg.min_sample_rate() <= SampleRate(48_000)
-            && cfg.max_sample_rate() >= SampleRate(48_000)
-            && cfg.channels() >= 1
-        {
-            return Ok(true);
-        }
-    }
-    Ok(false)
-}

crates/wzp-client/src/audio_ring.rs

@@ -1,122 +0,0 @@
-//! Lock-free SPSC ring buffer — "Reader-Detects-Lap" architecture.
-//!
-//! SPSC invariant: the producer ONLY writes `write_pos`, the consumer
-//! ONLY writes `read_pos`.  Neither thread touches the other's cursor.
-//!
-//! On overflow (writer laps the reader), the writer simply overwrites
-//! old buffer data.  The reader detects the lap via `available() >
-//! RING_CAPACITY` and snaps its own `read_pos` forward.
-//!
-//! Capacity is a power of 2 for bitmask indexing (no modulo).
-
-use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
-
-/// Ring buffer capacity — power of 2 for bitmask indexing.
-/// 16384 samples = 341.3ms at 48kHz mono.
-const RING_CAPACITY: usize = 16384; // 2^14
-const RING_MASK: usize = RING_CAPACITY - 1;
-
-/// Lock-free single-producer single-consumer ring buffer for i16 PCM samples.
-pub struct AudioRing {
-    buf: Box<[i16]>,
-    /// Monotonically increasing write cursor. ONLY written by producer.
-    write_pos: AtomicUsize,
-    /// Monotonically increasing read cursor. ONLY written by consumer.
-    read_pos: AtomicUsize,
-    /// Incremented by reader when it detects it was lapped (overflow).
-    overflow_count: AtomicU64,
-    /// Incremented by reader when ring is empty (underrun).
-    underrun_count: AtomicU64,
-}
-
-// SAFETY: AudioRing is SPSC — one thread writes (producer), one reads (consumer).
-// The producer only writes write_pos. The consumer only writes read_pos.
-// Neither thread writes the other's cursor. Buffer indices are derived from
-// the owning thread's cursor, ensuring no concurrent access to the same index.
-unsafe impl Send for AudioRing {}
-unsafe impl Sync for AudioRing {}
-
-impl AudioRing {
-    pub fn new() -> Self {
-        debug_assert!(RING_CAPACITY.is_power_of_two());
-        Self {
-            buf: vec![0i16; RING_CAPACITY].into_boxed_slice(),
-            write_pos: AtomicUsize::new(0),
-            read_pos: AtomicUsize::new(0),
-            overflow_count: AtomicU64::new(0),
-            underrun_count: AtomicU64::new(0),
-        }
-    }
-
-    /// Number of samples available to read (clamped to capacity).
-    pub fn available(&self) -> usize {
-        let w = self.write_pos.load(Ordering::Acquire);
-        let r = self.read_pos.load(Ordering::Relaxed);
-        w.wrapping_sub(r).min(RING_CAPACITY)
-    }
-
-    /// Write samples into the ring. Returns number of samples written.
-    ///
-    /// If the ring is full, old data is silently overwritten.  The reader
-    /// will detect the lap and self-correct.  The writer NEVER touches
-    /// `read_pos`.
-    pub fn write(&self, samples: &[i16]) -> usize {
-        let count = samples.len().min(RING_CAPACITY);
-        let w = self.write_pos.load(Ordering::Relaxed);
-
-        for i in 0..count {
-            unsafe {
-                let ptr = self.buf.as_ptr() as *mut i16;
-                *ptr.add((w + i) & RING_MASK) = samples[i];
-            }
-        }
-
-        self.write_pos
-            .store(w.wrapping_add(count), Ordering::Release);
-        count
-    }
-
-    /// Read samples from the ring into `out`. Returns number of samples read.
-    ///
-    /// If the writer has lapped the reader (overflow), `read_pos` is snapped
-    /// forward to the oldest valid data.
-    pub fn read(&self, out: &mut [i16]) -> usize {
-        let w = self.write_pos.load(Ordering::Acquire);
-        let mut r = self.read_pos.load(Ordering::Relaxed);
-
-        let mut avail = w.wrapping_sub(r);
-
-        // Lap detection: writer has overwritten our unread data.
-        if avail > RING_CAPACITY {
-            r = w.wrapping_sub(RING_CAPACITY);
-            avail = RING_CAPACITY;
-            self.overflow_count.fetch_add(1, Ordering::Relaxed);
-        }
-
-        let count = out.len().min(avail);
-        if count == 0 {
-            if w == r {
-                self.underrun_count.fetch_add(1, Ordering::Relaxed);
-            }
-            return 0;
-        }
-
-        for i in 0..count {
-            out[i] = unsafe { *self.buf.as_ptr().add((r + i) & RING_MASK) };
-        }
-
-        self.read_pos
-            .store(r.wrapping_add(count), Ordering::Release);
-        count
-    }
-
-    /// Number of overflow events (reader was lapped by writer).
-    pub fn overflow_count(&self) -> u64 {
-        self.overflow_count.load(Ordering::Relaxed)
-    }
-
-    /// Number of underrun events (reader found empty buffer).
-    pub fn underrun_count(&self) -> u64 {
-        self.underrun_count.load(Ordering::Relaxed)
-    }
-}

crates/wzp-client/src/audio_vpio.rs

@@ -1,179 +0,0 @@
-//! macOS Voice Processing I/O — uses Apple's VoiceProcessingIO audio unit
-//! for hardware-accelerated echo cancellation, AGC, and noise suppression.
-//!
-//! VoiceProcessingIO is a combined input+output unit that knows what's going
-//! to the speaker, so it can cancel the echo from the mic signal internally.
-//! This is the same engine FaceTime and other Apple apps use.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
-
-use anyhow::Context;
-use coreaudio::audio_unit::audio_format::LinearPcmFlags;
-use coreaudio::audio_unit::render_callback::{self, data};
-use coreaudio::audio_unit::{AudioUnit, Element, IOType, SampleFormat, Scope, StreamFormat};
-use coreaudio::sys;
-use tracing::info;
-
-use crate::audio_ring::AudioRing;
-
-/// Number of samples per 20 ms frame at 48 kHz mono.
-pub const FRAME_SAMPLES: usize = 960;
-
-/// Combined capture + playback via macOS VoiceProcessingIO.
-///
-/// The OS handles AEC internally — no manual far-end feeding needed.
-pub struct VpioAudio {
-    capture_ring: Arc<AudioRing>,
-    playout_ring: Arc<AudioRing>,
-    _audio_unit: AudioUnit,
-    running: Arc<AtomicBool>,
-}
-
-impl VpioAudio {
-    /// Start VoiceProcessingIO with AEC enabled.
-    pub fn start() -> Result<Self, anyhow::Error> {
-        let capture_ring = Arc::new(AudioRing::new());
-        let playout_ring = Arc::new(AudioRing::new());
-        let running = Arc::new(AtomicBool::new(true));
-
-        let mut au = AudioUnit::new(IOType::VoiceProcessingIO)
-            .context("failed to create VoiceProcessingIO audio unit")?;
-
-        // Must uninitialize before configuring properties.
-        au.uninitialize()
-            .context("failed to uninitialize VPIO for configuration")?;
-
-        // Enable input (mic) on Element::Input (bus 1).
-        let enable: u32 = 1;
-        au.set_property(
-            sys::kAudioOutputUnitProperty_EnableIO,
-            Scope::Input,
-            Element::Input,
-            Some(&enable),
-        )
-        .context("failed to enable VPIO input")?;
-
-        // Output (speaker) is enabled by default on VPIO, but be explicit.
-        au.set_property(
-            sys::kAudioOutputUnitProperty_EnableIO,
-            Scope::Output,
-            Element::Output,
-            Some(&enable),
-        )
-        .context("failed to enable VPIO output")?;
-
-        // Configure stream format: 48kHz mono f32 non-interleaved
-        let stream_format = StreamFormat {
-            sample_rate: 48_000.0,
-            sample_format: SampleFormat::F32,
-            flags: LinearPcmFlags::IS_FLOAT
-                | LinearPcmFlags::IS_PACKED
-                | LinearPcmFlags::IS_NON_INTERLEAVED,
-            channels: 1,
-        };
-
-        let asbd = stream_format.to_asbd();
-
-        // Input: set format on Output scope of Input element
-        // (= the format the AU delivers to us from the mic)
-        au.set_property(
-            sys::kAudioUnitProperty_StreamFormat,
-            Scope::Output,
-            Element::Input,
-            Some(&asbd),
-        )
-        .context("failed to set input stream format")?;
-
-        // Output: set format on Input scope of Output element
-        // (= the format we feed to the AU for the speaker)
-        au.set_property(
-            sys::kAudioUnitProperty_StreamFormat,
-            Scope::Input,
-            Element::Output,
-            Some(&asbd),
-        )
-        .context("failed to set output stream format")?;
-
-        // Set up input callback (mic capture with AEC applied)
-        let cap_ring = capture_ring.clone();
-        let cap_running = running.clone();
-        let logged = Arc::new(AtomicBool::new(false));
-        au.set_input_callback(
-            move |args: render_callback::Args<data::NonInterleaved<f32>>| {
-                if !cap_running.load(Ordering::Relaxed) {
-                    return Ok(());
-                }
-                let mut buffers = args.data.channels();
-                if let Some(ch) = buffers.next() {
-                    if !logged.swap(true, Ordering::Relaxed) {
-                        eprintln!("[vpio] capture callback: {} f32 samples", ch.len());
-                    }
-                    let mut tmp = [0i16; FRAME_SAMPLES];
-                    for chunk in ch.chunks(FRAME_SAMPLES) {
-                        let n = chunk.len();
-                        for i in 0..n {
-                            tmp[i] = (chunk[i].clamp(-1.0, 1.0) * i16::MAX as f32) as i16;
-                        }
-                        cap_ring.write(&tmp[..n]);
-                    }
-                }
-                Ok(())
-            },
-        )
-        .context("failed to set input callback")?;
-
-        // Set up output callback (speaker playback — AEC uses this as reference)
-        let play_ring = playout_ring.clone();
-        au.set_render_callback(
-            move |mut args: render_callback::Args<data::NonInterleaved<f32>>| {
-                let mut buffers = args.data.channels_mut();
-                if let Some(ch) = buffers.next() {
-                    let mut tmp = [0i16; FRAME_SAMPLES];
-                    for chunk in ch.chunks_mut(FRAME_SAMPLES) {
-                        let n = chunk.len();
-                        let read = play_ring.read(&mut tmp[..n]);
-                        for i in 0..read {
-                            chunk[i] = tmp[i] as f32 / i16::MAX as f32;
-                        }
-                        for i in read..n {
-                            chunk[i] = 0.0;
-                        }
-                    }
-                }
-                Ok(())
-            },
-        )
-        .context("failed to set render callback")?;
-
-        au.initialize().context("failed to initialize VoiceProcessingIO")?;
-        au.start().context("failed to start VoiceProcessingIO")?;
-
-        info!("VoiceProcessingIO started (OS-level AEC enabled)");
-
-        Ok(Self {
-            capture_ring,
-            playout_ring,
-            _audio_unit: au,
-            running,
-        })
-    }
-
-    pub fn capture_ring(&self) -> &Arc<AudioRing> {
-        &self.capture_ring
-    }
-
-    pub fn playout_ring(&self) -> &Arc<AudioRing> {
-        &self.playout_ring
-    }
-
-    pub fn stop(&self) {
-        self.running.store(false, Ordering::Relaxed);
-    }
-}
-
-impl Drop for VpioAudio {
-    fn drop(&mut self) {
-        self.stop();
-    }
-}

crates/wzp-client/src/audio_wasapi.rs

@@ -1,332 +0,0 @@
-//! Direct WASAPI microphone capture with Windows's OS-level AEC enabled.
-//!
-//! Bypasses CPAL and opens the default capture endpoint directly via
-//! `IMMDeviceEnumerator` + `IAudioClient2::SetClientProperties`, setting
-//! `AudioClientProperties.eCategory = AudioCategory_Communications`. That's
-//! the switch that tells Windows "this is a VoIP call" — the OS then
-//! enables its communications audio processing chain (AEC, noise
-//! suppression, automatic gain control) for the stream. AEC operates at
-//! the OS level using the currently-playing audio as the reference
-//! signal, so it cancels echo from our CPAL playback (and any other app's
-//! audio) without us having to plumb a reference signal ourselves.
-//!
-//! Platform: Windows only, compiled only when the `windows-aec` feature
-//! is enabled. Mirrors the public API of `audio_io::AudioCapture` so
-//! `wzp-client`'s lib.rs can transparently re-export either one as
-//! `AudioCapture`.
-
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
-
-use anyhow::{anyhow, Context};
-use tracing::{info, warn};
-use windows::core::{Interface, GUID};
-use windows::Win32::Foundation::{CloseHandle, BOOL, WAIT_OBJECT_0};
-use windows::Win32::Media::Audio::{
-    eCapture, eCommunications, AudioCategory_Communications, AudioClientProperties,
-    IAudioCaptureClient, IAudioClient, IAudioClient2, IMMDeviceEnumerator, MMDeviceEnumerator,
-    AUDCLNT_SHAREMODE_SHARED, AUDCLNT_STREAMFLAGS_AUTOCONVERTPCM,
-    AUDCLNT_STREAMFLAGS_EVENTCALLBACK, AUDCLNT_STREAMFLAGS_SRC_DEFAULT_QUALITY, WAVEFORMATEX,
-    WAVE_FORMAT_PCM,
-};
-use windows::Win32::System::Com::{
-    CoCreateInstance, CoInitializeEx, CoUninitialize, CLSCTX_ALL, COINIT_MULTITHREADED,
-};
-use windows::Win32::System::Threading::{CreateEventW, WaitForSingleObject, INFINITE};
-
-use crate::audio_ring::AudioRing;
-
-/// 20 ms at 48 kHz, mono. Matches the rest of the audio pipeline.
-pub const FRAME_SAMPLES: usize = 960;
-
-/// Microphone capture via WASAPI with Windows's communications AEC enabled.
-///
-/// The WASAPI capture stream runs on a dedicated OS thread. This handle is
-/// `Send + Sync`. Dropping it stops the stream and joins the thread.
-pub struct WasapiAudioCapture {
-    ring: Arc<AudioRing>,
-    running: Arc<AtomicBool>,
-    thread: Option<std::thread::JoinHandle<()>>,
-}
-
-impl WasapiAudioCapture {
-    /// Open the default communications microphone, enable OS AEC, and start
-    /// streaming PCM into a lock-free ring buffer.
-    ///
-    /// Returns only after the capture thread has successfully initialized
-    /// the stream, or propagates the error back to the caller.
-    pub fn start() -> Result<Self, anyhow::Error> {
-        let ring = Arc::new(AudioRing::new());
-        let running = Arc::new(AtomicBool::new(true));
-
-        let (init_tx, init_rx) = std::sync::mpsc::sync_channel::<Result<(), String>>(1);
-        let ring_cb = ring.clone();
-        let running_cb = running.clone();
-
-        let thread = std::thread::Builder::new()
-            .name("wzp-audio-capture-wasapi".into())
-            .spawn(move || {
-                let result = unsafe { capture_thread_main(ring_cb, running_cb.clone(), &init_tx) };
-                if let Err(e) = result {
-                    warn!("wasapi capture thread exited with error: {e}");
-                    // If we failed before signaling init, signal now so the
-                    // caller unblocks. Double-send is harmless (channel is
-                    // bounded to 1 and we only hit the second send path on
-                    // late errors).
-                    let _ = init_tx.send(Err(e.to_string()));
-                }
-            })
-            .context("failed to spawn WASAPI capture thread")?;
-
-        init_rx
-            .recv()
-            .map_err(|_| anyhow!("WASAPI capture thread exited before signaling init"))?
-            .map_err(|e| anyhow!("{e}"))?;
-
-        Ok(Self {
-            ring,
-            running,
-            thread: Some(thread),
-        })
-    }
-
-    /// Get a reference to the capture ring buffer for direct polling.
-    pub fn ring(&self) -> &Arc<AudioRing> {
-        &self.ring
-    }
-
-    /// Stop capturing.
-    pub fn stop(&self) {
-        self.running.store(false, Ordering::Relaxed);
-    }
-}
-
-impl Drop for WasapiAudioCapture {
-    fn drop(&mut self) {
-        self.stop();
-        if let Some(handle) = self.thread.take() {
-            // Join best-effort. The thread loop polls `running` every 200ms
-            // via a short WaitForSingleObject timeout, so it should exit
-            // within ~200ms of `stop()`.
-            let _ = handle.join();
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// WASAPI thread entry point — everything below this line runs on the
-// dedicated wzp-audio-capture-wasapi thread.
-// ---------------------------------------------------------------------------
-
-unsafe fn capture_thread_main(
-    ring: Arc<AudioRing>,
-    running: Arc<AtomicBool>,
-    init_tx: &std::sync::mpsc::SyncSender<Result<(), String>>,
-) -> Result<(), anyhow::Error> {
-    // COM init for the capture thread. MULTITHREADED because we're not
-    // running a message pump. Must be balanced by CoUninitialize on exit.
-    CoInitializeEx(None, COINIT_MULTITHREADED)
-        .ok()
-        .context("CoInitializeEx failed")?;
-
-    // Use a guard struct so CoUninitialize runs even on early returns.
-    struct ComGuard;
-    impl Drop for ComGuard {
-        fn drop(&mut self) {
-            unsafe { CoUninitialize() };
-        }
-    }
-    let _com_guard = ComGuard;
-
-    let enumerator: IMMDeviceEnumerator =
-        CoCreateInstance(&MMDeviceEnumerator, None, CLSCTX_ALL)
-            .context("CoCreateInstance(MMDeviceEnumerator) failed")?;
-
-    // eCommunications role (not eConsole) — this picks the device the user
-    // has designated for communications in Sound Settings. It's the one
-    // Windows's AEC is actually tuned for and the one Teams/Zoom use.
-    let device = enumerator
-        .GetDefaultAudioEndpoint(eCapture, eCommunications)
-        .context("GetDefaultAudioEndpoint(eCapture, eCommunications) failed")?;
-
-    if let Ok(name) = device_name(&device) {
-        info!(device = %name, "opening WASAPI communications capture endpoint");
-    }
-
-    let audio_client: IAudioClient = device
-        .Activate(CLSCTX_ALL, None)
-        .context("IMMDevice::Activate(IAudioClient) failed")?;
-
-    // IAudioClient2 exposes SetClientProperties, which is the ONLY way to
-    // set AudioCategory_Communications pre-Initialize. Calling it on the
-    // base IAudioClient would not compile, and setting it after Initialize
-    // is a no-op.
-    let audio_client2: IAudioClient2 = audio_client
-        .cast()
-        .context("QueryInterface IAudioClient2 failed")?;
-
-    let mut props = AudioClientProperties {
-        cbSize: std::mem::size_of::<AudioClientProperties>() as u32,
-        bIsOffload: BOOL(0),
-        eCategory: AudioCategory_Communications,
-        // 0 = AUDCLNT_STREAMOPTIONS_NONE. The `windows` crate doesn't
-        // export the enum constant in all versions, so use 0 directly.
-        Options: Default::default(),
-    };
-    audio_client2
-        .SetClientProperties(&mut props as *mut _)
-        .context("SetClientProperties(AudioCategory_Communications) failed")?;
-
-    // Request 48 kHz mono i16 directly. AUDCLNT_STREAMFLAGS_AUTOCONVERTPCM
-    // tells Windows to do any needed format conversion inside the audio
-    // engine rather than rejecting our format. SRC_DEFAULT_QUALITY picks
-    // the standard Windows resampler quality (fine for voice).
-    let wave_format = WAVEFORMATEX {
-        wFormatTag: WAVE_FORMAT_PCM as u16,
-        nChannels: 1,
-        nSamplesPerSec: 48_000,
-        nAvgBytesPerSec: 48_000 * 2, // 1 ch * 2 bytes/sample * 48000 Hz
-        nBlockAlign: 2,              // 1 ch * 2 bytes/sample
-        wBitsPerSample: 16,
-        cbSize: 0,
-    };
-
-    // 1,000,000 hns = 100 ms buffer (hns = 100-nanosecond units). Windows
-    // treats this as the minimum; the engine may give us a larger one.
-    const BUFFER_DURATION_HNS: i64 = 1_000_000;
-
-    audio_client
-        .Initialize(
-            AUDCLNT_SHAREMODE_SHARED,
-            AUDCLNT_STREAMFLAGS_EVENTCALLBACK
-                | AUDCLNT_STREAMFLAGS_AUTOCONVERTPCM
-                | AUDCLNT_STREAMFLAGS_SRC_DEFAULT_QUALITY,
-            BUFFER_DURATION_HNS,
-            0,
-            &wave_format,
-            Some(&GUID::zeroed()),
-        )
-        .context("IAudioClient::Initialize failed — Windows rejected communications-mode 48k mono i16")?;
-
-    // Event-driven capture: Windows signals this handle each time a new
-    // audio packet is available. We wait on it from the loop below.
-    let event = CreateEventW(None, false, false, None)
-        .context("CreateEventW failed")?;
-    audio_client
-        .SetEventHandle(event)
-        .context("SetEventHandle failed")?;
-
-    let capture_client: IAudioCaptureClient = audio_client
-        .GetService()
-        .context("IAudioClient::GetService(IAudioCaptureClient) failed")?;
-
-    audio_client.Start().context("IAudioClient::Start failed")?;
-
-    // Signal to the parent thread that init succeeded before entering the
-    // hot loop. From this point on, errors get logged but don't propagate
-    // back to the caller (they'd just cause the ring buffer to stop
-    // filling, which the main thread detects as underruns).
-    let _ = init_tx.send(Ok(()));
-    info!("WASAPI communications-mode capture started with OS AEC enabled");
-
-    let mut logged_first_packet = false;
-
-    // Main capture loop. Exit when `running` goes false (from Drop or an
-    // explicit stop() call).
-    while running.load(Ordering::Relaxed) {
-        // 200 ms timeout so we check `running` regularly even if the audio
-        // engine stops delivering packets (e.g. device unplugged).
-        let wait = WaitForSingleObject(event, 200);
-        if wait.0 != WAIT_OBJECT_0.0 {
-            // Timeout or failure — just loop and re-check running.
-            continue;
-        }
-
-        // Drain all available packets. Windows may have queued more than
-        // one since we were last scheduled.
-        loop {
-            let packet_length = match capture_client.GetNextPacketSize() {
-                Ok(n) => n,
-                Err(e) => {
-                    warn!("GetNextPacketSize failed: {e}");
-                    break;
-                }
-            };
-            if packet_length == 0 {
-                break;
-            }
-
-            let mut buffer_ptr: *mut u8 = std::ptr::null_mut();
-            let mut num_frames: u32 = 0;
-            let mut flags: u32 = 0;
-            let mut device_position: u64 = 0;
-            let mut qpc_position: u64 = 0;
-
-            if let Err(e) = capture_client.GetBuffer(
-                &mut buffer_ptr,
-                &mut num_frames,
-                &mut flags,
-                Some(&mut device_position),
-                Some(&mut qpc_position),
-            ) {
-                warn!("GetBuffer failed: {e}");
-                break;
-            }
-
-            if num_frames > 0 && !buffer_ptr.is_null() {
-                if !logged_first_packet {
-                    info!(
-                        frames = num_frames,
-                        flags, "WASAPI capture: first packet received"
-                    );
-                    logged_first_packet = true;
-                }
-
-                // Because we asked for 48 kHz mono i16, each frame is
-                // exactly one i16. Windows's AUTOCONVERTPCM handles the
-                // conversion from whatever the engine mix format is.
-                let samples = std::slice::from_raw_parts(
-                    buffer_ptr as *const i16,
-                    num_frames as usize,
-                );
-                ring.write(samples);
-            }
-
-            if let Err(e) = capture_client.ReleaseBuffer(num_frames) {
-                warn!("ReleaseBuffer failed: {e}");
-                break;
-            }
-        }
-    }
-
-    info!("WASAPI capture thread stopping");
-    let _ = audio_client.Stop();
-    let _ = CloseHandle(event);
-    // _com_guard drops here, calling CoUninitialize.
-
-    // Silence INFINITE unused-import warning — it's referenced by the
-    // `windows` crate's WaitForSingleObject alternative but we use the
-    // 200 ms timeout variant instead. Explicit suppression for clarity.
-    let _ = INFINITE;
-
-    Ok(())
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/// Best-effort device ID string for logging. Grabbing the friendly name via
-/// PKEY_Device_FriendlyName requires IPropertyStore + PROPVARIANT plumbing
-/// that's far more ceremony than a log line justifies; the ID is already
-/// sufficient to confirm we opened the right endpoint.
-///
-/// Rust 2024 edition's `unsafe_op_in_unsafe_fn` lint requires explicit
-/// `unsafe { ... }` blocks inside `unsafe fn` bodies for each unsafe call,
-/// even though the whole function is already marked unsafe.
-unsafe fn device_name(
-    device: &windows::Win32::Media::Audio::IMMDevice,
-) -> Result<String, anyhow::Error> {
-    let id = unsafe { device.GetId() }.context("IMMDevice::GetId failed")?;
-    Ok(unsafe { id.to_string() }.unwrap_or_else(|_| "<non-utf16>".to_string()))
-}

crates/wzp-client/src/call.rs

@@ -43,9 +43,6 @@ pub struct CallConfig {
     /// When enabled, only every 50th frame carries a full 12-byte MediaHeader;
     /// intermediate frames use a compact 4-byte MiniHeader.
     pub mini_frames_enabled: bool,
-    /// AEC far-end delay compensation in milliseconds (default: 40).
-    /// Compensates for the round-trip audio latency from playout to mic capture.
-    pub aec_delay_ms: u32,
     /// Enable adaptive jitter buffer (default: true).
     ///
     /// When true, the jitter buffer target depth is automatically adjusted
@@ -67,7 +64,6 @@ impl Default for CallConfig {
             noise_suppression: true,
             mini_frames_enabled: true,
             adaptive_jitter: true,
-            aec_delay_ms: 40,
         }
     }
 }
@@ -246,7 +242,7 @@ impl CallEncoder {
             block_id: 0,
             frame_in_block: 0,
             timestamp_ms: 0,
-            aec: EchoCanceller::with_delay(48000, 60, config.aec_delay_ms),
+            aec: EchoCanceller::new(48000, 100), // 100 ms echo tail
             agc: AutoGainControl::new(),
             silence_detector: SilenceDetector::new(
                 config.silence_threshold_rms,
@@ -445,15 +441,6 @@ impl CallEncoder {
         self.aec.feed_farend(farend);
     }
 
-    /// Apply DRED tuning output to the encoder.
-    ///
-    /// Called by the send loop after `DredTuner::update()` returns `Some`.
-    /// No-op when the active codec is Codec2 (DRED is Opus-only).
-    pub fn apply_dred_tuning(&mut self, tuning: wzp_proto::DredTuning) {
-        self.audio_enc.set_dred_duration(tuning.dred_frames);
-        self.audio_enc.set_expected_loss(tuning.expected_loss_pct);
-    }
-
     /// Enable or disable acoustic echo cancellation.
     pub fn set_aec_enabled(&mut self, enabled: bool) {
         self.aec.set_enabled(enabled);
@@ -606,52 +593,6 @@ impl CallDecoder {
         }
     }
 
-    /// Switch the decoder to match an incoming packet's codec if it differs
-    /// from the current profile. This enables cross-codec interop (e.g. one
-    /// client sends Opus, the other sends Codec2).
-    fn switch_decoder_if_needed(&mut self, incoming_codec: CodecId) {
-        if incoming_codec == self.profile.codec || incoming_codec == CodecId::ComfortNoise {
-            return;
-        }
-        let new_profile = Self::profile_for_codec(incoming_codec);
-        info!(
-            from = ?self.profile.codec,
-            to = ?incoming_codec,
-            "decoder switching codec to match incoming packet"
-        );
-        if let Err(e) = self.audio_dec.set_profile(new_profile) {
-            warn!("failed to switch decoder profile: {e}");
-            return;
-        }
-        self.fec_dec = wzp_fec::create_decoder(&new_profile);
-        self.profile = new_profile;
-    }
-
-    /// Map a `CodecId` to a reasonable `QualityProfile` for decoding.
-    fn profile_for_codec(codec: CodecId) -> QualityProfile {
-        match codec {
-            CodecId::Opus24k => QualityProfile::GOOD,
-            CodecId::Opus16k => QualityProfile {
-                codec: CodecId::Opus16k,
-                fec_ratio: 0.3,
-                frame_duration_ms: 20,
-                frames_per_block: 5,
-            },
-            CodecId::Opus6k => QualityProfile::DEGRADED,
-            CodecId::Opus32k => QualityProfile::STUDIO_32K,
-            CodecId::Opus48k => QualityProfile::STUDIO_48K,
-            CodecId::Opus64k => QualityProfile::STUDIO_64K,
-            CodecId::Codec2_3200 => QualityProfile {
-                codec: CodecId::Codec2_3200,
-                fec_ratio: 0.5,
-                frame_duration_ms: 20,
-                frames_per_block: 5,
-            },
-            CodecId::Codec2_1200 => QualityProfile::CATASTROPHIC,
-            CodecId::ComfortNoise => QualityProfile::GOOD,
-        }
-    }
-
     /// Decode the next audio frame from the jitter buffer.
     ///
     /// Returns PCM samples (48kHz mono) or None if not ready.
@@ -666,9 +607,6 @@ impl CallDecoder {
                     return Some(pcm.len());
                 }
 
-                // Auto-switch decoder if incoming codec differs from current.
-                self.switch_decoder_if_needed(pkt.header.codec_id);
-
                 self.last_was_cn = false;
                 let result = match self.audio_dec.decode(&pkt.payload, pcm) {
                     Ok(n) => Some(n),
@@ -1451,131 +1389,4 @@ mod tests {
             "frames_suppressed should be > 0"
         );
     }
-
-    // ---- DredTuner integration tests ----
-
-    /// End-to-end test: DredTuner reacts to simulated network degradation
-    /// and adjusts the encoder's DRED parameters via `apply_dred_tuning`.
-    #[test]
-    fn dred_tuner_adjusts_encoder_on_loss() {
-        use wzp_proto::DredTuner;
-
-        let mut enc = CallEncoder::new(&CallConfig {
-            profile: QualityProfile::GOOD,
-            suppression_enabled: false,
-            ..Default::default()
-        });
-        let mut tuner = DredTuner::new(QualityProfile::GOOD.codec);
-
-        // Baseline: good network → baseline DRED (20 frames = 200 ms).
-        let baseline = tuner.current();
-        assert_eq!(baseline.dred_frames, 20);
-
-        // Warm up the tuner — first few updates may return Some as the
-        // EWMA initializes and expected_loss settles from the initial 15%.
-        for _ in 0..10 {
-            tuner.update(0.0, 50, 5);
-        }
-        // After settling, the tuning should be at baseline.
-        assert_eq!(tuner.current().dred_frames, 20);
-
-        // Simulate network degradation: 30% loss, 300ms RTT.
-        // The tuner should increase DRED frames above baseline.
-        let tuning = tuner.update(30.0, 300, 15);
-        assert!(tuning.is_some(), "loss spike should trigger tuning change");
-        let t = tuning.unwrap();
-        assert!(
-            t.dred_frames > 20,
-            "30% loss should increase DRED above baseline 20, got {}",
-            t.dred_frames
-        );
-
-        // Apply to encoder — should not panic.
-        enc.apply_dred_tuning(t);
-
-        // Verify the encoder still works after tuning.
-        let pcm = voice_frame_20ms(0);
-        let packets = enc.encode_frame(&pcm).unwrap();
-        assert!(!packets.is_empty(), "encoder must still produce packets after DRED tuning");
-    }
-
-    /// DredTuner jitter spike triggers pre-emptive DRED boost to ceiling.
-    #[test]
-    fn dred_tuner_spike_boosts_to_ceiling() {
-        use wzp_proto::DredTuner;
-
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // Establish low-jitter baseline.
-        for _ in 0..20 {
-            tuner.update(0.0, 50, 5);
-        }
-        assert!(!tuner.spike_boost_active());
-
-        // Jitter spikes to 40ms (8x baseline of ~5ms).
-        let tuning = tuner.update(0.0, 50, 40);
-        assert!(tuner.spike_boost_active(), "jitter spike should activate boost");
-        assert!(tuning.is_some());
-        // Ceiling for Opus24k is 50 frames = 500 ms.
-        assert_eq!(
-            tuning.unwrap().dred_frames, 50,
-            "spike should push to ceiling"
-        );
-    }
-
-    /// DredTuner is a no-op for Codec2 profiles.
-    #[test]
-    fn dred_tuner_noop_for_codec2() {
-        use wzp_proto::DredTuner;
-
-        let mut tuner = DredTuner::new(CodecId::Codec2_1200);
-
-        // Even extreme conditions produce no tuning output.
-        assert!(tuner.update(50.0, 800, 100).is_none());
-        assert_eq!(tuner.current().dred_frames, 0);
-    }
-
-    /// DredTuner + CallEncoder: full cycle through profile switch.
-    #[test]
-    fn dred_tuner_handles_profile_switch() {
-        use wzp_proto::DredTuner;
-
-        let mut enc = CallEncoder::new(&CallConfig {
-            profile: QualityProfile::GOOD,
-            suppression_enabled: false,
-            ..Default::default()
-        });
-        let mut tuner = DredTuner::new(QualityProfile::GOOD.codec);
-
-        // Apply initial tuning on good network.
-        if let Some(t) = tuner.update(0.0, 50, 5) {
-            enc.apply_dred_tuning(t);
-        }
-
-        // Switch to degraded profile.
-        enc.set_profile(QualityProfile::DEGRADED).unwrap();
-        tuner.set_codec(QualityProfile::DEGRADED.codec);
-
-        // Opus6k baseline is 50 frames (500 ms), ceiling is 104 (1040 ms).
-        let baseline = tuner.current();
-        // After set_codec, the cached tuning should reflect old state;
-        // a fresh update gives the new codec's mapping.
-        let tuning = tuner.update(20.0, 200, 10);
-        assert!(tuning.is_some());
-        let t = tuning.unwrap();
-        assert!(
-            t.dred_frames >= 50,
-            "Opus6k with 20% loss should be at least baseline 50, got {}",
-            t.dred_frames
-        );
-
-        enc.apply_dred_tuning(t);
-
-        // Encode a 40ms frame (Opus6k uses 40ms frames = 1920 samples).
-        let pcm: Vec<i16> = (0..1920)
-            .map(|i| ((i as f32 * 0.1).sin() * 10_000.0) as i16)
-            .collect();
-        let packets = enc.encode_frame(&pcm).unwrap();
-        assert!(!packets.is_empty());
-    }
 }

crates/wzp-client/src/cli.rs

@@ -424,7 +424,6 @@ async fn run_silence(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::R
     info!(total_source, total_repair, total_bytes, "done — closing");
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
-        call_id: None,
     };
     transport.send_signal(&hangup).await.ok();
     transport.close().await?;
@@ -576,7 +575,6 @@ async fn run_file_mode(
     // Send Hangup signal so the relay knows we're done
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
-        call_id: None,
     };
     transport.send_signal(&hangup).await.ok();
 
@@ -628,21 +626,11 @@ async fn run_live(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::Resu
         .spawn(move || {
             let config = CallConfig::default();
             let mut encoder = CallEncoder::new(&config);
-            let mut frame = vec![0i16; FRAME_SAMPLES];
             loop {
-                // Pull a full 20 ms frame from the capture ring. The ring
-                // may return a partial read when the CPAL callback hasn't
-                // produced enough samples yet — keep reading until we
-                // accumulate a whole frame, sleeping briefly on empty
-                // returns so we don't hot-spin the CPU.
-                let mut filled = 0usize;
-                while filled < FRAME_SAMPLES {
-                    let n = capture.ring().read(&mut frame[filled..]);
-                    filled += n;
-                    if n == 0 {
-                        std::thread::sleep(std::time::Duration::from_millis(2));
-                    }
-                }
+                let frame = match capture.read_frame() {
+                    Some(f) => f,
+                    None => break,
+                };
                 let packets = match encoder.encode_frame(&frame) {
                     Ok(p) => p,
                     Err(e) => {
@@ -673,13 +661,7 @@ async fn run_live(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::Resu
                     // Repair packets feed the FEC decoder but don't produce audio.
                     if !is_repair {
                         if let Some(_n) = decoder.decode_next(&mut pcm_buf) {
-                            // Push the decoded frame into the playback
-                            // ring. The CPAL output callback drains from
-                            // here on its own clock; if the ring is full
-                            // (rare in CLI live mode) the write returns
-                            // a short count and the tail is dropped,
-                            // which is the correct real-time behavior.
-                            playback.ring().write(&pcm_buf);
+                            playback.write_frame(&pcm_buf);
                         }
                     }
                 }
@@ -749,7 +731,7 @@ async fn run_signal_mode(
         Some(SignalMessage::RegisterPresenceAck { success: true, .. }) => {
             info!(fingerprint = %fp, "registered on relay — waiting for calls");
         }
-        Some(SignalMessage::RegisterPresenceAck { success: false, error, .. }) => {
+        Some(SignalMessage::RegisterPresenceAck { success: false, error }) => {
             anyhow::bail!("registration failed: {}", error.unwrap_or_default());
         }
         other => {
@@ -772,17 +754,13 @@ async fn run_signal_mode(
             ephemeral_pub: [0u8; 32], // Phase 1: not used for key exchange
             signature: vec![],
             supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
-            // CLI client doesn't attempt hole-punching; always
-            // relay-path.
-            caller_reflexive_addr: None,
-            caller_local_addrs: Vec::new(),
-            caller_build_version: None,
         }).await?;
     }
 
     // Signal recv loop — handle incoming signals
     let signal_transport = transport.clone();
     let relay = relay_addr;
+    let my_fp = fp.clone();
     let my_seed = seed.0;
 
     loop {
@@ -806,17 +784,12 @@ async fn run_signal_mode(
                         ephemeral_pub: None,
                         signature: None,
                         chosen_profile: Some(wzp_proto::QualityProfile::GOOD),
-                        // CLI auto-accept uses generic (privacy) mode,
-                        // so callee addr stays hidden from the caller.
-                        callee_reflexive_addr: None,
-                        callee_local_addrs: Vec::new(),
-                        callee_build_version: None,
                     }).await;
                 }
                 SignalMessage::DirectCallAnswer { call_id, accept_mode, .. } => {
                     info!(call_id = %call_id, mode = ?accept_mode, "call answered");
                 }
-                SignalMessage::CallSetup { call_id, room, relay_addr: setup_relay, peer_direct_addr: _, peer_local_addrs: _ } => {
+                SignalMessage::CallSetup { call_id, room, relay_addr: setup_relay } => {
                     info!(call_id = %call_id, room = %room, relay = %setup_relay, "call setup — connecting to media room");
 
                     // Connect to the media room
@@ -867,7 +840,6 @@ async fn run_signal_mode(
                                                 info!("hanging up...");
                                                 let _ = signal_transport.send_signal(&SignalMessage::Hangup {
                                                     reason: wzp_proto::HangupReason::Normal,
-                                                    call_id: None,
                                                 }).await;
                                                 break;
                                             }
@@ -884,7 +856,7 @@ async fn run_signal_mode(
                         Err(e) => error!("media connect failed: {e}"),
                     }
                 }
-                SignalMessage::Hangup { reason, .. } => {
+                SignalMessage::Hangup { reason } => {
                     info!(reason = ?reason, "call ended by remote");
                 }
                 SignalMessage::Pong { .. } => {}

crates/wzp-client/src/dual_path.rs

@@ -1,546 +0,0 @@
-//! Phase 3.5 — dual-path QUIC connect race for P2P hole-punching.
-//!
-//! When both peers advertised reflex addrs in the
-//! DirectCallOffer/Answer flow, the relay cross-wires them into
-//! `CallSetup.peer_direct_addr`. This module races a direct QUIC
-//! handshake against the existing relay dial and returns whichever
-//! completes first — with automatic drop of the loser via
-//! `tokio::select!`.
-//!
-//! Role determination is deterministic and symmetric
-//! (`wzp_client::reflect::determine_role`): whichever peer has the
-//! lexicographically smaller reflex addr becomes the **Acceptor**
-//! (listens on a server-capable endpoint), the other becomes the
-//! **Dialer** (dials the peer's addr). Because the rule is
-//! identical on both sides, the Acceptor's inbound QUIC session
-//! and the Dialer's outbound are the SAME connection — no
-//! negotiation needed, no two-conns-per-call confusion.
-//!
-//! Timeout policy:
-//! - Direct path: 2s from the start of `race`. Cone-NAT hole-punch
-//!   typically completes in < 500ms on a LAN; 2s gives us tolerance
-//!   for a single QUIC Initial retry on unreliable networks.
-//! - Relay path: 10s (existing behavior elsewhere in the codebase).
-//! - Overall: `tokio::select!` returns as soon as either succeeds.
-
-use std::net::SocketAddr;
-use std::sync::Arc;
-use std::time::Duration;
-
-use crate::reflect::Role;
-use wzp_transport::QuinnTransport;
-
-/// Which path won the race. Used by the `connect` command for
-/// logging + (in the future) metrics.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WinningPath {
-    Direct,
-    Relay,
-}
-
-/// Phase 6: the race now returns BOTH transports (when available)
-/// so the connect command can negotiate with the peer before
-/// committing. The negotiation decides which transport to use
-/// based on whether BOTH sides report `direct_ok = true`.
-pub struct RaceResult {
-    /// The direct P2P transport, if the direct path completed.
-    /// `None` if the direct dial/accept failed or timed out.
-    pub direct_transport: Option<Arc<QuinnTransport>>,
-    /// The relay transport, if the relay dial completed.
-    /// `None` if the relay dial failed (shouldn't happen in
-    /// practice since relay is always reachable).
-    pub relay_transport: Option<Arc<QuinnTransport>>,
-    /// Which future completed first in the local race.
-    /// Informational — the actual path used is decided by the
-    /// Phase 6 negotiation after both sides exchange reports.
-    pub local_winner: WinningPath,
-}
-
-/// Attempt a direct QUIC connection to the peer in parallel with
-/// the relay dial and return the winning `QuinnTransport`.
-///
-/// `role` selects the direction of the direct attempt:
-/// - `Role::Acceptor` creates a server-capable endpoint and waits
-///   for the peer to dial in.
-/// - `Role::Dialer` creates a client-only endpoint and dials
-///   `peer_direct_addr`.
-///
-/// The relay path is always attempted in parallel as a fallback so
-/// the race ALWAYS produces a working transport unless both paths
-/// genuinely fail (network partition). Returns
-/// `Err(anyhow::anyhow!(...))` if both paths fail within the
-/// timeout.
-/// Phase 5.5 candidate bundle — full ICE-ish candidate list for
-/// the peer. The race tries them all in parallel alongside the
-/// relay path. At minimum this should contain the peer's
-/// server-reflexive address; `local_addrs` carries LAN host
-/// candidates gathered from their physical interfaces.
-///
-/// Empty is valid: the D-role has nothing to dial and the race
-/// reduces to "relay only" + (if A-role) accepting on the
-/// shared endpoint.
-#[derive(Debug, Clone, Default)]
-pub struct PeerCandidates {
-    /// Peer's server-reflexive address (Phase 3). `None` if the
-    /// peer didn't advertise one.
-    pub reflexive: Option<SocketAddr>,
-    /// Peer's LAN host addresses (Phase 5.5). Tried first on
-    /// same-LAN pairs — direct dials to these bypass the NAT
-    /// entirely.
-    pub local: Vec<SocketAddr>,
-}
-
-impl PeerCandidates {
-    /// Flatten into the list of addrs the D-role should dial.
-    /// Order: LAN host candidates first (fastest when they
-    /// work), then reflexive (covers the non-LAN case).
-    pub fn dial_order(&self) -> Vec<SocketAddr> {
-        let mut out = Vec::with_capacity(self.local.len() + 1);
-        out.extend(self.local.iter().copied());
-        if let Some(a) = self.reflexive {
-            // Only add if it's not already in the list (some
-            // edge cases on same-LAN could have the same addr
-            // in both).
-            if !out.contains(&a) {
-                out.push(a);
-            }
-        }
-        out
-    }
-
-    /// Is there anything for the D-role to dial? If not, the
-    /// race reduces to relay-only.
-    pub fn is_empty(&self) -> bool {
-        self.reflexive.is_none() && self.local.is_empty()
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-pub async fn race(
-    role: Role,
-    peer_candidates: PeerCandidates,
-    relay_addr: SocketAddr,
-    room_sni: String,
-    call_sni: String,
-    // Phase 5: when `Some`, reuse this endpoint for BOTH the
-    // direct-path branch AND the relay dial. Pass the signal
-    // endpoint. The endpoint MUST be server-capable (created
-    // with a server config) for the A-role accept branch to
-    // work.
-    //
-    // When `None`, falls back to fresh endpoints per role.
-    // Used by tests.
-    shared_endpoint: Option<wzp_transport::Endpoint>,
-    // Phase 7: dedicated IPv6 endpoint with IPV6_V6ONLY=1.
-    // When `Some`, A-role accepts on both v4+v6, D-role routes
-    // each candidate to its matching-AF endpoint. When `None`,
-    // IPv6 candidates are skipped (IPv4-only, pre-Phase-7).
-    ipv6_endpoint: Option<wzp_transport::Endpoint>,
-) -> anyhow::Result<RaceResult> {
-    // Rustls provider must be installed before any quinn endpoint
-    // is created. Install attempt is idempotent.
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
-    // Build the direct-path endpoint + future based on role.
-    //
-    // A-role: one accept future on the shared endpoint. The
-    //   first incoming QUIC connection wins — we don't care
-    //   which peer candidate the dialer used to reach us.
-    //
-    // D-role: N parallel dial futures, one per peer candidate
-    //   (all LAN host addrs + the reflex addr), consolidated
-    //   into a single direct_fut via FuturesUnordered-style
-    //   "first OK wins" semantics. The first successful dial
-    //   becomes the direct path; the losers are dropped (quinn
-    //   will abort the in-flight handshakes via the dropped
-    //   Connecting futures).
-    //
-    // Either way, direct_fut resolves to a single QuinnTransport
-    // (or an error) and is raced against the relay_fut by the
-    // outer tokio::select!.
-    let direct_ep: wzp_transport::Endpoint;
-    let direct_fut: std::pin::Pin<
-        Box<dyn std::future::Future<Output = anyhow::Result<QuinnTransport>> + Send>,
-    >;
-
-    match role {
-        Role::Acceptor => {
-            let ep = match shared_endpoint.clone() {
-                Some(ep) => {
-                    tracing::info!(
-                        local_addr = ?ep.local_addr().ok(),
-                        "dual_path: A-role reusing shared endpoint for accept"
-                    );
-                    ep
-                }
-                None => {
-                    let (sc, _cert_der) = wzp_transport::server_config();
-                    // 0.0.0.0:0 = IPv4 socket. [::]:0 dual-stack was
-                    // tried but breaks on Android devices where
-                    // IPV6_V6ONLY=1 (default on some kernels) —
-                    // IPv4 candidates silently fail. IPv6 host
-                    // candidates are skipped for now; they need a
-                    // dedicated IPv6 socket alongside the v4 one
-                    // (like WebRTC's dual-socket approach).
-                    let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
-                    let fresh = wzp_transport::create_endpoint(bind, Some(sc))?;
-                    tracing::info!(
-                        local_addr = ?fresh.local_addr().ok(),
-                        "dual_path: A-role fresh endpoint up, awaiting peer dial"
-                    );
-                    fresh
-                }
-            };
-            let ep_for_fut = ep.clone();
-            // Phase 7: IPv6 accept temporarily disabled (same reason
-            // as dial — IPv6 connections die on datagram send).
-            // Accept on IPv4 shared endpoint only.
-            let _v6_ep_unused = ipv6_endpoint.clone();
-            direct_fut = Box::pin(async move {
-                // Accept loop: retry if we get a stale/closed
-                // connection from a previous call. Max 3 retries
-                // to avoid spinning until the race timeout.
-                const MAX_STALE: usize = 3;
-                let mut stale_count: usize = 0;
-                loop {
-                    let conn = wzp_transport::accept(&ep_for_fut)
-                        .await
-                        .map_err(|e| anyhow::anyhow!("direct accept: {e}"))?;
-
-                    if let Some(reason) = conn.close_reason() {
-                        // Explicitly close so the peer gets a
-                        // close frame instead of idle timeout.
-                        conn.close(0u32.into(), b"stale");
-                        stale_count += 1;
-                        tracing::warn!(
-                            remote = %conn.remote_address(),
-                            stable_id = conn.stable_id(),
-                            stale_count,
-                            ?reason,
-                            "dual_path: A-role skipping stale connection"
-                        );
-                        if stale_count >= MAX_STALE {
-                            return Err(anyhow::anyhow!(
-                                "A-role: {stale_count} stale connections, aborting"
-                            ));
-                        }
-                        continue;
-                    }
-
-                    let has_dgram = conn.max_datagram_size().is_some();
-                    tracing::info!(
-                        remote = %conn.remote_address(),
-                        stable_id = conn.stable_id(),
-                        has_dgram,
-                        "dual_path: A-role accepted direct connection"
-                    );
-
-                    break Ok(QuinnTransport::new(conn));
-                }
-            });
-            direct_ep = ep;
-        }
-        Role::Dialer => {
-            let ep = match shared_endpoint.clone() {
-                Some(ep) => {
-                    tracing::info!(
-                        local_addr = ?ep.local_addr().ok(),
-                        candidates = ?peer_candidates.dial_order(),
-                        "dual_path: D-role reusing shared endpoint to dial peer candidates"
-                    );
-                    ep
-                }
-                None => {
-                    // 0.0.0.0:0 = IPv4 socket. [::]:0 dual-stack was
-                    // tried but breaks on Android devices where
-                    // IPV6_V6ONLY=1 (default on some kernels) —
-                    // IPv4 candidates silently fail. IPv6 host
-                    // candidates are skipped for now; they need a
-                    // dedicated IPv6 socket alongside the v4 one
-                    // (like WebRTC's dual-socket approach).
-                    let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
-                    let fresh = wzp_transport::create_endpoint(bind, None)?;
-                    tracing::info!(
-                        local_addr = ?fresh.local_addr().ok(),
-                        candidates = ?peer_candidates.dial_order(),
-                        "dual_path: D-role fresh endpoint up, dialing peer candidates"
-                    );
-                    fresh
-                }
-            };
-            let ep_for_fut = ep.clone();
-            let _v6_ep_for_dial = ipv6_endpoint.clone();
-            let dial_order = peer_candidates.dial_order();
-            let sni = call_sni.clone();
-            direct_fut = Box::pin(async move {
-                if dial_order.is_empty() {
-                    // No candidates — the race reduces to
-                    // relay-only. Surface a stable error so the
-                    // outer select falls through to relay_fut
-                    // without a spurious "direct failed" warning.
-                    // Use a pending future that never resolves so
-                    // the select's "other side wins" branch is
-                    // the natural outcome.
-                    std::future::pending::<anyhow::Result<QuinnTransport>>().await
-                } else {
-                    // Fan out N parallel dials via JoinSet. First
-                    // `Ok` wins; `Err` from a single candidate is
-                    // not fatal — we wait for the others. Only
-                    // when ALL have failed do we return Err.
-                    let mut set = tokio::task::JoinSet::new();
-                    for (idx, candidate) in dial_order.iter().enumerate() {
-                        // Phase 7: route each candidate to the
-                        // endpoint matching its address family.
-                        let candidate = *candidate;
-                        // Phase 7: IPv6 dials temporarily disabled.
-                        // IPv6 QUIC handshakes succeed but the
-                        // connection dies immediately on datagram
-                        // send ("connection lost"). Root cause is
-                        // likely router-level IPv6 UDP filtering.
-                        // Re-enable once IPv6 datagram delivery is
-                        // verified on target networks.
-                        if candidate.is_ipv6() {
-                            tracing::debug!(
-                                %candidate,
-                                candidate_idx = idx,
-                                "dual_path: skipping IPv6 candidate (disabled)"
-                            );
-                            continue;
-                        }
-                        let ep = ep_for_fut.clone();
-                        let client_cfg = wzp_transport::client_config();
-                        let sni = sni.clone();
-                        set.spawn(async move {
-                            let result = wzp_transport::connect(
-                                &ep,
-                                candidate,
-                                &sni,
-                                client_cfg,
-                            )
-                            .await;
-                            (idx, candidate, result)
-                        });
-                    }
-                    let mut last_err: Option<String> = None;
-                    while let Some(join_res) = set.join_next().await {
-                        let (idx, candidate, dial_res) = match join_res {
-                            Ok(t) => t,
-                            Err(e) => {
-                                last_err = Some(format!("join {e}"));
-                                continue;
-                            }
-                        };
-                        match dial_res {
-                            Ok(conn) => {
-                                tracing::info!(
-                                    %candidate,
-                                    candidate_idx = idx,
-                                    remote = %conn.remote_address(),
-                                    stable_id = conn.stable_id(),
-                                    "dual_path: direct dial succeeded on candidate"
-                                );
-                                // Abort the remaining in-flight
-                                // dials so they don't complete
-                                // and leak QUIC sessions.
-                                set.abort_all();
-                                return Ok(QuinnTransport::new(conn));
-                            }
-                            Err(e) => {
-                                tracing::debug!(
-                                    %candidate,
-                                    candidate_idx = idx,
-                                    error = %e,
-                                    "dual_path: direct dial failed, trying others"
-                                );
-                                last_err = Some(format!("candidate {candidate}: {e}"));
-                            }
-                        }
-                    }
-                    Err(anyhow::anyhow!(
-                        "all {} direct candidates failed; last: {}",
-                        dial_order.len(),
-                        last_err.unwrap_or_else(|| "n/a".into())
-                    ))
-                }
-            });
-            direct_ep = ep;
-        }
-    }
-
-    // Relay path: classic dial to the relay's media room. Phase 5:
-    // reuse the shared endpoint here too so MikroTik-style NATs
-    // keep a stable external port across all flows from this
-    // client. Falls back to a fresh endpoint when not shared.
-    let relay_ep = match shared_endpoint.clone() {
-        Some(ep) => ep,
-        None => {
-            let relay_bind: SocketAddr = "[::]:0".parse().unwrap();
-            wzp_transport::create_endpoint(relay_bind, None)?
-        }
-    };
-    let relay_ep_for_fut = relay_ep.clone();
-    let relay_client_cfg = wzp_transport::client_config();
-    let relay_sni = room_sni.clone();
-    // Phase 5.5 direct-path head-start: hold the relay dial for
-    // 500ms before attempting it. On same-LAN cone-NAT pairs the
-    // direct dial finishes in ~30-100ms, so giving direct a 500ms
-    // head start means direct reliably wins when it's going to
-    // work at all. The worst case adds 500ms to the fall-back-
-    // to-relay scenario, which is imperceptible for users on
-    // setups where direct isn't available anyway.
-    //
-    // Prior behavior (immediate race) caused the relay to win
-    // ~105ms races on a MikroTik LAN because:
-    //   - Acceptor role's direct_fut = accept() can only fire
-    //     when the peer has completed its outbound LAN dial
-    //   - Dialer role's parallel LAN dials need the peer's
-    //     CallSetup processed + the race started on the other
-    //     side before they can reach us
-    //   - Meanwhile relay_fut is a plain dial that completes in
-    //     whatever the client→relay RTT is (often <100ms)
-    //
-    // The 500ms head start is the minimum that empirically makes
-    // same-LAN direct reliably beat relay, without penalizing
-    // users who genuinely need the relay path.
-    const DIRECT_HEAD_START: Duration = Duration::from_millis(500);
-    let relay_fut = async move {
-        tokio::time::sleep(DIRECT_HEAD_START).await;
-        let conn =
-            wzp_transport::connect(&relay_ep_for_fut, relay_addr, &relay_sni, relay_client_cfg)
-                .await
-                .map_err(|e| anyhow::anyhow!("relay dial: {e}"))?;
-        Ok::<_, anyhow::Error>(QuinnTransport::new(conn))
-    };
-
-    // Phase 6: run both paths concurrently via tokio::spawn and
-    // collect BOTH results. The old tokio::select! approach dropped
-    // the loser, which meant the connect command couldn't negotiate
-    // with the peer — it had to commit to whichever path won locally.
-    //
-    // Now we spawn both as tasks, wait for the first to complete
-    // (that determines `local_winner`), then give the loser a short
-    // grace period to also complete. The connect command gets a
-    // RaceResult with both transports (when available) and uses the
-    // Phase 6 MediaPathReport exchange to decide which one to
-    // actually use for media.
-    tracing::info!(
-        ?role,
-        candidates = ?peer_candidates.dial_order(),
-        %relay_addr,
-        "dual_path: racing direct vs relay"
-    );
-
-    let mut direct_task = tokio::spawn(
-        tokio::time::timeout(Duration::from_secs(2), direct_fut),
-    );
-    let mut relay_task = tokio::spawn(async move {
-        // Keep the 500ms head start so direct has a chance
-        tokio::time::sleep(Duration::from_millis(500)).await;
-        tokio::time::timeout(Duration::from_secs(5), relay_fut).await
-    });
-
-    // Wait for the first one to complete. This tells us the
-    // local_winner — but we DON'T commit to it yet. Phase 6
-    // negotiation decides the actual path.
-    let (mut direct_result, mut relay_result): (
-        Option<anyhow::Result<QuinnTransport>>,
-        Option<anyhow::Result<QuinnTransport>>,
-    ) = (None, None);
-
-    let local_winner;
-
-    tokio::select! {
-        biased;
-        d = &mut direct_task => {
-            match d {
-                Ok(Ok(Ok(t))) => {
-                    tracing::info!("dual_path: direct completed first");
-                    direct_result = Some(Ok(t));
-                    local_winner = WinningPath::Direct;
-                }
-                Ok(Ok(Err(e))) => {
-                    tracing::warn!(error = %e, "dual_path: direct failed");
-                    direct_result = Some(Err(anyhow::anyhow!("{e}")));
-                    local_winner = WinningPath::Relay; // direct failed → relay is our only hope
-                }
-                Ok(Err(_)) => {
-                    tracing::warn!("dual_path: direct timed out (2s)");
-                    direct_result = Some(Err(anyhow::anyhow!("direct timeout")));
-                    local_winner = WinningPath::Relay;
-                }
-                Err(e) => {
-                    tracing::warn!(error = %e, "dual_path: direct task panicked");
-                    direct_result = Some(Err(anyhow::anyhow!("direct task panic")));
-                    local_winner = WinningPath::Relay;
-                }
-            }
-        }
-        r = &mut relay_task => {
-            match r {
-                Ok(Ok(Ok(t))) => {
-                    tracing::info!("dual_path: relay completed first");
-                    relay_result = Some(Ok(t));
-                    local_winner = WinningPath::Relay;
-                }
-                Ok(Ok(Err(e))) => {
-                    tracing::warn!(error = %e, "dual_path: relay failed");
-                    relay_result = Some(Err(anyhow::anyhow!("{e}")));
-                    local_winner = WinningPath::Direct;
-                }
-                Ok(Err(_)) => {
-                    tracing::warn!("dual_path: relay timed out");
-                    relay_result = Some(Err(anyhow::anyhow!("relay timeout")));
-                    local_winner = WinningPath::Direct;
-                }
-                Err(e) => {
-                    relay_result = Some(Err(anyhow::anyhow!("relay task panic: {e}")));
-                    local_winner = WinningPath::Direct;
-                }
-            }
-        }
-    }
-
-    // Give the loser a short grace period (1s) to also complete.
-    // If it does, we have both transports for Phase 6 negotiation.
-    // If it doesn't, we still proceed with just the winner.
-    if direct_result.is_none() {
-        match tokio::time::timeout(Duration::from_secs(1), direct_task).await {
-            Ok(Ok(Ok(Ok(t)))) => { direct_result = Some(Ok(t)); }
-            Ok(Ok(Ok(Err(e)))) => { direct_result = Some(Err(anyhow::anyhow!("{e}"))); }
-            _ => { direct_result = Some(Err(anyhow::anyhow!("direct: no result in grace period"))); }
-        }
-    }
-    if relay_result.is_none() {
-        match tokio::time::timeout(Duration::from_secs(1), relay_task).await {
-            Ok(Ok(Ok(Ok(t)))) => { relay_result = Some(Ok(t)); }
-            Ok(Ok(Ok(Err(e)))) => { relay_result = Some(Err(anyhow::anyhow!("{e}"))); }
-            _ => { relay_result = Some(Err(anyhow::anyhow!("relay: no result in grace period"))); }
-        }
-    }
-
-    let direct_ok = direct_result.as_ref().map(|r| r.is_ok()).unwrap_or(false);
-    let relay_ok = relay_result.as_ref().map(|r| r.is_ok()).unwrap_or(false);
-
-    tracing::info!(
-        ?local_winner,
-        direct_ok,
-        relay_ok,
-        "dual_path: race finished, both results collected for Phase 6 negotiation"
-    );
-
-    if !direct_ok && !relay_ok {
-        return Err(anyhow::anyhow!("both paths failed: no media transport available"));
-    }
-
-    let _ = (direct_ep, relay_ep, ipv6_endpoint);
-
-    Ok(RaceResult {
-        direct_transport: direct_result
-            .and_then(|r| r.ok())
-            .map(|t| Arc::new(t)),
-        relay_transport: relay_result
-            .and_then(|r| r.ok())
-            .map(|t| Arc::new(t)),
-        local_winner,
-    })
-}

crates/wzp-client/src/featherchat.rs

@@ -120,18 +120,6 @@ pub fn signal_to_call_type(signal: &SignalMessage) -> CallSignalType {
         SignalMessage::CallRinging { .. } => CallSignalType::Ringing,
         SignalMessage::RegisterPresence { .. }
         | SignalMessage::RegisterPresenceAck { .. } => CallSignalType::Offer, // relay-only
-        // NAT reflection is a client↔relay control exchange that
-        // never crosses the featherChat bridge — if it ever reaches
-        // this mapper something is wrong, but we still have to give
-        // an answer. "Offer" is the generic catch-all.
-        SignalMessage::Reflect
-        | SignalMessage::ReflectResponse { .. } => CallSignalType::Offer, // control-plane
-        // Phase 4 cross-relay forwarding envelope — strictly a
-        // relay-to-relay message, never rides the featherChat
-        // bridge. Catch-all mapping for completeness.
-        SignalMessage::FederatedSignalForward { .. } => CallSignalType::Offer,
-        SignalMessage::MediaPathReport { .. } => CallSignalType::Offer, // control-plane
-        SignalMessage::QualityDirective { .. } => CallSignalType::Offer, // relay-initiated
     }
 }
 
@@ -171,7 +159,6 @@ mod tests {
 
         let hangup = SignalMessage::Hangup {
             reason: wzp_proto::HangupReason::Normal,
-            call_id: None,
         };
         assert!(matches!(signal_to_call_type(&hangup), CallSignalType::Hangup));
 

crates/wzp-client/src/lib.rs

@@ -8,77 +8,16 @@
 
 #[cfg(feature = "audio")]
 pub mod audio_io;
-#[cfg(feature = "audio")]
-pub mod audio_ring;
-// VoiceProcessingIO is an Apple Core Audio API — only compile the module
-// when the `vpio` feature is on AND we're targeting macOS. Enabling the
-// feature on Windows/Linux was previously silently broken.
-#[cfg(all(feature = "vpio", target_os = "macos"))]
-pub mod audio_vpio;
-// WASAPI-direct capture with Windows's OS-level AEC (AudioCategory_Communications).
-// Only compiled when `windows-aec` feature is on AND target is Windows. The
-// `windows` dependency is itself gated to Windows in Cargo.toml, so enabling
-// this feature on non-Windows targets is a no-op.
-#[cfg(all(feature = "windows-aec", target_os = "windows"))]
-pub mod audio_wasapi;
-// WebRTC AEC3 (Audio Processing Module) wrapper around CPAL capture + playback
-// on Linux. Only compiled when `linux-aec` feature is on AND target is Linux.
-// The webrtc-audio-processing dep is itself gated to Linux in Cargo.toml.
-#[cfg(all(feature = "linux-aec", target_os = "linux"))]
-pub mod audio_linux_aec;
 pub mod bench;
 pub mod call;
 pub mod drift_test;
 pub mod echo_test;
 pub mod featherchat;
 pub mod handshake;
-pub mod dual_path;
 pub mod metrics;
-pub mod reflect;
 pub mod sweep;
 
-// AudioPlayback: three possible backends depending on feature flags.
-//   1. Default CPAL (`audio_io::AudioPlayback`) — baseline on every platform.
-//   2. Linux AEC (`audio_linux_aec::LinuxAecPlayback`) — CPAL + WebRTC APM
-//      render-side tee, so echo from speakers gets cancelled from the mic.
-//
-// On macOS and Windows we always use the default CPAL playback because:
-//   - macOS: VoiceProcessingIO handles AEC at the capture side (Apple's
-//     native hardware AEC uses its own reference signal handling).
-//   - Windows: WASAPI AudioCategory_Communications AEC uses the system
-//     render mix as reference — no per-process plumbing needed.
-//
-// Linux is the only platform where the in-app approach is necessary, so
-// the AEC playback path is gated to target_os = "linux".
-
-#[cfg(all(
-    feature = "audio",
-    any(not(feature = "linux-aec"), not(target_os = "linux"))
-))]
-pub use audio_io::AudioPlayback;
-
-#[cfg(all(feature = "linux-aec", target_os = "linux"))]
-pub use audio_linux_aec::LinuxAecPlayback as AudioPlayback;
-
-// AudioCapture: three possible backends depending on feature flags.
-//   1. Default CPAL (`audio_io::AudioCapture`) — baseline on every platform.
-//   2. Windows AEC (`audio_wasapi::WasapiAudioCapture`) — direct WASAPI
-//      with AudioCategory_Communications, OS APO chain does AEC.
-//   3. Linux AEC (`audio_linux_aec::LinuxAecCapture`) — CPAL + WebRTC APM
-//      capture-side echo cancellation using the playback tee as reference.
-// All three expose the same public API (`start`, `ring`, `stop`, `Drop`).
-
-#[cfg(all(
-    feature = "audio",
-    any(not(feature = "windows-aec"), not(target_os = "windows")),
-    any(not(feature = "linux-aec"), not(target_os = "linux"))
-))]
-pub use audio_io::AudioCapture;
-
-#[cfg(all(feature = "windows-aec", target_os = "windows"))]
-pub use audio_wasapi::WasapiAudioCapture as AudioCapture;
-
-#[cfg(all(feature = "linux-aec", target_os = "linux"))]
-pub use audio_linux_aec::LinuxAecCapture as AudioCapture;
+#[cfg(feature = "audio")]
+pub use audio_io::{AudioCapture, AudioPlayback};
 pub use call::{CallConfig, CallDecoder, CallEncoder};
 pub use handshake::perform_handshake;

crates/wzp-client/src/reflect.rs

@@ -1,679 +0,0 @@
-//! Multi-relay NAT reflection ("STUN for QUIC" — Phase 2).
-//!
-//! Phase 1 (`SignalMessage::Reflect` / `ReflectResponse`) lets a
-//! client ask a single relay "what source address do you see for
-//! me?". Phase 2 queries N relays in parallel and classifies the
-//! results into a NAT type so the future P2P hole-punching path
-//! can decide whether a direct QUIC handshake is viable:
-//!
-//! - All relays return the same `(ip, port)` → **Cone NAT**.
-//!   Endpoint-independent mapping, P2P hole-punching viable,
-//!   `consensus_addr` is the one address to advertise.
-//! - Same ip, different ports → **Symmetric port-dependent NAT**.
-//!   The mapping changes per destination, so the advertised addr
-//!   wouldn't match what a peer actually sees; fall back to
-//!   relay-mediated path.
-//! - Different ips → multi-homed / anycast / broken DNS, treat as
-//!   `Multiple` and do not attempt P2P.
-//! - 0 or 1 successful probes → `Unknown`, not enough data.
-//!
-//! A probe is a throwaway QUIC signal connection: open endpoint,
-//! connect, RegisterPresence (with a zero identity — the relay
-//! accepts this exactly like the main signaling path does), send
-//! Reflect, read ReflectResponse, close. Each probe gets its own
-//! ephemeral quinn::Endpoint so the OS assigns a fresh source port
-//! per relay — if we shared one endpoint across probes, a
-//! symmetric NAT in front of the client would map every probe to
-//! the same port and we couldn't detect it.
-
-use std::net::SocketAddr;
-use std::time::{Duration, Instant};
-
-use serde::Serialize;
-use wzp_proto::{MediaTransport, SignalMessage};
-use wzp_transport::{client_config, create_endpoint, QuinnTransport};
-
-/// Result of one probe against one relay. Always returned so the
-/// UI can render per-relay status even when some fail.
-#[derive(Debug, Clone, Serialize)]
-pub struct NatProbeResult {
-    pub relay_name: String,
-    pub relay_addr: String,
-    /// `Some` on successful probe, `None` on failure.
-    pub observed_addr: Option<String>,
-    /// End-to-end wall-clock from connect start to ReflectResponse
-    /// received, in milliseconds. `Some` only on success.
-    pub latency_ms: Option<u32>,
-    /// Human-readable error on failure.
-    pub error: Option<String>,
-}
-
-/// Aggregated classification over N `NatProbeResult`s.
-#[derive(Debug, Clone, Serialize)]
-pub struct NatDetection {
-    pub probes: Vec<NatProbeResult>,
-    pub nat_type: NatType,
-    /// When `nat_type == Cone`, the one address all probes agreed
-    /// on. `None` for every other case.
-    pub consensus_addr: Option<String>,
-}
-
-/// NAT classification. See module doc for semantics.
-#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq)]
-pub enum NatType {
-    Cone,
-    SymmetricPort,
-    Multiple,
-    Unknown,
-}
-
-/// Probe a single relay with a QUIC connection.
-///
-/// # Endpoint reuse (Phase 5 — Nebula-style architecture)
-///
-/// If `existing_endpoint` is `Some`, the probe uses that socket
-/// instead of creating a fresh one. This is the desired mode in
-/// production: a port-preserving NAT (MikroTik masquerade, most
-/// consumer routers) gives a **stable** external port for the
-/// one socket, so the reflex addr observed by ANY relay is the
-/// SAME addr and matches what a peer would see on a direct dial.
-/// Pass the signal endpoint here.
-///
-/// If `None`, creates a fresh one-shot endpoint. Kept for:
-/// - tests that spin up isolated probes
-/// - the "I'm not registered yet" case where there's no signal
-///   endpoint to reuse
-///
-/// NOTE on NAT-type detection: the pre-Phase-5 behavior of
-/// forcing a fresh endpoint per probe was wrong — it made every
-/// port-preserving NAT look symmetric because the classifier saw
-/// a different external port for each fresh source port. With
-/// one shared socket, the classifier reflects the REAL NAT
-/// behavior.
-pub async fn probe_reflect_addr(
-    relay: SocketAddr,
-    timeout_ms: u64,
-    existing_endpoint: Option<wzp_transport::Endpoint>,
-) -> Result<(SocketAddr, u32), String> {
-    // Install rustls provider idempotently — a second install on the
-    // same thread is a no-op.
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
-    let endpoint = match existing_endpoint {
-        Some(ep) => ep,
-        None => {
-            let bind: SocketAddr = "0.0.0.0:0".parse().unwrap();
-            create_endpoint(bind, None).map_err(|e| format!("endpoint: {e}"))?
-        }
-    };
-
-    let start = Instant::now();
-    let probe = async {
-        // Open the signal connection.
-        let conn =
-            wzp_transport::connect(&endpoint, relay, "_signal", client_config())
-                .await
-                .map_err(|e| format!("connect: {e}"))?;
-        let transport = QuinnTransport::new(conn);
-
-        // The relay signal handler waits for a RegisterPresence
-        // before entering its main dispatch loop (see
-        // wzp-relay/src/main.rs). So a transient probe has to
-        // register with a zero identity first — the relay accepts
-        // the empty-signature form exactly as the main signaling
-        // path does in desktop/src-tauri/src/lib.rs register_signal.
-        transport
-            .send_signal(&SignalMessage::RegisterPresence {
-                identity_pub: [0u8; 32],
-                signature: vec![],
-                alias: None,
-            })
-            .await
-            .map_err(|e| format!("send RegisterPresence: {e}"))?;
-        // Drain the RegisterPresenceAck so the response to our
-        // Reflect doesn't land on an unexpected stream order.
-        match transport.recv_signal().await {
-            Ok(Some(SignalMessage::RegisterPresenceAck { success: true, .. })) => {}
-            Ok(Some(other)) => {
-                return Err(format!(
-                    "unexpected pre-reflect signal: {:?}",
-                    std::mem::discriminant(&other)
-                ));
-            }
-            Ok(None) => return Err("connection closed before RegisterPresenceAck".into()),
-            Err(e) => return Err(format!("recv RegisterPresenceAck: {e}")),
-        }
-
-        // Send Reflect and await response.
-        transport
-            .send_signal(&SignalMessage::Reflect)
-            .await
-            .map_err(|e| format!("send Reflect: {e}"))?;
-
-        match transport.recv_signal().await {
-            Ok(Some(SignalMessage::ReflectResponse { observed_addr })) => {
-                let parsed: SocketAddr = observed_addr
-                    .parse()
-                    .map_err(|e| format!("parse observed_addr {observed_addr:?}: {e}"))?;
-                let latency_ms = start.elapsed().as_millis() as u32;
-
-                // Clean close so the relay's per-connection cleanup
-                // runs promptly and we don't leak file descriptors.
-                let _ = transport.close().await;
-
-                Ok((parsed, latency_ms))
-            }
-            Ok(Some(other)) => Err(format!(
-                "expected ReflectResponse, got {:?}",
-                std::mem::discriminant(&other)
-            )),
-            Ok(None) => Err("connection closed before ReflectResponse".into()),
-            Err(e) => Err(format!("recv ReflectResponse: {e}")),
-        }
-    };
-
-    let out = tokio::time::timeout(Duration::from_millis(timeout_ms), probe)
-        .await
-        .map_err(|_| format!("probe timeout ({timeout_ms}ms)"))??;
-
-    // `endpoint` is a quinn::Endpoint clone — an Arc under the
-    // hood. Letting it drop at end-of-scope is correct whether it
-    // was fresh (last ref → socket closes) or shared (ref count
-    // decrements, socket stays alive for the signal loop).
-    Ok(out)
-}
-
-/// Detect the client's NAT type by probing N relays in parallel and
-/// classifying the returned addresses. Never errors — failing
-/// probes surface via `NatProbeResult.error`; aggregate is always
-/// returned.
-///
-/// # Endpoint reuse (Phase 5)
-///
-/// If `shared_endpoint` is `Some`, every probe reuses it. This is
-/// the PRODUCTION behavior: all probes source from the same UDP
-/// port, so port-preserving NATs map them to the same external
-/// port, and the classifier reflects the real NAT type. Pass the
-/// signal endpoint.
-///
-/// If `None`, each probe creates its own fresh endpoint — useful
-/// in tests that don't have a signal endpoint, but produces
-/// spurious `SymmetricPort` classifications against NATs that
-/// would otherwise look cone-like.
-pub async fn detect_nat_type(
-    relays: Vec<(String, SocketAddr)>,
-    timeout_ms: u64,
-    shared_endpoint: Option<wzp_transport::Endpoint>,
-) -> NatDetection {
-    // Parallel probes via tokio::task::JoinSet so the wall-clock is
-    // bounded by the slowest probe, not the sum. JoinSet keeps the
-    // dep surface at just tokio — we already depend on it.
-    let mut set = tokio::task::JoinSet::new();
-    for (name, addr) in relays {
-        let ep = shared_endpoint.clone();
-        set.spawn(async move {
-            let result = probe_reflect_addr(addr, timeout_ms, ep).await;
-            (name, addr, result)
-        });
-    }
-
-    let mut probes = Vec::new();
-    while let Some(join_result) = set.join_next().await {
-        let (name, addr, result) = match join_result {
-            Ok(tuple) => tuple,
-            // Task panicked — surface as a synthetic failed probe so
-            // the aggregate still returns a reasonable shape. This
-            // shouldn't happen but we don't want one bad probe to
-            // poison the whole detection.
-            Err(join_err) => {
-                probes.push(NatProbeResult {
-                    relay_name: "<panicked>".into(),
-                    relay_addr: "unknown".into(),
-                    observed_addr: None,
-                    latency_ms: None,
-                    error: Some(format!("probe task panicked: {join_err}")),
-                });
-                continue;
-            }
-        };
-        probes.push(match result {
-            Ok((observed, latency_ms)) => NatProbeResult {
-                relay_name: name,
-                relay_addr: addr.to_string(),
-                observed_addr: Some(observed.to_string()),
-                latency_ms: Some(latency_ms),
-                error: None,
-            },
-            Err(e) => NatProbeResult {
-                relay_name: name,
-                relay_addr: addr.to_string(),
-                observed_addr: None,
-                latency_ms: None,
-                error: Some(e),
-            },
-        });
-    }
-
-    let (nat_type, consensus_addr) = classify_nat(&probes);
-    NatDetection {
-        probes,
-        nat_type,
-        consensus_addr,
-    }
-}
-
-/// Enumerate LAN-local host candidates this client is reachable
-/// on, paired with the given port (typically the signal
-/// endpoint's bound port so that incoming dials land on the same
-/// socket the advertised reflex addr points to).
-///
-/// Gathers BOTH IPv4 and IPv6 candidates:
-///
-/// - **IPv4**: RFC1918 private ranges (10/8, 172.16/12, 192.168/16)
-///   and CGNAT shared-transition (100.64/10). Public IPv4 is
-///   skipped because the reflex-addr path already covers it.
-///   Loopback and link-local (169.254/16) are skipped.
-///
-/// - **IPv6**: ALL global-unicast addresses (2000::/3 — the real
-///   routable IPv6 space) AND unique-local (fc00::/7). These
-///   are directly dialable from a peer on the same LAN, and on
-///   true dual-stack LANs (which most consumer ISPs now provide,
-///   including Starlink) IPv6 often gives a direct path even
-///   when IPv4 can't hairpin. Loopback (::1), unspecified (::),
-///   and link-local (fe80::/10) are skipped — link-local would
-///   require a scope ID to be useful and is basically never
-///   reachable across interface boundaries.
-///
-/// The port must come from the caller — typically
-/// `signal_endpoint.local_addr()?.port()`, so that the peer's
-/// dials to these addresses land on the same socket that's
-/// already listening (Phase 5 shared-endpoint architecture).
-///
-/// Safe to call from any thread; no I/O, no async. The `if-addrs`
-/// crate reads the kernel's interface table via a single
-/// getifaddrs(3) syscall.
-pub fn local_host_candidates(v4_port: u16, v6_port: Option<u16>) -> Vec<SocketAddr> {
-    let Ok(ifaces) = if_addrs::get_if_addrs() else {
-        return Vec::new();
-    };
-    let mut out = Vec::new();
-    for iface in ifaces {
-        if iface.is_loopback() {
-            continue;
-        }
-        match iface.ip() {
-            std::net::IpAddr::V4(v4) => {
-                if v4.is_link_local() {
-                    continue;
-                }
-                // Keep RFC1918 private ranges and CGNAT — those
-                // are the LAN-dialable addrs we actually want.
-                // Skip public v4 because the reflex addr already
-                // covers that path.
-                if v4.is_private() {
-                    out.push(SocketAddr::new(std::net::IpAddr::V4(v4), v4_port));
-                } else if v4.octets()[0] == 100 && (v4.octets()[1] & 0xc0) == 0x40 {
-                    // 100.64/10 CGNAT — rare but valid if two
-                    // phones are on the same CGNAT-hairpinned
-                    // carrier LAN (some hotspot setups).
-                    out.push(SocketAddr::new(std::net::IpAddr::V4(v4), v4_port));
-                }
-            }
-            std::net::IpAddr::V6(v6) => {
-                // Phase 7: IPv6 host candidates via dedicated
-                // IPv6 socket. When v6_port is None, no IPv6
-                // endpoint exists — skip silently.
-                let Some(port) = v6_port else { continue };
-                if v6.is_loopback() || v6.is_unspecified() {
-                    continue;
-                }
-                // fe80::/10 link-local — needs scope ID, not
-                // routable across interfaces.
-                if (v6.segments()[0] & 0xffc0) == 0xfe80 {
-                    continue;
-                }
-                // Accept global unicast (2000::/3) and
-                // unique-local (fc00::/7).
-                let first_seg = v6.segments()[0];
-                let is_global = (first_seg & 0xe000) == 0x2000;
-                let is_ula = (first_seg & 0xfe00) == 0xfc00;
-                if is_global || is_ula {
-                    out.push(SocketAddr::new(std::net::IpAddr::V6(v6), port));
-                }
-            }
-        }
-    }
-    out
-}
-
-/// Role assignment for the Phase 3.5 dual-path QUIC race.
-///
-/// Both peers already know two strings at CallSetup time: their
-/// own server-reflexive address (queried via Phase 1 Reflect) and
-/// the peer's (carried in `CallSetup.peer_direct_addr`). To avoid
-/// a negotiation round-trip, both sides compare the two strings
-/// lexicographically and agree on a deterministic role:
-///
-/// - **Acceptor** — lexicographically smaller addr. Listens for
-///   an incoming direct connection from the peer. Does NOT dial.
-/// - **Dialer**   — lexicographically larger addr. Dials the
-///   peer's direct addr. Does NOT listen.
-///
-/// Both roles ALSO dial the relay in parallel as a fallback.
-/// Whichever future (direct or relay) completes first is used as
-/// the media transport. Because the role is deterministic and
-/// symmetric, both peers end up holding the same underlying QUIC
-/// session on the direct path — A's accepted conn and D's dialed
-/// conn are literally the same connection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Role {
-    /// This peer listens for the direct incoming connection.
-    Acceptor,
-    /// This peer dials the peer's direct address.
-    Dialer,
-}
-
-/// Compute the deterministic role for this peer in the dual-path
-/// race. Returns `None` when no direct attempt is possible —
-/// either peer didn't advertise a reflex addr, or the two addrs
-/// are identical (same host on loopback / mis-advertised).
-///
-/// The caller should treat `None` as "skip direct, relay-only".
-pub fn determine_role(
-    own_reflex_addr: Option<&str>,
-    peer_reflex_addr: Option<&str>,
-) -> Option<Role> {
-    let (own, peer) = match (own_reflex_addr, peer_reflex_addr) {
-        (Some(o), Some(p)) => (o, p),
-        _ => return None,
-    };
-    match own.cmp(peer) {
-        std::cmp::Ordering::Less => Some(Role::Acceptor),
-        std::cmp::Ordering::Greater => Some(Role::Dialer),
-        // Equal addrs should never happen in production (both
-        // peers behind the same NAT mapping + same port would be
-        // a degenerate case). Guard against it so we don't infinite-
-        // loop waiting for a connection to ourselves.
-        std::cmp::Ordering::Equal => None,
-    }
-}
-
-/// Returns `true` if the address is in an RFC1918 / link-local /
-/// loopback range and therefore cannot possibly be a post-NAT
-/// reflex address from the public internet's point of view.
-///
-/// A probe against a relay ON THE SAME LAN as the client will
-/// naturally report the client's LAN IP back (because there's no
-/// NAT between them) — that observation is real but says nothing
-/// about the client's public-internet-facing NAT state. Mixing
-/// LAN reflex addrs with public-internet reflex addrs in
-/// `classify_nat` would always report `Multiple` (different IPs)
-/// and falsely warn about symmetric NAT. Filter them out before
-/// classifying.
-fn is_private_or_loopback(addr: &SocketAddr) -> bool {
-    match addr.ip() {
-        std::net::IpAddr::V4(v4) => {
-            let o = v4.octets();
-            v4.is_loopback()
-                || v4.is_private() // 10/8, 172.16/12, 192.168/16
-                || v4.is_link_local() // 169.254/16
-                || (o[0] == 100 && (o[1] & 0xc0) == 0x40) // 100.64/10 CGNAT shared
-        }
-        std::net::IpAddr::V6(v6) => {
-            v6.is_loopback() || v6.is_unspecified() || (v6.segments()[0] & 0xffc0) == 0xfe80 // fe80::/10 link-local
-        }
-    }
-}
-
-/// Pure-function NAT classifier — split out for unit testing
-/// without touching the network.
-///
-/// Only considers probes whose reflex addr is a **public-internet**
-/// address. LAN / private / loopback reflex addrs are dropped
-/// because they reflect the same-network path rather than the
-/// real NAT state. CGNAT (100.64/10) is also treated as private
-/// because the post-CGNAT address would be what we actually want
-/// to classify on — but CGNAT is unreachable from outside the
-/// carrier, so a relay seeing the CGNAT addr is on the same
-/// carrier network and again not useful for classification.
-pub fn classify_nat(probes: &[NatProbeResult]) -> (NatType, Option<String>) {
-    // First: parse every successful probe's observed addr.
-    let parsed: Vec<SocketAddr> = probes
-        .iter()
-        .filter_map(|p| p.observed_addr.as_deref().and_then(|s| s.parse().ok()))
-        .collect();
-
-    // Then: drop LAN / private / loopback reflex addrs. Those are
-    // legitimate observations by same-network relays, but they
-    // don't contribute to NAT-type classification because the
-    // client's real public-facing NAT mapping is not involved on
-    // that path. A relay on the same LAN always sees the client's
-    // LAN IP, regardless of whether the NAT beyond it is cone or
-    // symmetric.
-    let successes: Vec<SocketAddr> = parsed
-        .into_iter()
-        .filter(|a| !is_private_or_loopback(a))
-        .collect();
-
-    if successes.len() < 2 {
-        return (NatType::Unknown, None);
-    }
-
-    let first = successes[0];
-    let same_ip = successes.iter().all(|a| a.ip() == first.ip());
-    if !same_ip {
-        return (NatType::Multiple, None);
-    }
-
-    let same_port = successes.iter().all(|a| a.port() == first.port());
-    if same_port {
-        (NatType::Cone, Some(first.to_string()))
-    } else {
-        (NatType::SymmetricPort, None)
-    }
-}
-
-// ── Unit tests for the pure classifier ───────────────────────────
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn mk(addr: Option<&str>) -> NatProbeResult {
-        NatProbeResult {
-            relay_name: "test".into(),
-            relay_addr: "0.0.0.0:0".into(),
-            observed_addr: addr.map(|s| s.to_string()),
-            latency_ms: addr.map(|_| 10),
-            error: None,
-        }
-    }
-
-    #[test]
-    fn classify_empty_is_unknown() {
-        let (nt, addr) = classify_nat(&[]);
-        assert_eq!(nt, NatType::Unknown);
-        assert!(addr.is_none());
-    }
-
-    #[test]
-    fn classify_single_success_is_unknown() {
-        let probes = vec![mk(Some("192.0.2.1:4433"))];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Unknown);
-        assert!(addr.is_none());
-    }
-
-    #[test]
-    fn classify_two_identical_is_cone() {
-        let probes = vec![
-            mk(Some("192.0.2.1:4433")),
-            mk(Some("192.0.2.1:4433")),
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Cone);
-        assert_eq!(addr.as_deref(), Some("192.0.2.1:4433"));
-    }
-
-    #[test]
-    fn classify_same_ip_different_ports_is_symmetric() {
-        let probes = vec![
-            mk(Some("192.0.2.1:4433")),
-            mk(Some("192.0.2.1:51234")),
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::SymmetricPort);
-        assert!(addr.is_none());
-    }
-
-    #[test]
-    fn classify_different_ips_is_multiple() {
-        let probes = vec![
-            mk(Some("192.0.2.1:4433")),
-            mk(Some("198.51.100.9:4433")),
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Multiple);
-        assert!(addr.is_none());
-    }
-
-    #[test]
-    fn classify_drops_private_ip_probes() {
-        // One LAN probe + one public probe should behave like a
-        // single public probe — i.e. Unknown (not enough data to
-        // classify). This is the common real-world case: the user
-        // has a LAN relay + an internet relay configured, the LAN
-        // relay sees the LAN IP, the internet relay sees the WAN
-        // IP, and the old classifier would flag "Multiple" and
-        // falsely warn about symmetric NAT.
-        let probes = vec![
-            mk(Some("192.168.1.100:4433")), // LAN — must be dropped
-            mk(Some("203.0.113.5:4433")),   // public (TEST-NET-3)
-        ];
-        let (nt, _) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Unknown);
-    }
-
-    #[test]
-    fn classify_drops_loopback_probes() {
-        let probes = vec![
-            mk(Some("127.0.0.1:4433")),     // loopback — must be dropped
-            mk(Some("203.0.113.5:4433")),   // public
-            mk(Some("203.0.113.5:4433")),   // public, same addr
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        // Two public probes with identical addrs → Cone.
-        assert_eq!(nt, NatType::Cone);
-        assert_eq!(addr.as_deref(), Some("203.0.113.5:4433"));
-    }
-
-    #[test]
-    fn classify_drops_cgnat_probes() {
-        // 100.64.0.0/10 is the CGNAT shared-transition range.
-        // Filter treats it like RFC1918 — a relay that sees the
-        // client with a 100.64/10 addr is on the same CGNAT
-        // network and can't contribute to public NAT classification.
-        let probes = vec![
-            mk(Some("100.64.0.42:4433")),   // CGNAT — dropped
-            mk(Some("203.0.113.5:4433")),   // public
-            mk(Some("203.0.113.5:12345")),  // public, different port
-        ];
-        let (nt, _) = classify_nat(&probes);
-        // Two public probes same IP different port → SymmetricPort.
-        assert_eq!(nt, NatType::SymmetricPort);
-    }
-
-    #[test]
-    fn classify_two_lan_probes_is_unknown_not_cone() {
-        // Even if both probes come back from LAN relays, we can't
-        // say anything useful about the public NAT state. Unknown,
-        // not Cone.
-        let probes = vec![
-            mk(Some("192.168.1.100:4433")),
-            mk(Some("192.168.1.100:4433")),
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Unknown);
-        assert!(addr.is_none());
-    }
-
-    #[test]
-    fn classify_mix_of_success_and_failure() {
-        let probes = vec![
-            mk(Some("192.0.2.1:4433")),
-            mk(None), // failed probe
-            mk(Some("192.0.2.1:4433")),
-        ];
-        let (nt, addr) = classify_nat(&probes);
-        // Two successes both agree → Cone, ignore the failure row.
-        assert_eq!(nt, NatType::Cone);
-        assert_eq!(addr.as_deref(), Some("192.0.2.1:4433"));
-    }
-
-    #[test]
-    fn determine_role_smaller_is_acceptor() {
-        // Lexicographic: "192.0.2.1:4433" < "198.51.100.9:4433"
-        assert_eq!(
-            determine_role(Some("192.0.2.1:4433"), Some("198.51.100.9:4433")),
-            Some(Role::Acceptor)
-        );
-    }
-
-    #[test]
-    fn determine_role_larger_is_dialer() {
-        assert_eq!(
-            determine_role(Some("198.51.100.9:4433"), Some("192.0.2.1:4433")),
-            Some(Role::Dialer)
-        );
-    }
-
-    #[test]
-    fn determine_role_port_difference_matters() {
-        // Same ip, different ports — string compare still works
-        // because "4433" < "54321".
-        assert_eq!(
-            determine_role(Some("127.0.0.1:4433"), Some("127.0.0.1:54321")),
-            Some(Role::Acceptor)
-        );
-        assert_eq!(
-            determine_role(Some("127.0.0.1:54321"), Some("127.0.0.1:4433")),
-            Some(Role::Dialer)
-        );
-    }
-
-    #[test]
-    fn determine_role_equal_addrs_is_none() {
-        assert_eq!(
-            determine_role(Some("192.0.2.1:4433"), Some("192.0.2.1:4433")),
-            None
-        );
-    }
-
-    #[test]
-    fn determine_role_missing_side_is_none() {
-        assert_eq!(determine_role(None, Some("192.0.2.1:4433")), None);
-        assert_eq!(determine_role(Some("192.0.2.1:4433"), None), None);
-        assert_eq!(determine_role(None, None), None);
-    }
-
-    #[test]
-    fn determine_role_is_symmetric_across_peers() {
-        // Both peers compute roles independently; they must end
-        // up with opposite assignments (one Acceptor, one Dialer)
-        // so that each side ends up talking to the other.
-        let a = "192.0.2.1:4433";
-        let b = "198.51.100.9:4433";
-        let alice_role = determine_role(Some(a), Some(b));
-        let bob_role = determine_role(Some(b), Some(a));
-        assert_eq!(alice_role, Some(Role::Acceptor));
-        assert_eq!(bob_role, Some(Role::Dialer));
-    }
-
-    #[test]
-    fn classify_one_success_one_failure_is_unknown() {
-        let probes = vec![mk(Some("192.0.2.1:4433")), mk(None)];
-        let (nt, addr) = classify_nat(&probes);
-        assert_eq!(nt, NatType::Unknown);
-        assert!(addr.is_none());
-    }
-}

crates/wzp-client/tests/dual_path.rs

@@ -1,213 +0,0 @@
-//! Phase 3.5 integration tests for the dual-path QUIC race.
-//!
-//! The race takes a role (Acceptor or Dialer), a peer_direct_addr,
-//! a relay_addr, and two SNI strings, then returns whichever QUIC
-//! handshake completes first wrapped in a `QuinnTransport`. These
-//! tests validate that:
-//!
-//! 1. On loopback with two real clients playing A + D roles, the
-//!    direct path wins (fewer hops than relay).
-//! 2. When the direct peer is dead (nothing listening) but the
-//!    relay is up, the relay wins within the fallback window.
-//! 3. When both paths are dead, the race errors cleanly rather
-//!    than hanging forever.
-//!
-//! The "relay" in these tests is a minimal mock that just accepts
-//! an incoming QUIC connection and drops it — we don't need any
-//! protocol handling, just a TCP-ish listen-and-accept.
-
-use std::net::{Ipv4Addr, SocketAddr};
-use std::time::Duration;
-
-use wzp_client::dual_path::{race, PeerCandidates, WinningPath};
-use wzp_client::reflect::Role;
-use wzp_transport::{create_endpoint, server_config};
-
-/// Spin up a "relay-ish" mock server on loopback that accepts
-/// incoming QUIC connections and does nothing with them. Used to
-/// give the relay branch of the race a real target to dial.
-/// Returns the bound address + a join handle (kept alive to keep
-/// the endpoint up).
-async fn spawn_mock_relay() -> (SocketAddr, tokio::task::JoinHandle<()>) {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-    let (sc, _cert_der) = server_config();
-    let bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let ep = create_endpoint(bind, Some(sc)).expect("relay endpoint");
-    let addr = ep.local_addr().expect("local_addr");
-
-    let handle = tokio::spawn(async move {
-        // Accept loop — hold the connection alive for a short
-        // while so the race result isn't killed by the peer
-        // closing before the winning transport is returned.
-        while let Some(incoming) = ep.accept().await {
-            if let Ok(_conn) = incoming.await {
-                tokio::time::sleep(Duration::from_secs(5)).await;
-            }
-        }
-    });
-    (addr, handle)
-}
-
-// -----------------------------------------------------------------------
-// Test 1: direct path wins when both sides are up
-// -----------------------------------------------------------------------
-//
-// Spawn a mock relay, then set up a two-client test where one
-// client plays the Acceptor role and the other plays the Dialer
-// role. The Dialer's `peer_direct_addr` is the Acceptor's listen
-// address. Because the direct path is a single loopback hop and
-// the relay dial also terminates on loopback, both complete
-// essentially instantly — the `biased` tokio::select in race()
-// should pick direct.
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn dual_path_direct_wins_on_loopback() {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
-
-    // Acceptor task: run race(Role::Acceptor, peer_addr_placeholder, ...).
-    // Since the acceptor doesn't dial, the peer_direct_addr arg is
-    // unused on the direct branch but we still pass a placeholder
-    // because the API takes one. Use a stub addr that would error
-    // if it were ever dialed — proving the Acceptor really doesn't
-    // reach it.
-    let unused_addr: SocketAddr = "127.0.0.1:2".parse().unwrap();
-
-    // We can't race both sides in the same task because each race
-    // call has its own direct endpoint that needs to talk to the
-    // OTHER side's endpoint. So spawn the Acceptor in a task and
-    // let it expose its listen addr via a oneshot back to the test,
-    // then run the Dialer in the test's main task.
-    //
-    // There's a chicken-and-egg issue: the Acceptor's listen addr
-    // is only known after race() creates its endpoint. To avoid
-    // reaching into race()'s internals, we instead play a slight
-    // trick: create the Acceptor's endpoint ourselves (outside
-    // race()) to learn its addr, spin up an accept loop on it
-    // ourselves, and pass THAT addr as the Dialer's peer addr.
-    // This tests the Dialer->Acceptor handshake end-to-end without
-    // running the full race() on both sides.
-
-    let (sc, _cert_der) = server_config();
-    let acceptor_bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let acceptor_ep = create_endpoint(acceptor_bind, Some(sc)).expect("acceptor ep");
-    let acceptor_listen_addr = acceptor_ep.local_addr().expect("acceptor addr");
-
-    // Drop the external acceptor after the test finishes, not
-    // before — spawn a dedicated accept task.
-    let acceptor_accept_task = tokio::spawn(async move {
-        // Accept one connection and hold it for a while so the
-        // Dialer side can complete its QUIC handshake.
-        if let Some(incoming) = acceptor_ep.accept().await {
-            if let Ok(_conn) = incoming.await {
-                tokio::time::sleep(Duration::from_secs(5)).await;
-            }
-        }
-    });
-
-    // Now run the Dialer in the race — peer_direct_addr = acceptor's
-    // listen addr. The relay is the mock from above. Direct path
-    // should win.
-    let result = race(
-        Role::Dialer,
-        PeerCandidates {
-            reflexive: Some(acceptor_listen_addr),
-            local: Vec::new(),
-        },
-        relay_addr,
-        "test-room".into(),
-        "call-test".into(),
-        None, // Phase 5: tests use fresh endpoints (no shared signal)
-    )
-    .await
-    .expect("race must succeed");
-
-    assert!(result.direct_transport.is_some(), "direct transport should be available");
-    assert_eq!(result.local_winner, WinningPath::Direct, "direct should win on loopback");
-
-    // Cancel the acceptor accept task so the test finishes.
-    acceptor_accept_task.abort();
-    // Suppress unused-var warning for the placeholder.
-    let _ = unused_addr;
-}
-
-// -----------------------------------------------------------------------
-// Test 2: relay wins when the direct peer is dead
-// -----------------------------------------------------------------------
-//
-// Dialer role, peer_direct_addr = a port nothing is listening on,
-// relay is the working mock. Direct dial will sit waiting for a
-// QUIC handshake that never comes; the 2s direct timeout kicks in
-// and the relay path wins the fallback.
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn dual_path_relay_wins_when_direct_is_dead() {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
-
-    // A port that nothing is listening on — dead direct target.
-    // Port 1 on loopback is almost never bound and UDP packets to
-    // it will be dropped silently, so the QUIC handshake times out.
-    let dead_peer: SocketAddr = "127.0.0.1:1".parse().unwrap();
-
-    let result = race(
-        Role::Dialer,
-        PeerCandidates {
-            reflexive: Some(dead_peer),
-            local: Vec::new(),
-        },
-        relay_addr,
-        "test-room".into(),
-        "call-test".into(),
-        None, // Phase 5: tests use fresh endpoints (no shared signal)
-    )
-    .await
-    .expect("race must succeed via relay fallback");
-
-    assert!(result.relay_transport.is_some(), "relay transport should be available");
-    assert_eq!(
-        result.local_winner,
-        WinningPath::Relay,
-        "relay should win when direct dial has nowhere to land"
-    );
-}
-
-// -----------------------------------------------------------------------
-// Test 3: race errors cleanly when both paths are dead
-// -----------------------------------------------------------------------
-//
-// Dialer role, peer_direct_addr = dead, relay_addr = dead.
-// Expected: race returns an Err within ~7s (2s direct timeout +
-// 5s relay timeout fallback).
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn dual_path_errors_cleanly_when_both_paths_dead() {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
-    let dead_peer: SocketAddr = "127.0.0.1:1".parse().unwrap();
-    let dead_relay: SocketAddr = "127.0.0.1:2".parse().unwrap();
-
-    let start = std::time::Instant::now();
-    let result = race(
-        Role::Dialer,
-        PeerCandidates {
-            reflexive: Some(dead_peer),
-            local: Vec::new(),
-        },
-        dead_relay,
-        "test-room".into(),
-        "call-test".into(),
-        None, // Phase 5: tests use fresh endpoints (no shared signal)
-    )
-    .await;
-    let elapsed = start.elapsed();
-
-    assert!(result.is_err(), "both-dead must return Err");
-    // Upper bound: direct 2s timeout + relay 5s fallback + small
-    // slack for scheduling. If this blows, something is looping.
-    assert!(
-        elapsed < Duration::from_secs(10),
-        "race took too long to give up: {:?}",
-        elapsed
-    );
-}

crates/wzp-client/tests/handshake_integration.rs

@@ -83,12 +83,12 @@ async fn full_handshake_both_sides_derive_same_session() {
 
     // Run client and relay handshakes concurrently.
     let (client_result, relay_result) = tokio::join!(
-        wzp_client::handshake::perform_handshake(client_transport_clone.as_ref(), &client_seed, None),
+        wzp_client::handshake::perform_handshake(client_transport_clone.as_ref(), &client_seed),
         wzp_relay::handshake::accept_handshake(relay_transport_clone.as_ref(), &relay_seed),
     );
 
     let mut client_session = client_result.expect("client handshake should succeed");
-    let (mut relay_session, chosen_profile, _caller_fp, _caller_alias) =
+    let (mut relay_session, chosen_profile) =
         relay_result.expect("relay handshake should succeed");
 
     // Verify a profile was chosen.
@@ -151,7 +151,6 @@ async fn handshake_rejects_tampered_signature() {
             ephemeral_pub,
             signature: bad_signature,
             supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
-            alias: None,
         };
         client_transport_clone
             .send_signal(&offer)

crates/wzp-codec/src/adaptive.rs

@@ -116,14 +116,6 @@ impl AudioEncoder for AdaptiveEncoder {
     fn set_dtx(&mut self, enabled: bool) {
         self.opus.set_dtx(enabled);
     }
-
-    fn set_expected_loss(&mut self, loss_pct: u8) {
-        self.opus.set_expected_loss(loss_pct);
-    }
-
-    fn set_dred_duration(&mut self, frames: u8) {
-        self.opus.set_dred_duration(frames);
-    }
 }
 
 // ─── AdaptiveDecoder ─────────────────────────────────────────────────────────

crates/wzp-codec/src/aec.rs

@@ -1,127 +1,53 @@
-//! Acoustic Echo Cancellation — delay-compensated leaky NLMS with
-//! Geigel double-talk detection.
-//!
-//! Key insight: on a laptop, the round-trip audio latency (playout → speaker
-//! → air → mic → capture) is 30–50ms.  The far-end reference must be delayed
-//! by this amount so the adaptive filter models the *echo path*, not the
-//! *system delay + echo path*.
-//!
-//! The leaky coefficient decay prevents the filter from diverging when the
-//! echo path changes (e.g. hand near laptop) or when the delay estimate
-//! is slightly off.
+//! Acoustic Echo Cancellation using NLMS adaptive filter.
+//! Processes 480-sample (10ms) sub-frames at 48kHz.
 
-/// Delay-compensated leaky NLMS echo canceller with Geigel DTD.
+/// NLMS (Normalized Least Mean Squares) adaptive filter echo canceller.
+///
+/// Removes acoustic echo by modelling the echo path between the far-end
+/// (speaker) signal and the near-end (microphone) signal, then subtracting
+/// the estimated echo from the near-end in real time.
 pub struct EchoCanceller {
-    // --- Adaptive filter ---
-    filter: Vec<f32>,
+    filter_coeffs: Vec<f32>,
     filter_len: usize,
-    /// Circular buffer of far-end reference samples (after delay).
-    far_buf: Vec<f32>,
-    far_pos: usize,
-    /// NLMS step size.
+    far_end_buf: Vec<f32>,
+    far_end_pos: usize,
     mu: f32,
-    /// Leakage factor: coefficients are multiplied by (1 - leak) each frame.
-    /// Prevents unbounded growth / divergence.  0.0001 is gentle.
-    leak: f32,
     enabled: bool,
-
-    // --- Delay buffer ---
-    /// Raw far-end samples before delay compensation.
-    delay_ring: Vec<f32>,
-    delay_write: usize,
-    delay_read: usize,
-    /// Delay in samples (e.g. 1920 = 40ms at 48kHz).
-    delay_samples: usize,
-    /// Capacity of the delay ring.
-    delay_cap: usize,
-
-    // --- Double-talk detection (Geigel) ---
-    /// Peak far-end level over the last filter_len samples.
-    far_peak: f32,
-    /// Geigel threshold: if |near| > threshold * far_peak, assume double-talk.
-    geigel_threshold: f32,
-    /// Holdover counter: keep DTD active for a few frames after detection.
-    dtd_holdover: u32,
-    dtd_hold_frames: u32,
 }
 
 impl EchoCanceller {
     /// Create a new echo canceller.
     ///
     /// * `sample_rate` — typically 48000
-    /// * `filter_ms`   — echo-tail length in milliseconds (60ms recommended)
-    /// * `delay_ms`    — far-end delay compensation in milliseconds (40ms for laptops)
+    /// * `filter_ms`   — echo-tail length in milliseconds (e.g. 100 for 100 ms)
     pub fn new(sample_rate: u32, filter_ms: u32) -> Self {
-        Self::with_delay(sample_rate, filter_ms, 40)
-    }
-
-    pub fn with_delay(sample_rate: u32, filter_ms: u32, delay_ms: u32) -> Self {
         let filter_len = (sample_rate as usize) * (filter_ms as usize) / 1000;
-        let delay_samples = (sample_rate as usize) * (delay_ms as usize) / 1000;
-        // Delay ring must hold at least delay_samples + one frame (960) of headroom.
-        let delay_cap = delay_samples + (sample_rate as usize / 10); // +100ms headroom
         Self {
-            filter: vec![0.0; filter_len],
+            filter_coeffs: vec![0.0f32; filter_len],
             filter_len,
-            far_buf: vec![0.0; filter_len],
-            far_pos: 0,
+            far_end_buf: vec![0.0f32; filter_len],
+            far_end_pos: 0,
             mu: 0.01,
-            leak: 0.0001,
             enabled: true,
-
-            delay_ring: vec![0.0; delay_cap],
-            delay_write: 0,
-            delay_read: 0,
-            delay_samples,
-            delay_cap,
-
-            far_peak: 0.0,
-            geigel_threshold: 0.7,
-            dtd_holdover: 0,
-            dtd_hold_frames: 5,
         }
     }
 
-    /// Feed far-end (speaker) samples.  These go into the delay buffer first;
-    /// once enough samples have accumulated, they are released to the filter's
-    /// circular buffer with the correct delay offset.
+    /// Feed far-end (speaker/playback) samples into the circular buffer.
+    ///
+    /// Must be called with the audio that was played out through the speaker
+    /// *before* the corresponding near-end frame is processed.
     pub fn feed_farend(&mut self, farend: &[i16]) {
-        // Write raw samples into the delay ring.
         for &s in farend {
-            self.delay_ring[self.delay_write % self.delay_cap] = s as f32;
-            self.delay_write += 1;
-        }
-
-        // Release delayed samples to the filter's far-end buffer.
-        while self.delay_available() >= 1 {
-            let sample = self.delay_ring[self.delay_read % self.delay_cap];
-            self.delay_read += 1;
-
-            self.far_buf[self.far_pos] = sample;
-            self.far_pos = (self.far_pos + 1) % self.filter_len;
-
-            // Track peak far-end level for Geigel DTD.
-            let abs_s = sample.abs();
-            if abs_s > self.far_peak {
-                self.far_peak = abs_s;
-            }
-        }
-
-        // Decay far_peak slowly (avoids stale peak from a loud burst long ago).
-        self.far_peak *= 0.9995;
-    }
-
-    /// Number of delayed samples available to release.
-    fn delay_available(&self) -> usize {
-        let buffered = self.delay_write - self.delay_read;
-        if buffered > self.delay_samples {
-            buffered - self.delay_samples
-        } else {
-            0
+            self.far_end_buf[self.far_end_pos] = s as f32;
+            self.far_end_pos = (self.far_end_pos + 1) % self.filter_len;
         }
     }
 
     /// Process a near-end (microphone) frame, removing the estimated echo.
+    ///
+    /// Returns the echo-return-loss enhancement (ERLE) as a ratio: the RMS of
+    /// the original near-end divided by the RMS of the residual.  Values > 1.0
+    /// mean echo was reduced.
     pub fn process_frame(&mut self, nearend: &mut [i16]) -> f32 {
         if !self.enabled {
             return 1.0;
@@ -130,96 +56,85 @@ impl EchoCanceller {
         let n = nearend.len();
         let fl = self.filter_len;
 
-        // --- Geigel double-talk detection ---
-        // If any near-end sample exceeds threshold * far_peak, assume
-        // the local speaker is active and freeze adaptation.
-        let mut is_doubletalk = self.dtd_holdover > 0;
-        if !is_doubletalk {
-            let threshold_level = self.geigel_threshold * self.far_peak;
-            for &s in nearend.iter() {
-                if (s as f32).abs() > threshold_level && self.far_peak > 100.0 {
-                    is_doubletalk = true;
-                    self.dtd_holdover = self.dtd_hold_frames;
-                    break;
-                }
-            }
-        }
-        if self.dtd_holdover > 0 {
-            self.dtd_holdover -= 1;
-        }
-
-        // Check if far-end is active (otherwise nothing to cancel).
-        let far_active = self.far_peak > 100.0;
-
-        // --- Leaky coefficient decay ---
-        // Applied once per frame for efficiency.
-        let decay = 1.0 - self.leak;
-        for c in self.filter.iter_mut() {
-            *c *= decay;
-        }
-
         let mut sum_near_sq: f64 = 0.0;
         let mut sum_err_sq: f64 = 0.0;
 
         for i in 0..n {
             let near_f = nearend[i] as f32;
 
-            // Position of far-end "now" for this near-end sample.
-            let base = (self.far_pos + fl * ((n / fl) + 2) + i - n) % fl;
-
-            // --- Echo estimation: dot(filter, far_end_window) ---
+            // --- estimate echo as dot(coeffs, farend_window) ---
+            // The far-end window for this sample starts at
+            //   (far_end_pos - 1 - i) mod filter_len   (most recent)
+            // and goes back filter_len samples.
             let mut echo_est: f32 = 0.0;
             let mut power: f32 = 0.0;
 
+            // Position of the most-recent far-end sample for this near-end sample.
+            // far_end_pos points to the *next write* position, so the most-recent
+            // sample written is at far_end_pos - 1.  We have already called
+            // feed_farend for this block, so the relevant samples are the last
+            // filter_len entries ending just before the current write position,
+            // offset by how far we are into this near-end frame.
+            //
+            // For sample i of the near-end frame, the corresponding far-end
+            // "now" is far_end_pos - n + i  (wrapping).
+            // far_end_pos points to next-write, so most recent sample is at
+            // far_end_pos - 1.  For the i-th near-end sample we want the
+            // far-end "now" to be at (far_end_pos - n + i).  We add fl
+            // repeatedly to avoid underflow on the usize subtraction.
+            let base = (self.far_end_pos + fl * ((n / fl) + 2) + i - n) % fl;
+
             for k in 0..fl {
                 let fe_idx = (base + fl - k) % fl;
-                let fe = self.far_buf[fe_idx];
-                echo_est += self.filter[k] * fe;
+                let fe = self.far_end_buf[fe_idx];
+                echo_est += self.filter_coeffs[k] * fe;
                 power += fe * fe;
             }
 
             let error = near_f - echo_est;
 
-            // --- NLMS adaptation (only when far-end active & no double-talk) ---
-            if far_active && !is_doubletalk && power > 10.0 {
-                let step = self.mu * error / (power + 1.0);
-                for k in 0..fl {
-                    let fe_idx = (base + fl - k) % fl;
-                    self.filter[k] += step * self.far_buf[fe_idx];
-                }
+            // --- NLMS coefficient update ---
+            let norm = power + 1.0; // +1 regularisation to avoid div-by-zero
+            let step = self.mu * error / norm;
+
+            for k in 0..fl {
+                let fe_idx = (base + fl - k) % fl;
+                let fe = self.far_end_buf[fe_idx];
+                self.filter_coeffs[k] += step * fe;
             }
 
-            let out = error.clamp(-32768.0, 32767.0);
+            // Clamp output
+            let out = error.max(-32768.0).min(32767.0);
             nearend[i] = out as i16;
 
-            sum_near_sq += (near_f as f64).powi(2);
-            sum_err_sq += (out as f64).powi(2);
+            sum_near_sq += (near_f as f64) * (near_f as f64);
+            sum_err_sq += (out as f64) * (out as f64);
         }
 
+        // ERLE ratio
         if sum_err_sq < 1.0 {
-            100.0
-        } else {
-            (sum_near_sq / sum_err_sq).sqrt() as f32
+            return 100.0; // near-perfect cancellation
         }
+        (sum_near_sq / sum_err_sq).sqrt() as f32
     }
 
+    /// Enable or disable echo cancellation.
     pub fn set_enabled(&mut self, enabled: bool) {
         self.enabled = enabled;
     }
 
+    /// Returns whether echo cancellation is currently enabled.
     pub fn is_enabled(&self) -> bool {
         self.enabled
     }
 
+    /// Reset the adaptive filter to its initial state.
+    ///
+    /// Zeroes out all filter coefficients and the far-end circular buffer.
     pub fn reset(&mut self) {
-        self.filter.iter_mut().for_each(|c| *c = 0.0);
-        self.far_buf.iter_mut().for_each(|s| *s = 0.0);
-        self.far_pos = 0;
-        self.far_peak = 0.0;
-        self.delay_ring.iter_mut().for_each(|s| *s = 0.0);
-        self.delay_write = 0;
-        self.delay_read = 0;
-        self.dtd_holdover = 0;
+        self.filter_coeffs.iter_mut().for_each(|c| *c = 0.0);
+        self.far_end_buf.iter_mut().for_each(|s| *s = 0.0);
+        self.far_end_pos = 0;
     }
 }
 
@@ -228,40 +143,50 @@ mod tests {
     use super::*;
 
     #[test]
-    fn creates_with_correct_sizes() {
-        let aec = EchoCanceller::with_delay(48000, 60, 40);
-        assert_eq!(aec.filter_len, 2880); // 60ms @ 48kHz
-        assert_eq!(aec.delay_samples, 1920); // 40ms @ 48kHz
+    fn aec_creates_with_correct_filter_len() {
+        let aec = EchoCanceller::new(48000, 100);
+        assert_eq!(aec.filter_len, 4800);
+        assert_eq!(aec.filter_coeffs.len(), 4800);
+        assert_eq!(aec.far_end_buf.len(), 4800);
     }
 
     #[test]
-    fn passthrough_when_disabled() {
-        let mut aec = EchoCanceller::new(48000, 60);
+    fn aec_passthrough_when_disabled() {
+        let mut aec = EchoCanceller::new(48000, 100);
         aec.set_enabled(false);
+        assert!(!aec.is_enabled());
 
-        let original: Vec<i16> = (0..960).map(|i| (i * 10) as i16).collect();
+        let original: Vec<i16> = (0..480).map(|i| (i * 10) as i16).collect();
         let mut frame = original.clone();
-        aec.process_frame(&mut frame);
+        let erle = aec.process_frame(&mut frame);
+        assert_eq!(erle, 1.0);
         assert_eq!(frame, original);
     }
 
     #[test]
-    fn silence_passthrough() {
-        let mut aec = EchoCanceller::with_delay(48000, 30, 0);
-        aec.feed_farend(&vec![0i16; 960]);
-        let mut frame = vec![0i16; 960];
-        aec.process_frame(&mut frame);
-        assert!(frame.iter().all(|&s| s == 0));
+    fn aec_reset_zeroes_state() {
+        let mut aec = EchoCanceller::new(48000, 10); // short for test speed
+        let farend: Vec<i16> = (0..480).map(|i| ((i * 37) % 1000) as i16).collect();
+        aec.feed_farend(&farend);
+
+        aec.reset();
+
+        assert!(aec.filter_coeffs.iter().all(|&c| c == 0.0));
+        assert!(aec.far_end_buf.iter().all(|&s| s == 0.0));
+        assert_eq!(aec.far_end_pos, 0);
     }
 
     #[test]
-    fn reduces_echo_with_no_delay() {
-        // Simulate: far-end plays, echo arrives at mic attenuated by ~50%
-        // (realistic — speaker to mic on laptop loses volume).
-        let mut aec = EchoCanceller::with_delay(48000, 10, 0);
+    fn aec_reduces_echo_of_known_signal() {
+        // Use a small filter for speed.  Feed a known far-end signal, then
+        // present the *same* signal as near-end (perfect echo, no room).
+        // After adaptation the output energy should drop.
+        let filter_ms = 5; // 240 taps at 48 kHz
+        let mut aec = EchoCanceller::new(48000, filter_ms);
 
-        let frame_len = 480;
-        let make_tone = |offset: usize| -> Vec<i16> {
+        // Generate a simple repeating pattern.
+        let frame_len = 480usize;
+        let make_frame = |offset: usize| -> Vec<i16> {
             (0..frame_len)
                 .map(|i| {
                     let t = (offset + i) as f64 / 48000.0;
@@ -270,16 +195,18 @@ mod tests {
                 .collect()
         };
 
+        // Warm up the adaptive filter with several frames.
         let mut last_erle = 1.0f32;
-        for frame_idx in 0..100 {
-            let farend = make_tone(frame_idx * frame_len);
+        for frame_idx in 0..40 {
+            let farend = make_frame(frame_idx * frame_len);
             aec.feed_farend(&farend);
 
-            // Near-end = attenuated copy of far-end (echo at ~50% volume).
-            let mut nearend: Vec<i16> = farend.iter().map(|&s| s / 2).collect();
+            // Near-end = exact copy of far-end (pure echo).
+            let mut nearend = farend.clone();
             last_erle = aec.process_frame(&mut nearend);
         }
 
+        // After 40 frames the ERLE should be meaningfully > 1.
         assert!(
             last_erle > 1.0,
             "expected ERLE > 1.0 after adaptation, got {last_erle}"
@@ -287,49 +214,15 @@ mod tests {
     }
 
     #[test]
-    fn preserves_nearend_during_doubletalk() {
-        let mut aec = EchoCanceller::with_delay(48000, 30, 0);
-
-        let frame_len = 960;
-        let nearend: Vec<i16> = (0..frame_len)
-            .map(|i| {
-                let t = i as f64 / 48000.0;
-                (10000.0 * (2.0 * std::f64::consts::PI * 440.0 * t).sin()) as i16
-            })
-            .collect();
-
-        // Feed silence as far-end (no echo source).
-        aec.feed_farend(&vec![0i16; frame_len]);
-
-        let mut frame = nearend.clone();
-        aec.process_frame(&mut frame);
-
-        let input_energy: f64 = nearend.iter().map(|&s| (s as f64).powi(2)).sum();
-        let output_energy: f64 = frame.iter().map(|&s| (s as f64).powi(2)).sum();
-        let ratio = output_energy / input_energy;
-
-        assert!(
-            ratio > 0.8,
-            "near-end speech should be preserved, energy ratio = {ratio:.3}"
-        );
-    }
-
-    #[test]
-    fn delay_buffer_holds_samples() {
-        let mut aec = EchoCanceller::with_delay(48000, 10, 20);
-        // 20ms delay = 960 samples @ 48kHz.
-        // After feeding, feed_farend auto-drains available samples to far_buf.
-        // So delay_available() is always 0 after feed_farend returns.
-        // Instead, verify far_pos advances only after the delay is filled.
-
-        // Feed 960 samples (= delay amount). No samples released yet.
-        aec.feed_farend(&vec![1i16; 960]);
-        // far_buf should still be all zeros (nothing released).
-        assert!(aec.far_buf.iter().all(|&s| s == 0.0), "nothing should be released yet");
-
-        // Feed 480 more. 480 should be released to far_buf.
-        aec.feed_farend(&vec![2i16; 480]);
-        let non_zero = aec.far_buf.iter().filter(|&&s| s != 0.0).count();
-        assert!(non_zero > 0, "samples should have been released to far_buf");
+    fn aec_silence_passthrough() {
+        let mut aec = EchoCanceller::new(48000, 10);
+        // Feed silence far-end
+        aec.feed_farend(&vec![0i16; 480]);
+        // Near-end is silence too
+        let mut frame = vec![0i16; 480];
+        let erle = aec.process_frame(&mut frame);
+        assert!(erle >= 1.0);
+        // Output should still be silence
+        assert!(frame.iter().all(|&s| s == 0));
     }
 }

crates/wzp-codec/src/lib.rs

@@ -28,26 +28,6 @@ pub use denoise::NoiseSupressor;
 pub use silence::{ComfortNoise, SilenceDetector};
 pub use wzp_proto::{AudioDecoder, AudioEncoder, CodecId, QualityProfile};
 
-use std::sync::atomic::{AtomicBool, Ordering};
-
-/// Global verbose-logging flag for DRED. Off by default — when enabled
-/// (via the GUI debug toggle wired through Tauri), the encoder logs its
-/// DRED config + libopus version, and the recv path logs every DRED
-/// reconstruction, classical PLC fill, and parse heartbeat. Off in
-/// "normal" mode keeps logcat clean.
-static DRED_VERBOSE_LOGS: AtomicBool = AtomicBool::new(false);
-
-/// Returns whether DRED verbose logging is currently enabled.
-#[inline]
-pub fn dred_verbose_logs() -> bool {
-    DRED_VERBOSE_LOGS.load(Ordering::Relaxed)
-}
-
-/// Enable/disable DRED verbose logging at runtime.
-pub fn set_dred_verbose_logs(enabled: bool) {
-    DRED_VERBOSE_LOGS.store(enabled, Ordering::Relaxed);
-}
-
 /// Create an adaptive encoder starting at the given quality profile.
 ///
 /// The returned encoder accepts 48 kHz mono PCM regardless of the active

crates/wzp-codec/src/opus_enc.rs

@@ -14,9 +14,8 @@
 //!   networks; short window keeps decoder CPU modest.
 //! - Normal tiers (Opus 16k/24k): 200 ms — balanced baseline covering common
 //!   VoIP loss patterns (20–150 ms bursts from wifi roam, transient congestion).
-//! - Degraded tier (Opus 6k): 1040 ms — users on 6k are by definition on a
-//!   bad link; the maximum libopus DRED window buys the best burst resilience
-//!   where it matters. The RDO-VAE naturally degrades quality at longer offsets.
+//! - Degraded tier (Opus 6k): 500 ms — users on 6k are by definition on a
+//!   bad link; longer DRED buys maximum burst resilience where it matters.
 //!
 //! # Why the 15% packet loss floor
 //!
@@ -39,18 +38,10 @@
 //! keeping the bitrate overhead modest compared to 25%. Real measurements
 //! from the quality adapter override upward when loss exceeds the floor.
 
-use std::sync::OnceLock;
-
 use opusic_c::{Application, Bitrate, Channels, Encoder, InbandFec, SampleRate, Signal};
-use tracing::{debug, info, warn};
+use tracing::{debug, warn};
 use wzp_proto::{AudioEncoder, CodecError, CodecId, QualityProfile};
 
-/// Logged exactly once per process the first time an OpusEncoder is built.
-/// Confirms that libopus 1.5.2 (the version with DRED) is actually linked
-/// at runtime — invaluable when chasing "is the new codec loaded?"
-/// regressions on Android, where the only debug surface is logcat.
-static LIBOPUS_VERSION_LOGGED: OnceLock<()> = OnceLock::new();
-
 /// Minimum `OPUS_SET_PACKET_LOSS_PERC` value used in DRED mode. libopus
 /// scales the DRED emission window with the assumed loss percentage:
 /// empirically, 5% gives a 15 ms window (useless), 10% gives 55 ms, 15%
@@ -79,12 +70,8 @@ pub fn dred_duration_for(codec: CodecId) -> u8 {
         CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 10,
         // Normal tiers — balanced baseline.
         CodecId::Opus16k | CodecId::Opus24k => 20,
-        // Degraded tier — maximum burst resilience. 104 × 10 ms = 1040 ms,
-        // the highest value libopus 1.5 supports. Users on 6k are on a bad
-        // link by definition; the RDO-VAE naturally degrades quality at longer
-        // offsets, so the extra window costs only ~1-2 kbps additional overhead
-        // while buying substantially better burst resilience (up from 500 ms).
-        CodecId::Opus6k => 104,
+        // Degraded tier — maximum burst resilience.
+        CodecId::Opus6k => 50,
         // Non-Opus (Codec2 / CN): DRED is N/A.
         CodecId::Codec2_1200 | CodecId::Codec2_3200 | CodecId::ComfortNoise => 0,
     }
@@ -191,26 +178,13 @@ impl OpusEncoder {
             .set_packet_loss(DRED_LOSS_FLOOR_PCT)
             .map_err(|e| CodecError::EncodeFailed(format!("set packet loss floor: {e:?}")))?;
 
-        // Both of these are gated behind the GUI debug toggle so logcat
-        // stays clean in normal mode. Flip "DRED verbose logs" in the
-        // settings panel to see the per-encoder config + libopus version.
-        if crate::dred_verbose_logs() {
-            info!(
-                codec = ?codec,
-                dred_frames,
-                dred_ms = dred_frames as u32 * 10,
-                loss_floor_pct = DRED_LOSS_FLOOR_PCT,
-                "opus encoder: DRED enabled"
-            );
-
-            // One-shot logging of the linked libopus version so we can
-            // confirm at a glance that opusic-c (libopus 1.5.2) is loaded.
-            // Pre-Phase-0 audiopus shipped libopus 1.3 which has no DRED;
-            // if this log says "libopus 1.3" something is very wrong.
-            LIBOPUS_VERSION_LOGGED.get_or_init(|| {
-                info!(libopus_version = %opusic_c::version(), "linked libopus version");
-            });
-        }
+        debug!(
+            codec = ?codec,
+            dred_frames,
+            dred_ms = dred_frames as u32 * 10,
+            loss_floor_pct = DRED_LOSS_FLOOR_PCT,
+            "opus encoder: DRED enabled"
+        );
 
         Ok(())
     }
@@ -339,14 +313,6 @@ impl AudioEncoder for OpusEncoder {
     fn set_dtx(&mut self, enabled: bool) {
         let _ = self.inner.set_dtx(enabled);
     }
-
-    fn set_expected_loss(&mut self, loss_pct: u8) {
-        OpusEncoder::set_expected_loss(self, loss_pct);
-    }
-
-    fn set_dred_duration(&mut self, frames: u8) {
-        OpusEncoder::set_dred_duration(self, frames);
-    }
 }
 
 #[cfg(test)]
@@ -402,8 +368,8 @@ mod tests {
     }
 
     #[test]
-    fn dred_duration_for_degraded_tier_is_1040ms() {
-        assert_eq!(dred_duration_for(CodecId::Opus6k), 104);
+    fn dred_duration_for_degraded_tier_is_500ms() {
+        assert_eq!(dred_duration_for(CodecId::Opus6k), 50);
     }
 
     #[test]

crates/wzp-crypto/tests/featherchat_compat.rs

@@ -115,7 +115,6 @@ fn wzp_signal_serializes_into_fc_callsignal_payload() {
         ephemeral_pub: [2u8; 32],
         signature: vec![3u8; 64],
         supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
-        alias: None,
     };
 
     // Encode as featherChat CallSignal payload
@@ -199,7 +198,6 @@ fn wzp_answer_round_trips_through_fc_callsignal() {
 fn wzp_hangup_round_trips_through_fc_callsignal() {
     let hangup = wzp_proto::SignalMessage::Hangup {
         reason: wzp_proto::HangupReason::Normal,
-        call_id: None,
     };
 
     let payload = wzp_client::featherchat::encode_call_payload(&hangup, None, None);
@@ -275,14 +273,13 @@ fn auth_invalid_response_matches() {
 
 #[test]
 fn all_signal_types_map_correctly() {
-    use wzp_client::featherchat::signal_to_call_type;
+    use wzp_client::featherchat::{signal_to_call_type, CallSignalType};
 
     let cases: Vec<(wzp_proto::SignalMessage, &str)> = vec![
         (
             wzp_proto::SignalMessage::CallOffer {
                 identity_pub: [0; 32], ephemeral_pub: [0; 32],
                 signature: vec![], supported_profiles: vec![],
-                alias: None,
             },
             "Offer",
         ),
@@ -303,7 +300,6 @@ fn all_signal_types_map_correctly() {
         (
             wzp_proto::SignalMessage::Hangup {
                 reason: wzp_proto::HangupReason::Normal,
-                call_id: None,
             },
             "Hangup",
         ),

crates/wzp-native/Cargo.toml

@@ -1,29 +0,0 @@
-[package]
-name = "wzp-native"
-version = "0.1.0"
-edition = "2024"
-description = "WarzonePhone native audio library — standalone Android cdylib that eventually owns all C++ (Oboe bridge) and exposes a pure-C FFI. Built with cargo-ndk, loaded at runtime by the Tauri desktop cdylib via libloading."
-
-# Crate-type is DELIBERATELY only cdylib (no rlib, no staticlib). This crate
-# is built with `cargo ndk -t arm64-v8a build --release -p wzp-native` as a
-# standalone .so, which is the same path the legacy wzp-android crate uses
-# successfully on the same phone / same NDK. Keeping the crate-type single
-# avoids the rust-lang/rust#104707 symbol leak that bit us when Tauri's
-# desktop crate had ["staticlib", "cdylib", "rlib"] and any C++ static
-# archive pulled bionic's internal pthread_create into the final .so.
-[lib]
-name = "wzp_native"
-crate-type = ["cdylib"]
-
-[build-dependencies]
-# cc is SAFE to use here because this crate is a single-cdylib: no
-# staticlib in crate-type → no rust-lang/rust#104707 symbol leak. The
-# legacy wzp-android crate uses the same setup and works.
-cc = "1"
-
-[dependencies]
-# Phase 2: Oboe C++ audio bridge. Still no Rust deps — we do the whole
-# audio pipeline via extern "C" into the bundled C++ and expose our own
-# narrow extern "C" API for wzp-desktop to dlopen via libloading.
-# Phase 3 can add wzp-proto/wzp-codec if we want to share codec logic
-# instead of calling back into wzp-desktop via callbacks.

crates/wzp-native/build.rs

@@ -1,119 +0,0 @@
-//! wzp-native build.rs — Oboe C++ bridge compile on Android.
-//!
-//! Near-verbatim copy of crates/wzp-android/build.rs (which is known to
-//! work). The crucial distinction: this crate is a single-cdylib (no
-//! staticlib, no rlib in crate-type) so rust-lang/rust#104707 doesn't
-//! apply — bionic's internal pthread_create / __init_tcb symbols stay
-//! UND and resolve against libc.so at runtime, as they should.
-//!
-//! On non-Android hosts we compile `cpp/oboe_stub.cpp` (empty stubs) so
-//! `cargo check --target <host>` still works for IDEs and CI.
-
-use std::path::PathBuf;
-
-fn main() {
-    let target = std::env::var("TARGET").unwrap_or_default();
-
-    if target.contains("android") {
-        // getauxval_fix: override compiler-rt's broken static getauxval
-        // stub that SIGSEGVs in shared libraries.
-        cc::Build::new()
-            .file("cpp/getauxval_fix.c")
-            .compile("wzp_native_getauxval_fix");
-
-        let oboe_dir = fetch_oboe();
-        match oboe_dir {
-            Some(oboe_path) => {
-                println!("cargo:warning=wzp-native: building with Oboe from {:?}", oboe_path);
-                let mut build = cc::Build::new();
-                build
-                    .cpp(true)
-                    .std("c++17")
-                    // Shared libc++ — matches legacy wzp-android setup.
-                    .cpp_link_stdlib(Some("c++_shared"))
-                    .include("cpp")
-                    .include(oboe_path.join("include"))
-                    .include(oboe_path.join("src"))
-                    .define("WZP_HAS_OBOE", None)
-                    .file("cpp/oboe_bridge.cpp");
-                add_cpp_files_recursive(&mut build, &oboe_path.join("src"));
-                build.compile("wzp_native_oboe_bridge");
-            }
-            None => {
-                println!("cargo:warning=wzp-native: Oboe not found, building stub");
-                cc::Build::new()
-                    .cpp(true)
-                    .std("c++17")
-                    .cpp_link_stdlib(Some("c++_shared"))
-                    .file("cpp/oboe_stub.cpp")
-                    .include("cpp")
-                    .compile("wzp_native_oboe_bridge");
-            }
-        }
-
-        // Oboe needs log + OpenSLES backends at runtime.
-        println!("cargo:rustc-link-lib=log");
-        println!("cargo:rustc-link-lib=OpenSLES");
-
-        // Re-run if any cpp file changes
-        println!("cargo:rerun-if-changed=cpp/oboe_bridge.cpp");
-        println!("cargo:rerun-if-changed=cpp/oboe_bridge.h");
-        println!("cargo:rerun-if-changed=cpp/oboe_stub.cpp");
-        println!("cargo:rerun-if-changed=cpp/getauxval_fix.c");
-    } else {
-        // Non-Android hosts: compile the empty stub so lib.rs's extern
-        // declarations resolve when someone runs `cargo check` on macOS
-        // or Linux without an NDK.
-        cc::Build::new()
-            .cpp(true)
-            .std("c++17")
-            .file("cpp/oboe_stub.cpp")
-            .include("cpp")
-            .compile("wzp_native_oboe_bridge");
-        println!("cargo:rerun-if-changed=cpp/oboe_stub.cpp");
-    }
-}
-
-/// Recursively add all `.cpp` files from a directory to a cc::Build.
-fn add_cpp_files_recursive(build: &mut cc::Build, dir: &std::path::Path) {
-    if !dir.is_dir() {
-        return;
-    }
-    for entry in std::fs::read_dir(dir).unwrap() {
-        let entry = entry.unwrap();
-        let path = entry.path();
-        if path.is_dir() {
-            add_cpp_files_recursive(build, &path);
-        } else if path.extension().map_or(false, |e| e == "cpp") {
-            build.file(&path);
-        }
-    }
-}
-
-/// Fetch or find Oboe headers + sources (v1.8.1). Same logic as the
-/// legacy wzp-android crate's build.rs.
-fn fetch_oboe() -> Option<PathBuf> {
-    let out_dir = PathBuf::from(std::env::var("OUT_DIR").unwrap());
-    let oboe_dir = out_dir.join("oboe");
-
-    if oboe_dir.join("include").join("oboe").join("Oboe.h").exists() {
-        return Some(oboe_dir);
-    }
-
-    let status = std::process::Command::new("git")
-        .args([
-            "clone",
-            "--depth=1",
-            "--branch=1.8.1",
-            "https://github.com/google/oboe.git",
-            oboe_dir.to_str().unwrap(),
-        ])
-        .status();
-
-    match status {
-        Ok(s) if s.success() && oboe_dir.join("include").join("oboe").join("Oboe.h").exists() => {
-            Some(oboe_dir)
-        }
-        _ => None,
-    }
-}

crates/wzp-native/cpp/getauxval_fix.c

@@ -1,21 +0,0 @@
-// Override the broken static getauxval from compiler-rt/CRT.
-// The static version reads from __libc_auxv which is NULL in shared libs
-// loaded via dlopen, causing SIGSEGV in init_have_lse_atomics at load time.
-// This version calls the real bionic getauxval via dlsym.
-#ifdef __ANDROID__
-#include <dlfcn.h>
-#include <stdint.h>
-
-typedef unsigned long (*getauxval_fn)(unsigned long);
-
-unsigned long getauxval(unsigned long type) {
-    static getauxval_fn real_getauxval = (getauxval_fn)0;
-    if (!real_getauxval) {
-        real_getauxval = (getauxval_fn)dlsym((void*)-1L /* RTLD_DEFAULT */, "getauxval");
-        if (!real_getauxval) {
-            return 0;
-        }
-    }
-    return real_getauxval(type);
-}
-#endif

crates/wzp-native/cpp/oboe_bridge.cpp

@@ -1,477 +0,0 @@
-// Full Oboe implementation for Android
-// This file is compiled only when targeting Android
-
-#include "oboe_bridge.h"
-
-#ifdef __ANDROID__
-#include <oboe/Oboe.h>
-#include <android/log.h>
-#include <cstring>
-#include <atomic>
-#include <chrono>
-#include <thread>
-
-#define LOG_TAG "wzp-oboe"
-#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)
-#define LOGW(...) __android_log_print(ANDROID_LOG_WARN, LOG_TAG, __VA_ARGS__)
-#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)
-
-// ---------------------------------------------------------------------------
-// Ring buffer helpers (SPSC, lock-free)
-// ---------------------------------------------------------------------------
-
-static inline int32_t ring_available_read(const wzp_atomic_int* write_idx,
-                                           const wzp_atomic_int* read_idx,
-                                           int32_t capacity) {
-    int32_t w = std::atomic_load_explicit(write_idx, std::memory_order_acquire);
-    int32_t r = std::atomic_load_explicit(read_idx, std::memory_order_relaxed);
-    int32_t avail = w - r;
-    if (avail < 0) avail += capacity;
-    return avail;
-}
-
-static inline int32_t ring_available_write(const wzp_atomic_int* write_idx,
-                                            const wzp_atomic_int* read_idx,
-                                            int32_t capacity) {
-    return capacity - 1 - ring_available_read(write_idx, read_idx, capacity);
-}
-
-static inline void ring_write(int16_t* buf, int32_t capacity,
-                               wzp_atomic_int* write_idx, const wzp_atomic_int* read_idx,
-                               const int16_t* src, int32_t count) {
-    int32_t w = std::atomic_load_explicit(write_idx, std::memory_order_relaxed);
-    for (int32_t i = 0; i < count; i++) {
-        buf[w] = src[i];
-        w++;
-        if (w >= capacity) w = 0;
-    }
-    std::atomic_store_explicit(write_idx, w, std::memory_order_release);
-}
-
-static inline void ring_read(int16_t* buf, int32_t capacity,
-                              const wzp_atomic_int* write_idx, wzp_atomic_int* read_idx,
-                              int16_t* dst, int32_t count) {
-    int32_t r = std::atomic_load_explicit(read_idx, std::memory_order_relaxed);
-    for (int32_t i = 0; i < count; i++) {
-        dst[i] = buf[r];
-        r++;
-        if (r >= capacity) r = 0;
-    }
-    std::atomic_store_explicit(read_idx, r, std::memory_order_release);
-}
-
-// ---------------------------------------------------------------------------
-// Global state
-// ---------------------------------------------------------------------------
-
-static std::shared_ptr<oboe::AudioStream> g_capture_stream;
-static std::shared_ptr<oboe::AudioStream> g_playout_stream;
-// Value copy — the WzpOboeRings the Rust side passes us lives on the caller's
-// stack frame and goes away as soon as wzp_oboe_start returns. The raw
-// int16/atomic pointers INSIDE the struct point into the Rust-owned, leaked-
-// for-the-lifetime-of-the-process AudioBackend singleton, so copying the
-// struct by value is safe and keeps the inner pointers valid indefinitely.
-// g_rings_valid guards the audio-callback-side read; clearing it in stop()
-// signals "no backend" to the callbacks which then return silence + Stop.
-static WzpOboeRings g_rings{};
-static std::atomic<bool> g_rings_valid{false};
-static std::atomic<bool> g_running{false};
-static std::atomic<float> g_capture_latency_ms{0.0f};
-static std::atomic<float> g_playout_latency_ms{0.0f};
-
-// ---------------------------------------------------------------------------
-// Capture callback
-// ---------------------------------------------------------------------------
-
-class CaptureCallback : public oboe::AudioStreamDataCallback {
-public:
-    uint64_t calls = 0;
-    uint64_t total_frames = 0;
-    uint64_t total_written = 0;
-    uint64_t ring_full_drops = 0;
-
-    oboe::DataCallbackResult onAudioReady(
-            oboe::AudioStream* stream,
-            void* audioData,
-            int32_t numFrames) override {
-        if (!g_running.load(std::memory_order_relaxed) ||
-            !g_rings_valid.load(std::memory_order_acquire)) {
-            return oboe::DataCallbackResult::Stop;
-        }
-
-        const int16_t* src = static_cast<const int16_t*>(audioData);
-        int32_t avail = ring_available_write(g_rings.capture_write_idx,
-                                              g_rings.capture_read_idx,
-                                              g_rings.capture_capacity);
-        int32_t to_write = (numFrames < avail) ? numFrames : avail;
-        if (to_write > 0) {
-            ring_write(g_rings.capture_buf, g_rings.capture_capacity,
-                       g_rings.capture_write_idx, g_rings.capture_read_idx,
-                       src, to_write);
-        }
-        total_frames += numFrames;
-        total_written += to_write;
-        if (to_write < numFrames) {
-            ring_full_drops += (numFrames - to_write);
-        }
-
-        // Sample-range probe on the FIRST callback to prove we get real audio
-        if (calls == 0 && numFrames > 0) {
-            int16_t lo = src[0], hi = src[0];
-            int32_t sumsq = 0;
-            for (int32_t i = 0; i < numFrames; i++) {
-                if (src[i] < lo) lo = src[i];
-                if (src[i] > hi) hi = src[i];
-                sumsq += (int32_t)src[i] * (int32_t)src[i];
-            }
-            int32_t rms = (int32_t) (numFrames > 0 ? (int32_t)__builtin_sqrt((double)sumsq / (double)numFrames) : 0);
-            LOGI("capture cb#0: numFrames=%d sample_range=[%d..%d] rms=%d to_write=%d",
-                 numFrames, lo, hi, rms, to_write);
-        }
-        // Heartbeat every 50 callbacks (~1s at 20ms/burst)
-        calls++;
-        if ((calls % 50) == 0) {
-            LOGI("capture heartbeat: calls=%llu numFrames=%d ring_avail_write=%d to_write=%d full_drops=%llu total_written=%llu",
-                 (unsigned long long)calls, numFrames, avail, to_write,
-                 (unsigned long long)ring_full_drops, (unsigned long long)total_written);
-        }
-
-        // Update latency estimate
-        auto result = stream->calculateLatencyMillis();
-        if (result) {
-            g_capture_latency_ms.store(static_cast<float>(result.value()),
-                                        std::memory_order_relaxed);
-        }
-
-        return oboe::DataCallbackResult::Continue;
-    }
-};
-
-// ---------------------------------------------------------------------------
-// Playout callback
-// ---------------------------------------------------------------------------
-
-class PlayoutCallback : public oboe::AudioStreamDataCallback {
-public:
-    uint64_t calls = 0;
-    uint64_t total_frames = 0;
-    uint64_t total_played_real = 0;
-    uint64_t underrun_frames = 0;
-    uint64_t nonempty_calls = 0;
-
-    oboe::DataCallbackResult onAudioReady(
-            oboe::AudioStream* stream,
-            void* audioData,
-            int32_t numFrames) override {
-        if (!g_running.load(std::memory_order_relaxed) ||
-            !g_rings_valid.load(std::memory_order_acquire)) {
-            memset(audioData, 0, numFrames * sizeof(int16_t));
-            return oboe::DataCallbackResult::Stop;
-        }
-
-        int16_t* dst = static_cast<int16_t*>(audioData);
-        int32_t avail = ring_available_read(g_rings.playout_write_idx,
-                                             g_rings.playout_read_idx,
-                                             g_rings.playout_capacity);
-        int32_t to_read = (numFrames < avail) ? numFrames : avail;
-
-        if (to_read > 0) {
-            ring_read(g_rings.playout_buf, g_rings.playout_capacity,
-                      g_rings.playout_write_idx, g_rings.playout_read_idx,
-                      dst, to_read);
-            nonempty_calls++;
-        }
-        // Fill remainder with silence on underrun
-        if (to_read < numFrames) {
-            memset(dst + to_read, 0, (numFrames - to_read) * sizeof(int16_t));
-            underrun_frames += (numFrames - to_read);
-        }
-        total_frames += numFrames;
-        total_played_real += to_read;
-
-        // First callback: log requested config + prove we're being called
-        if (calls == 0) {
-            LOGI("playout cb#0: numFrames=%d ring_avail_read=%d to_read=%d",
-                 numFrames, avail, to_read);
-        }
-        // On the first callback that actually has data, log the sample range
-        // so we can tell if the samples coming out of the ring look like real
-        // audio vs constant-zeroes vs garbage.
-        if (to_read > 0 && nonempty_calls == 1) {
-            int16_t lo = dst[0], hi = dst[0];
-            int32_t sumsq = 0;
-            for (int32_t i = 0; i < to_read; i++) {
-                if (dst[i] < lo) lo = dst[i];
-                if (dst[i] > hi) hi = dst[i];
-                sumsq += (int32_t)dst[i] * (int32_t)dst[i];
-            }
-            int32_t rms = (to_read > 0) ? (int32_t)__builtin_sqrt((double)sumsq / (double)to_read) : 0;
-            LOGI("playout FIRST nonempty read: to_read=%d sample_range=[%d..%d] rms=%d",
-                 to_read, lo, hi, rms);
-        }
-        // Heartbeat every 50 callbacks (~1s at 20ms/burst)
-        calls++;
-        if ((calls % 50) == 0) {
-            int state = (int)stream->getState();
-            auto xrunRes = stream->getXRunCount();
-            int xruns = xrunRes ? xrunRes.value() : -1;
-            LOGI("playout heartbeat: calls=%llu nonempty=%llu numFrames=%d ring_avail_read=%d to_read=%d underrun_frames=%llu total_played_real=%llu state=%d xruns=%d",
-                 (unsigned long long)calls, (unsigned long long)nonempty_calls,
-                 numFrames, avail, to_read,
-                 (unsigned long long)underrun_frames, (unsigned long long)total_played_real,
-                 state, xruns);
-        }
-
-        // Update latency estimate
-        auto result = stream->calculateLatencyMillis();
-        if (result) {
-            g_playout_latency_ms.store(static_cast<float>(result.value()),
-                                        std::memory_order_relaxed);
-        }
-
-        return oboe::DataCallbackResult::Continue;
-    }
-};
-
-static CaptureCallback g_capture_cb;
-static PlayoutCallback g_playout_cb;
-
-// ---------------------------------------------------------------------------
-// Public C API
-// ---------------------------------------------------------------------------
-
-int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
-    if (g_running.load(std::memory_order_relaxed)) {
-        LOGW("wzp_oboe_start: already running");
-        return -1;
-    }
-
-    // Deep-copy the rings struct into static storage BEFORE we publish it to
-    // the audio callbacks — `rings` points at the caller's stack frame and
-    // goes away as soon as this function returns.
-    g_rings = *rings;
-    g_rings_valid.store(true, std::memory_order_release);
-
-    // Build capture stream
-    oboe::AudioStreamBuilder captureBuilder;
-    captureBuilder.setDirection(oboe::Direction::Input)
-        ->setPerformanceMode(oboe::PerformanceMode::LowLatency)
-        ->setSharingMode(oboe::SharingMode::Shared)
-        ->setFormat(oboe::AudioFormat::I16)
-        ->setChannelCount(config->channel_count)
-        ->setSampleRateConversionQuality(oboe::SampleRateConversionQuality::Best)
-        ->setDataCallback(&g_capture_cb);
-
-    if (config->bt_active) {
-        // BT SCO mode: do NOT set sample rate or input preset.
-        // Requesting 48kHz against a BT SCO device fails with
-        // "getInputProfile could not find profile". Letting the system
-        // choose the native rate (8/16kHz) and relying on Oboe's
-        // resampler (SampleRateConversionQuality::Best) to bridge
-        // to our 48kHz ring buffer is the only path that works.
-        // InputPreset::VoiceCommunication can also prevent BT SCO
-        // routing on some devices — skip it for BT.
-        LOGI("capture: BT mode — no sample rate or input preset set");
-    } else {
-        captureBuilder.setSampleRate(config->sample_rate)
-            ->setFramesPerDataCallback(config->frames_per_burst)
-            ->setInputPreset(oboe::InputPreset::VoiceCommunication);
-    }
-
-    oboe::Result result = captureBuilder.openStream(g_capture_stream);
-    if (result != oboe::Result::OK) {
-        LOGE("Failed to open capture stream: %s", oboe::convertToText(result));
-        return -2;
-    }
-    LOGI("capture stream opened: actualSR=%d actualCh=%d actualFormat=%d actualFramesPerBurst=%d actualFramesPerDataCallback=%d bufferCapacityInFrames=%d sharing=%d perfMode=%d",
-         g_capture_stream->getSampleRate(),
-         g_capture_stream->getChannelCount(),
-         (int)g_capture_stream->getFormat(),
-         g_capture_stream->getFramesPerBurst(),
-         g_capture_stream->getFramesPerDataCallback(),
-         g_capture_stream->getBufferCapacityInFrames(),
-         (int)g_capture_stream->getSharingMode(),
-         (int)g_capture_stream->getPerformanceMode());
-
-    // Build playout stream.
-    //
-    // Regression triangulation between builds:
-    //   96be740 (Usage::Media, default API): playout callback DID drain
-    //   the ring at steady 50Hz (playout heartbeat: calls=1100,
-    //   total_played_real=1055040). Audio not audible because OS routing
-    //   sent it to a silent output.
-    //
-    //   8c36fb5 (Usage::VoiceCommunication + setAudioApi(AAudio) +
-    //   ContentType::Speech): playout callback fired cb#0 once then
-    //   stopped draining the ring entirely. written_samples stuck at
-    //   ring capacity (7679) across all subsequent heartbeats, so Oboe
-    //   accepted zero samples after startup. Still inaudible.
-    //
-    // Hypothesis: forcing setAudioApi(AAudio) + VoiceCommunication on
-    // Pixel 6 / Android 15 opens a stream that succeeds at cb#0 but
-    // then detaches from the real audio driver. Reverting to the
-    // config that at least drove callbacks correctly, plus the
-    // Kotlin-side MODE_IN_COMMUNICATION + setSpeakerphoneOn(true)
-    // handled in MainActivity.kt to route audio to the loud speaker.
-    // Usage::VoiceCommunication is the correct Oboe usage for a VoIP app
-    // — it respects Android's in-call audio routing and lets
-    // AudioManager.setSpeakerphoneOn/setBluetoothScoOn actually switch
-    // between earpiece, loudspeaker, and Bluetooth headset. Combined with
-    // MODE_IN_COMMUNICATION set from MainActivity.kt and
-    // speakerphoneOn=false by default, this produces handset/earpiece as
-    // the default output.
-    //
-    // IMPORTANT: do NOT add setAudioApi(AAudio) here. Build 8c36fb5 proved
-    // forcing AAudio with Usage::VoiceCommunication makes the playout
-    // callback stop draining the ring after cb#0, even though the stream
-    // opens successfully. Letting Oboe pick the API (which will be AAudio
-    // on API ≥ 27 but via a different codepath) kept callbacks firing in
-    // every other build.
-    oboe::AudioStreamBuilder playoutBuilder;
-    playoutBuilder.setDirection(oboe::Direction::Output)
-        ->setPerformanceMode(oboe::PerformanceMode::LowLatency)
-        ->setSharingMode(oboe::SharingMode::Shared)
-        ->setFormat(oboe::AudioFormat::I16)
-        ->setChannelCount(config->channel_count)
-        ->setSampleRateConversionQuality(oboe::SampleRateConversionQuality::Best)
-        ->setDataCallback(&g_playout_cb);
-
-    if (config->bt_active) {
-        LOGI("playout: BT mode — no sample rate set, using Usage::Media");
-        // Usage::Media instead of VoiceCommunication for BT output
-        // to avoid conflicts with the communication device routing.
-        playoutBuilder.setUsage(oboe::Usage::Media);
-    } else {
-        playoutBuilder.setSampleRate(config->sample_rate)
-            ->setFramesPerDataCallback(config->frames_per_burst)
-            ->setUsage(oboe::Usage::VoiceCommunication);
-    }
-
-    result = playoutBuilder.openStream(g_playout_stream);
-    if (result != oboe::Result::OK) {
-        LOGE("Failed to open playout stream: %s", oboe::convertToText(result));
-        g_capture_stream->close();
-        g_capture_stream.reset();
-        return -3;
-    }
-    LOGI("playout stream opened: actualSR=%d actualCh=%d actualFormat=%d actualFramesPerBurst=%d actualFramesPerDataCallback=%d bufferCapacityInFrames=%d sharing=%d perfMode=%d",
-         g_playout_stream->getSampleRate(),
-         g_playout_stream->getChannelCount(),
-         (int)g_playout_stream->getFormat(),
-         g_playout_stream->getFramesPerBurst(),
-         g_playout_stream->getFramesPerDataCallback(),
-         g_playout_stream->getBufferCapacityInFrames(),
-         (int)g_playout_stream->getSharingMode(),
-         (int)g_playout_stream->getPerformanceMode());
-
-    g_running.store(true, std::memory_order_release);
-
-    // Start both streams
-    result = g_capture_stream->requestStart();
-    if (result != oboe::Result::OK) {
-        LOGE("Failed to start capture: %s", oboe::convertToText(result));
-        g_running.store(false, std::memory_order_release);
-        g_capture_stream->close();
-        g_playout_stream->close();
-        g_capture_stream.reset();
-        g_playout_stream.reset();
-        return -4;
-    }
-
-    result = g_playout_stream->requestStart();
-    if (result != oboe::Result::OK) {
-        LOGE("Failed to start playout: %s", oboe::convertToText(result));
-        g_running.store(false, std::memory_order_release);
-        g_capture_stream->requestStop();
-        g_capture_stream->close();
-        g_playout_stream->close();
-        g_capture_stream.reset();
-        g_playout_stream.reset();
-        return -5;
-    }
-
-    // Log initial stream states right after requestStart() returns.
-    // On well-behaved HALs both will already be Started; on others
-    // (Nothing A059) they may still be in Starting state.
-    LOGI("requestStart returned: capture_state=%d playout_state=%d",
-         (int)g_capture_stream->getState(),
-         (int)g_playout_stream->getState());
-
-    // Poll until both streams report Started state, up to 2s timeout.
-    // Some Android HALs (Nothing A059) delay transitioning from Starting
-    // to Started; proceeding before the transition completes causes the
-    // first capture/playout callbacks to be dropped silently.
-    {
-        auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(2000);
-        int poll_count = 0;
-        while (std::chrono::steady_clock::now() < deadline) {
-            auto cap_state = g_capture_stream->getState();
-            auto play_state = g_playout_stream->getState();
-            if (cap_state == oboe::StreamState::Started &&
-                play_state == oboe::StreamState::Started) {
-                LOGI("both streams Started after %d polls", poll_count);
-                break;
-            }
-            poll_count++;
-            std::this_thread::sleep_for(std::chrono::milliseconds(10));
-        }
-        // Log final state even on timeout (helps diagnose HAL quirks)
-        LOGI("stream states after poll: capture=%d playout=%d (polls=%d)",
-             (int)g_capture_stream->getState(),
-             (int)g_playout_stream->getState(),
-             poll_count);
-    }
-
-    LOGI("Oboe started: sr=%d burst=%d ch=%d",
-         config->sample_rate, config->frames_per_burst, config->channel_count);
-    return 0;
-}
-
-void wzp_oboe_stop(void) {
-    g_running.store(false, std::memory_order_release);
-    // Tell the audio callbacks to stop touching g_rings BEFORE we tear down
-    // the streams, so any in-flight callback returns Stop instead of reading
-    // stale pointers.
-    g_rings_valid.store(false, std::memory_order_release);
-
-    if (g_capture_stream) {
-        g_capture_stream->requestStop();
-        g_capture_stream->close();
-        g_capture_stream.reset();
-    }
-    if (g_playout_stream) {
-        g_playout_stream->requestStop();
-        g_playout_stream->close();
-        g_playout_stream.reset();
-    }
-
-    LOGI("Oboe stopped");
-}
-
-float wzp_oboe_capture_latency_ms(void) {
-    return g_capture_latency_ms.load(std::memory_order_relaxed);
-}
-
-float wzp_oboe_playout_latency_ms(void) {
-    return g_playout_latency_ms.load(std::memory_order_relaxed);
-}
-
-int wzp_oboe_is_running(void) {
-    return g_running.load(std::memory_order_relaxed) ? 1 : 0;
-}
-
-#else
-// Non-Android fallback — should not be reached; oboe_stub.cpp is used instead.
-// Provide empty implementations just in case.
-
-int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
-    (void)config; (void)rings;
-    return -99;
-}
-
-void wzp_oboe_stop(void) {}
-float wzp_oboe_capture_latency_ms(void) { return 0.0f; }
-float wzp_oboe_playout_latency_ms(void) { return 0.0f; }
-int wzp_oboe_is_running(void) { return 0; }
-
-#endif // __ANDROID__

crates/wzp-native/cpp/oboe_bridge.h

@@ -1,44 +0,0 @@
-#ifndef WZP_OBOE_BRIDGE_H
-#define WZP_OBOE_BRIDGE_H
-
-#include <stdint.h>
-
-#ifdef __cplusplus
-#include <atomic>
-typedef std::atomic<int32_t> wzp_atomic_int;
-extern "C" {
-#else
-#include <stdatomic.h>
-typedef atomic_int wzp_atomic_int;
-#endif
-
-typedef struct {
-    int32_t sample_rate;
-    int32_t frames_per_burst;
-    int32_t channel_count;
-    int32_t bt_active;  /* nonzero = BT SCO mode: skip sample rate + input preset */
-} WzpOboeConfig;
-
-typedef struct {
-    int16_t* capture_buf;
-    int32_t  capture_capacity;
-    wzp_atomic_int* capture_write_idx;
-    wzp_atomic_int* capture_read_idx;
-
-    int16_t* playout_buf;
-    int32_t  playout_capacity;
-    wzp_atomic_int* playout_write_idx;
-    wzp_atomic_int* playout_read_idx;
-} WzpOboeRings;
-
-int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings);
-void wzp_oboe_stop(void);
-float wzp_oboe_capture_latency_ms(void);
-float wzp_oboe_playout_latency_ms(void);
-int wzp_oboe_is_running(void);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // WZP_OBOE_BRIDGE_H

crates/wzp-native/cpp/oboe_stub.cpp

@@ -1,27 +0,0 @@
-// Stub implementation for non-Android host builds (testing, cargo check, etc.)
-
-#include "oboe_bridge.h"
-#include <stdio.h>
-
-int wzp_oboe_start(const WzpOboeConfig* config, const WzpOboeRings* rings) {
-    (void)config;
-    (void)rings;
-    fprintf(stderr, "wzp_oboe_start: stub (not on Android)\n");
-    return 0;
-}
-
-void wzp_oboe_stop(void) {
-    fprintf(stderr, "wzp_oboe_stop: stub (not on Android)\n");
-}
-
-float wzp_oboe_capture_latency_ms(void) {
-    return 0.0f;
-}
-
-float wzp_oboe_playout_latency_ms(void) {
-    return 0.0f;
-}
-
-int wzp_oboe_is_running(void) {
-    return 0;
-}

crates/wzp-native/src/lib.rs

@@ -1,427 +0,0 @@
-//! wzp-native — standalone Android cdylib for all the C++ audio code.
-//!
-//! Built with `cargo ndk`, NOT `cargo tauri android build`. Loaded at
-//! runtime by the Tauri desktop cdylib (`wzp-desktop`) via libloading.
-//! See `docs/incident-tauri-android-init-tcb.md` for why the split exists.
-//!
-//! Phase 2: real Oboe audio backend.
-//!
-//! Architecture: Oboe runs capture + playout streams on its own high-
-//! priority AAudio callback threads inside the C++ bridge. Two SPSC ring
-//! buffers (capture and playout) are shared between the C++ callbacks
-//! and the Rust side via atomic indices — no locks on the hot path.
-//! `wzp-desktop` drains the capture ring into its Opus encoder and fills
-//! the playout ring with decoded PCM.
-
-use std::sync::atomic::{AtomicI32, Ordering};
-
-// ─── Phase 1 smoke-test exports (kept for sanity checks) ─────────────────
-
-/// Returns 42. Used by wzp-desktop's setup() to verify dlopen + dlsym
-/// work before any audio code runs.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_version() -> i32 {
-    42
-}
-
-/// Writes a NUL-terminated string into `out` (capped at `cap`) and
-/// returns bytes written excluding the NUL.
-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn wzp_native_hello(out: *mut u8, cap: usize) -> usize {
-    const MSG: &[u8] = b"hello from wzp-native\0";
-    if out.is_null() || cap == 0 {
-        return 0;
-    }
-    let n = MSG.len().min(cap);
-    unsafe {
-        core::ptr::copy_nonoverlapping(MSG.as_ptr(), out, n);
-        *out.add(n - 1) = 0;
-    }
-    n - 1
-}
-
-// ─── C++ Oboe bridge FFI ─────────────────────────────────────────────────
-
-#[repr(C)]
-struct WzpOboeConfig {
-    sample_rate: i32,
-    frames_per_burst: i32,
-    channel_count: i32,
-    /// When nonzero, capture stream skips setSampleRate and setInputPreset
-    /// so the system can route to BT SCO at its native rate (8/16kHz).
-    /// Oboe's SampleRateConversionQuality::Best resamples to 48kHz.
-    bt_active: i32,
-}
-
-#[repr(C)]
-struct WzpOboeRings {
-    capture_buf: *mut i16,
-    capture_capacity: i32,
-    capture_write_idx: *mut AtomicI32,
-    capture_read_idx: *mut AtomicI32,
-    playout_buf: *mut i16,
-    playout_capacity: i32,
-    playout_write_idx: *mut AtomicI32,
-    playout_read_idx: *mut AtomicI32,
-}
-
-// SAFETY: atomics synchronise producer/consumer; raw pointers are owned
-// by the AudioBackend singleton below whose lifetime covers all calls.
-unsafe impl Send for WzpOboeRings {}
-unsafe impl Sync for WzpOboeRings {}
-
-unsafe extern "C" {
-    fn wzp_oboe_start(config: *const WzpOboeConfig, rings: *const WzpOboeRings) -> i32;
-    fn wzp_oboe_stop();
-    fn wzp_oboe_capture_latency_ms() -> f32;
-    fn wzp_oboe_playout_latency_ms() -> f32;
-    fn wzp_oboe_is_running() -> i32;
-}
-
-// ─── SPSC ring buffer (shared with C++ via AtomicI32) ────────────────────
-
-/// 20 ms @ 48 kHz mono = 960 samples.
-const FRAME_SAMPLES: usize = 960;
-/// ~160 ms headroom at 48 kHz.
-const RING_CAPACITY: usize = 7680;
-
-struct RingBuffer {
-    buf: Vec<i16>,
-    capacity: usize,
-    write_idx: AtomicI32,
-    read_idx: AtomicI32,
-}
-
-// SAFETY: SPSC with atomic read/write cursors; producer and consumer
-// are always on different threads.
-unsafe impl Send for RingBuffer {}
-unsafe impl Sync for RingBuffer {}
-
-impl RingBuffer {
-    fn new(capacity: usize) -> Self {
-        Self {
-            buf: vec![0i16; capacity],
-            capacity,
-            write_idx: AtomicI32::new(0),
-            read_idx: AtomicI32::new(0),
-        }
-    }
-
-    fn available_read(&self) -> usize {
-        let w = self.write_idx.load(Ordering::Acquire);
-        let r = self.read_idx.load(Ordering::Relaxed);
-        let avail = w - r;
-        if avail < 0 { (avail + self.capacity as i32) as usize } else { avail as usize }
-    }
-
-    fn available_write(&self) -> usize {
-        self.capacity - 1 - self.available_read()
-    }
-
-    fn write(&self, data: &[i16]) -> usize {
-        let count = data.len().min(self.available_write());
-        if count == 0 {
-            return 0;
-        }
-        let mut w = self.write_idx.load(Ordering::Relaxed) as usize;
-        let cap = self.capacity;
-        let buf_ptr = self.buf.as_ptr() as *mut i16;
-        for sample in &data[..count] {
-            unsafe { *buf_ptr.add(w) = *sample; }
-            w += 1;
-            if w >= cap { w = 0; }
-        }
-        self.write_idx.store(w as i32, Ordering::Release);
-        count
-    }
-
-    fn read(&self, out: &mut [i16]) -> usize {
-        let count = out.len().min(self.available_read());
-        if count == 0 {
-            return 0;
-        }
-        let mut r = self.read_idx.load(Ordering::Relaxed) as usize;
-        let cap = self.capacity;
-        let buf_ptr = self.buf.as_ptr();
-        for slot in &mut out[..count] {
-            unsafe { *slot = *buf_ptr.add(r); }
-            r += 1;
-            if r >= cap { r = 0; }
-        }
-        self.read_idx.store(r as i32, Ordering::Release);
-        count
-    }
-
-    fn buf_ptr(&self) -> *mut i16 {
-        self.buf.as_ptr() as *mut i16
-    }
-    fn write_idx_ptr(&self) -> *mut AtomicI32 {
-        &self.write_idx as *const AtomicI32 as *mut AtomicI32
-    }
-    fn read_idx_ptr(&self) -> *mut AtomicI32 {
-        &self.read_idx as *const AtomicI32 as *mut AtomicI32
-    }
-}
-
-// ─── AudioBackend singleton ──────────────────────────────────────────────
-//
-// There is one global AudioBackend instance because Oboe's C++ side
-// holds its own singleton of the streams. The `Box::leak`'d statics own
-// the ring buffers for the lifetime of the process — dropping them while
-// Oboe is still running would cause use-after-free in the audio callback.
-
-use std::sync::OnceLock;
-
-struct AudioBackend {
-    capture: RingBuffer,
-    playout: RingBuffer,
-    started: std::sync::Mutex<bool>,
-    /// Per-write logging throttle counter for wzp_native_audio_write_playout.
-    playout_write_log_count: std::sync::atomic::AtomicU64,
-    /// Fix A (task #35): the playout ring's read_idx at the last
-    /// check. If audio_write_playout observes read_idx hasn't
-    /// advanced after N writes, the Oboe playout callback has
-    /// stopped firing → restart the streams.
-    playout_last_read_idx: std::sync::atomic::AtomicI32,
-    /// Number of writes since the last read_idx advance.
-    playout_stall_writes: std::sync::atomic::AtomicU32,
-}
-
-static BACKEND: OnceLock<&'static AudioBackend> = OnceLock::new();
-
-fn backend() -> &'static AudioBackend {
-    BACKEND.get_or_init(|| {
-        Box::leak(Box::new(AudioBackend {
-            capture: RingBuffer::new(RING_CAPACITY),
-            playout: RingBuffer::new(RING_CAPACITY),
-            started: std::sync::Mutex::new(false),
-            playout_write_log_count: std::sync::atomic::AtomicU64::new(0),
-            playout_last_read_idx: std::sync::atomic::AtomicI32::new(0),
-            playout_stall_writes: std::sync::atomic::AtomicU32::new(0),
-        }))
-    })
-}
-
-// ─── C FFI for wzp-desktop ───────────────────────────────────────────────
-
-/// Start the Oboe audio streams. Returns 0 on success, non-zero on error.
-/// Idempotent — calling while already running is a no-op that returns 0.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_start() -> i32 {
-    audio_start_inner(false)
-}
-
-/// Start Oboe in Bluetooth SCO mode — skips sample rate and input preset
-/// on capture so the system can route to the BT SCO device natively.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_start_bt() -> i32 {
-    audio_start_inner(true)
-}
-
-fn audio_start_inner(bt: bool) -> i32 {
-    let b = backend();
-    let mut started = match b.started.lock() {
-        Ok(g) => g,
-        Err(_) => return -1,
-    };
-    if *started {
-        return 0;
-    }
-
-    let config = WzpOboeConfig {
-        sample_rate: 48_000,
-        frames_per_burst: FRAME_SAMPLES as i32,
-        channel_count: 1,
-        bt_active: if bt { 1 } else { 0 },
-    };
-    let rings = WzpOboeRings {
-        capture_buf: b.capture.buf_ptr(),
-        capture_capacity: b.capture.capacity as i32,
-        capture_write_idx: b.capture.write_idx_ptr(),
-        capture_read_idx: b.capture.read_idx_ptr(),
-        playout_buf: b.playout.buf_ptr(),
-        playout_capacity: b.playout.capacity as i32,
-        playout_write_idx: b.playout.write_idx_ptr(),
-        playout_read_idx: b.playout.read_idx_ptr(),
-    };
-    let ret = unsafe { wzp_oboe_start(&config, &rings) };
-    if ret != 0 {
-        return ret;
-    }
-    *started = true;
-    0
-}
-
-/// Stop Oboe. Idempotent. Safe to call from any thread.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_stop() {
-    let b = backend();
-    if let Ok(mut started) = b.started.lock() {
-        if *started {
-            unsafe { wzp_oboe_stop() };
-            *started = false;
-        }
-    }
-}
-
-/// Read captured PCM samples from the capture ring. Returns the number
-/// of `i16` samples actually copied into `out` (may be less than
-/// `out_len` if the ring is empty).
-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn wzp_native_audio_read_capture(out: *mut i16, out_len: usize) -> usize {
-    if out.is_null() || out_len == 0 {
-        return 0;
-    }
-    let slice = unsafe { std::slice::from_raw_parts_mut(out, out_len) };
-    backend().capture.read(slice)
-}
-
-/// Write PCM samples into the playout ring. Returns the number of
-/// samples actually enqueued (may be less than `in_len` if the ring
-/// is nearly full — in practice the caller should pace to 20 ms
-/// frames and spin briefly if the ring is full).
-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn wzp_native_audio_write_playout(input: *const i16, in_len: usize) -> usize {
-    if input.is_null() || in_len == 0 {
-        return 0;
-    }
-    let slice = unsafe { std::slice::from_raw_parts(input, in_len) };
-    let b = backend();
-
-    // Fix A (task #35): detect playout callback stall. If the
-    // playout ring's read_idx hasn't advanced in 50+ writes
-    // (~1 second at 50 writes/sec), the Oboe playout callback
-    // has stopped firing → restart the streams. This is the
-    // self-healing behavior that makes rejoin work: teardown +
-    // rebuild clears whatever HAL state locked up the callback.
-    let current_read_idx = b.playout.read_idx.load(std::sync::atomic::Ordering::Relaxed);
-    let last_read_idx = b.playout_last_read_idx.load(std::sync::atomic::Ordering::Relaxed);
-    if current_read_idx == last_read_idx {
-        let stall = b.playout_stall_writes.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-        if stall >= 50 {
-            // Callback hasn't drained anything in ~1 second.
-            // Force a stream restart.
-            unsafe {
-                android_log("playout STALL detected (50 writes, read_idx unchanged) — restarting Oboe streams");
-            }
-            b.playout_stall_writes.store(0, std::sync::atomic::Ordering::Relaxed);
-            // Release the started lock, stop, re-start.
-            // This is the same logic as the Rust-side
-            // audio_stop() + audio_start() but done inline
-            // because we can't call the extern "C" fns
-            // recursively. Just call the C++ side directly.
-            {
-                if let Ok(mut started) = b.started.lock() {
-                    if *started {
-                        unsafe { wzp_oboe_stop() };
-                        *started = false;
-                    }
-                }
-            }
-            // Clear the rings so the restart doesn't read stale data
-            b.playout.write_idx.store(0, std::sync::atomic::Ordering::Relaxed);
-            b.playout.read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
-            b.capture.write_idx.store(0, std::sync::atomic::Ordering::Relaxed);
-            b.capture.read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
-            // Re-start (stall detector — always non-BT mode)
-            let config = WzpOboeConfig {
-                sample_rate: 48_000,
-                frames_per_burst: FRAME_SAMPLES as i32,
-                channel_count: 1,
-                bt_active: 0,
-            };
-            let rings = WzpOboeRings {
-                capture_buf: b.capture.buf_ptr(),
-                capture_capacity: b.capture.capacity as i32,
-                capture_write_idx: b.capture.write_idx_ptr(),
-                capture_read_idx: b.capture.read_idx_ptr(),
-                playout_buf: b.playout.buf_ptr(),
-                playout_capacity: b.playout.capacity as i32,
-                playout_write_idx: b.playout.write_idx_ptr(),
-                playout_read_idx: b.playout.read_idx_ptr(),
-            };
-            let ret = unsafe { wzp_oboe_start(&config, &rings) };
-            if ret == 0 {
-                if let Ok(mut started) = b.started.lock() {
-                    *started = true;
-                }
-                unsafe { android_log("playout restart OK — Oboe streams rebuilt"); }
-            } else {
-                unsafe { android_log(&format!("playout restart FAILED: {ret}")); }
-            }
-            b.playout_last_read_idx.store(0, std::sync::atomic::Ordering::Relaxed);
-            return 0; // caller will retry on next frame
-        }
-    } else {
-        // read_idx advanced — callback is alive, reset counter
-        b.playout_stall_writes.store(0, std::sync::atomic::Ordering::Relaxed);
-        b.playout_last_read_idx.store(current_read_idx, std::sync::atomic::Ordering::Relaxed);
-    }
-
-    let before_w = b.playout.write_idx.load(std::sync::atomic::Ordering::Relaxed);
-    let before_r = b.playout.read_idx.load(std::sync::atomic::Ordering::Relaxed);
-    let written = b.playout.write(slice);
-    // First few writes: log ring state + sample range so we can compare what
-    // engine.rs hands us to what the C++ playout callback reads.
-    let first_writes = b.playout_write_log_count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-    if first_writes < 3 || first_writes % 50 == 0 {
-        let (mut lo, mut hi, mut sumsq) = (i16::MAX, i16::MIN, 0i64);
-        for &s in slice.iter() {
-            if s < lo { lo = s; }
-            if s > hi { hi = s; }
-            sumsq += (s as i64) * (s as i64);
-        }
-        let rms = (sumsq as f64 / slice.len() as f64).sqrt() as i32;
-        let avail_w_after = b.playout.available_write();
-        let avail_r_after = b.playout.available_read();
-        let msg = format!(
-            "playout WRITE #{first_writes}: in_len={} written={} range=[{lo}..{hi}] rms={rms} before_w={before_w} before_r={before_r} avail_read_after={avail_r_after} avail_write_after={avail_w_after}",
-            slice.len(), written
-        );
-        unsafe {
-            android_log(msg.as_str());
-        }
-    }
-    written
-}
-
-// Minimal android logcat shim so we can print from the cdylib without pulling
-// in android_logger crate (which would add another dep that has to build with
-// cargo-ndk). Uses libc's __android_log_print via extern linkage.
-#[cfg(target_os = "android")]
-unsafe extern "C" {
-    fn __android_log_write(prio: i32, tag: *const u8, text: *const u8) -> i32;
-}
-
-#[cfg(target_os = "android")]
-unsafe fn android_log(msg: &str) {
-    // ANDROID_LOG_INFO = 4. Tag and text must be NUL-terminated.
-    let tag = b"wzp-native\0";
-    let mut buf = Vec::with_capacity(msg.len() + 1);
-    buf.extend_from_slice(msg.as_bytes());
-    buf.push(0);
-    unsafe { __android_log_write(4, tag.as_ptr(), buf.as_ptr()); }
-}
-
-#[cfg(not(target_os = "android"))]
-#[allow(dead_code)]
-unsafe fn android_log(_msg: &str) {}
-
-/// Current capture latency reported by Oboe, in milliseconds. Returns
-/// NaN / 0.0 if the stream isn't running.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_capture_latency_ms() -> f32 {
-    unsafe { wzp_oboe_capture_latency_ms() }
-}
-
-/// Current playout latency reported by Oboe, in milliseconds.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_playout_latency_ms() -> f32 {
-    unsafe { wzp_oboe_playout_latency_ms() }
-}
-
-/// Non-zero if both Oboe streams are currently running.
-#[unsafe(no_mangle)]
-pub extern "C" fn wzp_native_audio_is_running() -> i32 {
-    unsafe { wzp_oboe_is_running() }
-}

crates/wzp-proto/src/dred_tuner.rs

@@ -1,312 +0,0 @@
-//! Continuous DRED tuning from real-time network metrics.
-//!
-//! Instead of locking DRED duration to 3 discrete quality tiers (100/200/500 ms),
-//! `DredTuner` maps live path quality metrics to a continuous DRED duration and
-//! expected-loss hint, updated every N packets. This makes DRED reactive within
-//! ~200 ms instead of waiting for 3+ consecutive bad quality reports to trigger
-//! a full tier transition.
-//!
-//! The tuner also implements pre-emptive jitter-spike detection ("sawtooth"
-//! prediction): when jitter variance spikes >30% over a 200 ms window — typical
-//! of Starlink satellite handovers — it temporarily boosts DRED to the maximum
-//! allowed for the current codec before packets actually start dropping.
-
-use crate::CodecId;
-
-/// Output of a single tuning cycle.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct DredTuning {
-    /// DRED duration in 10 ms frame units (0–104). Passed directly to
-    /// `OpusEncoder::set_dred_duration()`.
-    pub dred_frames: u8,
-    /// Expected packet loss percentage (0–100). Passed to
-    /// `OpusEncoder::set_expected_loss()`. Floored at 15% by the encoder
-    /// itself, but we pass the real value so the encoder can override upward.
-    pub expected_loss_pct: u8,
-}
-
-/// Minimum DRED frames for any Opus codec (matches DRED_LOSS_FLOOR_PCT logic:
-/// at 15% loss, libopus 1.5 emits ~95 ms of DRED, which needs at least 10
-/// frames configured to be useful).
-const MIN_DRED_FRAMES: u8 = 5;
-
-/// Maximum DRED frames libopus supports (104 × 10 ms = 1040 ms).
-const MAX_DRED_FRAMES: u8 = 104;
-
-/// Jitter variance spike ratio that triggers pre-emptive DRED boost.
-const JITTER_SPIKE_RATIO: f32 = 1.3;
-
-/// How many tuning cycles a jitter-spike boost persists (at 25 packets/cycle
-/// and 20 ms/packet, 10 cycles ≈ 5 seconds).
-const SPIKE_BOOST_COOLDOWN_CYCLES: u32 = 10;
-
-/// Maps codec tier to its baseline DRED frames (used when network is healthy).
-fn baseline_dred_frames(codec: CodecId) -> u8 {
-    match codec {
-        CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 10, // 100 ms
-        CodecId::Opus16k | CodecId::Opus24k => 20,                    // 200 ms
-        CodecId::Opus6k => 50,                                         // 500 ms
-        _ => 0,
-    }
-}
-
-/// Maps codec tier to its maximum allowed DRED frames under spike/bad conditions.
-fn max_dred_frames_for(codec: CodecId) -> u8 {
-    match codec {
-        // Studio: cap at 300 ms (don't waste bitrate on good links)
-        CodecId::Opus32k | CodecId::Opus48k | CodecId::Opus64k => 30,
-        // Normal: cap at 500 ms
-        CodecId::Opus16k | CodecId::Opus24k => 50,
-        // Degraded: allow full 1040 ms
-        CodecId::Opus6k => MAX_DRED_FRAMES,
-        _ => 0,
-    }
-}
-
-/// Continuous DRED tuner driven by network path metrics.
-pub struct DredTuner {
-    /// Current codec (determines baseline and ceiling).
-    codec: CodecId,
-    /// Last computed tuning output.
-    last_tuning: DredTuning,
-    /// EWMA-smoothed jitter for spike detection (in ms).
-    jitter_ewma: f32,
-    /// Remaining cooldown cycles for a jitter-spike boost.
-    spike_cooldown: u32,
-    /// Whether the tuner has received at least one observation.
-    initialized: bool,
-}
-
-impl DredTuner {
-    /// Create a new tuner for the given codec.
-    pub fn new(codec: CodecId) -> Self {
-        let baseline = baseline_dred_frames(codec);
-        Self {
-            codec,
-            last_tuning: DredTuning {
-                dred_frames: baseline,
-                expected_loss_pct: 15, // match DRED_LOSS_FLOOR_PCT
-            },
-            jitter_ewma: 0.0,
-            spike_cooldown: 0,
-            initialized: false,
-        }
-    }
-
-    /// Update the active codec (e.g. on tier transition). Resets spike state.
-    pub fn set_codec(&mut self, codec: CodecId) {
-        self.codec = codec;
-        self.spike_cooldown = 0;
-    }
-
-    /// Feed network metrics and compute new DRED parameters.
-    ///
-    /// Call this every tuning cycle (e.g. every 25 packets ≈ 500 ms at 20 ms
-    /// frame duration).
-    ///
-    /// - `loss_pct`: observed packet loss (0.0–100.0)
-    /// - `rtt_ms`: smoothed round-trip time
-    /// - `jitter_ms`: current jitter estimate (RTT variance)
-    ///
-    /// Returns `Some(tuning)` if the output changed, `None` if unchanged.
-    pub fn update(&mut self, loss_pct: f32, rtt_ms: u32, jitter_ms: u32) -> Option<DredTuning> {
-        if !self.codec.is_opus() {
-            return None;
-        }
-
-        let baseline = baseline_dred_frames(self.codec);
-        let ceiling = max_dred_frames_for(self.codec);
-
-        // --- Jitter spike detection ---
-        let jitter_f = jitter_ms as f32;
-        if !self.initialized {
-            self.jitter_ewma = jitter_f;
-            self.initialized = true;
-        } else {
-            // Fast-up (alpha=0.3), slow-down (alpha=0.05) asymmetric EWMA
-            let alpha = if jitter_f > self.jitter_ewma { 0.3 } else { 0.05 };
-            self.jitter_ewma = alpha * jitter_f + (1.0 - alpha) * self.jitter_ewma;
-        }
-
-        // Detect spike: instantaneous jitter > EWMA × 1.3
-        if self.jitter_ewma > 1.0 && jitter_f > self.jitter_ewma * JITTER_SPIKE_RATIO {
-            self.spike_cooldown = SPIKE_BOOST_COOLDOWN_CYCLES;
-        }
-
-        // Decrement cooldown
-        if self.spike_cooldown > 0 {
-            self.spike_cooldown -= 1;
-        }
-
-        // --- Compute DRED frames ---
-        let dred_frames = if self.spike_cooldown > 0 {
-            // During spike boost: jump to ceiling
-            ceiling
-        } else {
-            // Continuous mapping: scale linearly between baseline and ceiling
-            // based on loss percentage.
-            //   0% loss → baseline
-            //  40% loss → ceiling
-            let loss_clamped = loss_pct.clamp(0.0, 40.0);
-            let t = loss_clamped / 40.0;
-            let raw = baseline as f32 + t * (ceiling - baseline) as f32;
-            (raw as u8).clamp(MIN_DRED_FRAMES, ceiling)
-        };
-
-        // --- Compute expected loss hint ---
-        // Pass the real loss so the encoder can clamp at its own floor (15%).
-        // For RTT-driven boost: high RTT suggests impending loss, so add a
-        // phantom loss contribution to keep DRED emitting generously.
-        let rtt_loss_phantom = if rtt_ms > 200 {
-            ((rtt_ms - 200) as f32 / 40.0).min(15.0)
-        } else {
-            0.0
-        };
-        let expected_loss = (loss_pct + rtt_loss_phantom).clamp(0.0, 100.0) as u8;
-
-        let tuning = DredTuning {
-            dred_frames,
-            expected_loss_pct: expected_loss,
-        };
-
-        if tuning != self.last_tuning {
-            self.last_tuning = tuning;
-            Some(tuning)
-        } else {
-            None
-        }
-    }
-
-    /// Get the last computed tuning without updating.
-    pub fn current(&self) -> DredTuning {
-        self.last_tuning
-    }
-
-    /// Whether a jitter-spike boost is currently active.
-    pub fn spike_boost_active(&self) -> bool {
-        self.spike_cooldown > 0
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn baseline_for_opus24k() {
-        let tuner = DredTuner::new(CodecId::Opus24k);
-        assert_eq!(tuner.current().dred_frames, 20); // 200 ms
-    }
-
-    #[test]
-    fn baseline_for_opus6k() {
-        let tuner = DredTuner::new(CodecId::Opus6k);
-        assert_eq!(tuner.current().dred_frames, 50); // 500 ms
-    }
-
-    #[test]
-    fn codec2_returns_none() {
-        let mut tuner = DredTuner::new(CodecId::Codec2_1200);
-        assert!(tuner.update(10.0, 100, 20).is_none());
-    }
-
-    #[test]
-    fn scales_with_loss() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // 0% loss → baseline (20 frames)
-        tuner.update(0.0, 50, 5);
-        assert_eq!(tuner.current().dred_frames, 20);
-
-        // 20% loss → midpoint between 20 and 50 = 35
-        tuner.update(20.0, 50, 5);
-        assert_eq!(tuner.current().dred_frames, 35);
-
-        // 40%+ loss → ceiling (50 frames)
-        tuner.update(40.0, 50, 5);
-        assert_eq!(tuner.current().dred_frames, 50);
-    }
-
-    #[test]
-    fn jitter_spike_triggers_boost() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // Establish baseline jitter
-        for _ in 0..20 {
-            tuner.update(0.0, 50, 10);
-        }
-        assert!(!tuner.spike_boost_active());
-
-        // Spike: jitter jumps to 50 ms (5x the EWMA of ~10)
-        tuner.update(0.0, 50, 50);
-        assert!(tuner.spike_boost_active());
-        // Should be at ceiling (50 frames = 500 ms for Opus24k)
-        assert_eq!(tuner.current().dred_frames, 50);
-    }
-
-    #[test]
-    fn spike_cooldown_decays() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // Establish baseline then spike
-        for _ in 0..20 {
-            tuner.update(0.0, 50, 10);
-        }
-        tuner.update(0.0, 50, 50);
-        assert!(tuner.spike_boost_active());
-
-        // Run through cooldown
-        for _ in 0..SPIKE_BOOST_COOLDOWN_CYCLES {
-            tuner.update(0.0, 50, 10);
-        }
-        assert!(!tuner.spike_boost_active());
-        // Should return to baseline
-        assert_eq!(tuner.current().dred_frames, 20);
-    }
-
-    #[test]
-    fn rtt_phantom_loss() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // High RTT (400ms) with 0% real loss
-        tuner.update(0.0, 400, 10);
-        // Phantom loss = (400-200)/40 = 5
-        assert_eq!(tuner.current().expected_loss_pct, 5);
-    }
-
-    #[test]
-    fn set_codec_resets_spike() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // Trigger spike
-        for _ in 0..20 {
-            tuner.update(0.0, 50, 10);
-        }
-        tuner.update(0.0, 50, 50);
-        assert!(tuner.spike_boost_active());
-
-        // Switch codec — spike should reset
-        tuner.set_codec(CodecId::Opus6k);
-        assert!(!tuner.spike_boost_active());
-    }
-
-    #[test]
-    fn opus6k_reaches_max_1040ms() {
-        let mut tuner = DredTuner::new(CodecId::Opus6k);
-
-        // High loss → should reach 104 frames (1040 ms)
-        tuner.update(40.0, 50, 5);
-        assert_eq!(tuner.current().dred_frames, MAX_DRED_FRAMES);
-    }
-
-    #[test]
-    fn returns_none_when_unchanged() {
-        let mut tuner = DredTuner::new(CodecId::Opus24k);
-
-        // First update always returns Some (initial → computed)
-        let first = tuner.update(0.0, 50, 5);
-        // Same inputs → None
-        let second = tuner.update(0.0, 50, 5);
-        assert!(first.is_some() || second.is_none());
-    }
-}

crates/wzp-proto/src/error.rs

@@ -53,15 +53,6 @@ pub enum TransportError {
     Timeout { ms: u64 },
     #[error("io error: {0}")]
     Io(#[from] std::io::Error),
-    /// Parsed wire bytes successfully but the payload didn't
-    /// deserialize into a known `SignalMessage` variant. Usually
-    /// means the peer is running a newer build with a variant we
-    /// don't know yet. Callers should **log and continue** rather
-    /// than tearing down the connection, so that forward-compat
-    /// additions to `SignalMessage` don't silently kill old
-    /// clients/relays.
-    #[error("signal deserialize: {0}")]
-    Deserialize(String),
     #[error("internal transport error: {0}")]
     Internal(String),
 }

crates/wzp-proto/src/lib.rs

@@ -14,7 +14,6 @@
 
 pub mod bandwidth;
 pub mod codec_id;
-pub mod dred_tuner;
 pub mod error;
 pub mod jitter;
 pub mod packet;
@@ -31,7 +30,6 @@ pub use packet::{
     FRAME_TYPE_MINI,
 };
 pub use bandwidth::{BandwidthEstimator, CongestionState};
-pub use dred_tuner::{DredTuner, DredTuning};
 pub use quality::{AdaptiveQualityController, NetworkContext, Tier};
 pub use session::{Session, SessionEvent, SessionState};
 pub use traits::*;

crates/wzp-proto/src/packet.rs

@@ -608,14 +608,8 @@ pub enum SignalMessage {
     Ping { timestamp_ms: u64 },
     Pong { timestamp_ms: u64 },
 
-    /// End the call. `call_id` is optional for backwards compatibility
-    /// with older clients that send Hangup without it — the relay falls
-    /// back to ending ALL active calls for the sender in that case.
-    Hangup {
-        reason: HangupReason,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        call_id: Option<String>,
-    },
+    /// End the call.
+    Hangup { reason: HangupReason },
 
     /// featherChat bearer token for relay authentication.
     /// Sent as the first signal message when --auth-url is configured.
@@ -722,9 +716,6 @@ pub enum SignalMessage {
         success: bool,
         #[serde(skip_serializing_if = "Option::is_none")]
         error: Option<String>,
-        /// Relay's build version (git short hash).
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        relay_build: Option<String>,
     },
 
     /// Direct call offer routed through the relay to a specific peer.
@@ -745,28 +736,6 @@ pub enum SignalMessage {
         signature: Vec<u8>,
         /// Supported quality profiles.
         supported_profiles: Vec<crate::QualityProfile>,
-        /// Phase 3 (hole-punching): caller's own server-reflexive
-        /// address as learned via `SignalMessage::Reflect`. The
-        /// relay stashes this in its call registry and later
-        /// injects it into the callee's `CallSetup.peer_direct_addr`
-        /// so the callee can try a direct QUIC handshake to the
-        /// caller instead of routing media through the relay.
-        /// `None` means "caller doesn't want P2P, use relay only".
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        caller_reflexive_addr: Option<String>,
-        /// Phase 5.5 (ICE host candidates): caller's LAN-local
-        /// interface addresses paired with its signal endpoint's
-        /// port. Peers on the same physical LAN can direct-dial
-        /// these without going through the WAN reflex addr,
-        /// which is important because most consumer NATs
-        /// (including MikroTik masquerade) don't support NAT
-        /// hairpinning — the reflex addr is unreachable from
-        /// the same LAN.
-        #[serde(default, skip_serializing_if = "Vec::is_empty")]
-        caller_local_addrs: Vec<String>,
-        /// Build version (git short hash) for debugging.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        caller_build_version: Option<String>,
     },
 
     /// Callee's response to a direct call.
@@ -786,23 +755,6 @@ pub enum SignalMessage {
         /// Chosen quality profile (present when accepting).
         #[serde(skip_serializing_if = "Option::is_none")]
         chosen_profile: Option<crate::QualityProfile>,
-        /// Phase 3 (hole-punching): callee's own server-reflexive
-        /// address, only populated on `AcceptTrusted` — privacy-mode
-        /// answers leave this `None` so the callee's real IP stays
-        /// hidden (the whole point of `AcceptGeneric`). The relay
-        /// carries it opaquely into the caller's `CallSetup`.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        callee_reflexive_addr: Option<String>,
-        /// Phase 5.5 (ICE host candidates): callee's LAN-local
-        /// interface addresses. Same purpose as
-        /// `caller_local_addrs` in `DirectCallOffer`. Only
-        /// populated on `AcceptTrusted` alongside
-        /// `callee_reflexive_addr`.
-        #[serde(default, skip_serializing_if = "Vec::is_empty")]
-        callee_local_addrs: Vec<String>,
-        /// Build version (git short hash) for debugging.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        callee_build_version: Option<String>,
     },
 
     /// Relay tells both parties: media room is ready.
@@ -812,119 +764,12 @@ pub enum SignalMessage {
         room: String,
         /// Relay address for the QUIC media connection.
         relay_addr: String,
-        /// Phase 3 (hole-punching): the OTHER party's server-reflexive
-        /// address as the relay learned it from the offer/answer
-        /// exchange. When populated, clients attempt a direct QUIC
-        /// handshake to this address in parallel with the existing
-        /// relay path and use whichever connects first. `None`
-        /// means the relay path is the only option — either because
-        /// a peer didn't advertise its addr (Phase 1/2 relay or
-        /// privacy-mode answer) or because the relay decided P2P
-        /// wasn't viable.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        peer_direct_addr: Option<String>,
-        /// Phase 5.5 (ICE host candidates): the OTHER party's LAN
-        /// host addresses (RFC1918 IPv4 + CGNAT + non-link-local
-        /// IPv6). On same-LAN calls these are directly dialable
-        /// and bypass the NAT-hairpinning problem that blocks
-        /// same-LAN peers from using `peer_direct_addr`.
-        /// Client-side race tries all of these in parallel.
-        #[serde(default, skip_serializing_if = "Vec::is_empty")]
-        peer_local_addrs: Vec<String>,
     },
 
     /// Ringing notification (relay → caller, callee received the offer).
     CallRinging {
         call_id: String,
     },
-
-    // ── NAT reflection ("STUN for QUIC") ──────────────────────────────
-
-    /// Client → relay: "please tell me the source IP:port you see on
-    /// this connection". A QUIC-native replacement for classic STUN
-    /// that reuses the TLS-authenticated signal channel to the relay
-    /// instead of running a separate UDP reflection service on port
-    /// 3478. The relay answers with `ReflectResponse`.
-    ///
-    /// No payload — the relay already knows which connection the
-    /// request arrived on, and `connection.remote_address()` gives it
-    /// the exact source address (post-NAT) as observed from the
-    /// server side of the TLS session.
-    Reflect,
-
-    /// Relay → client: response to `Reflect`. Carries the socket
-    /// address the relay observes as the client's source for this
-    /// QUIC connection in `SocketAddr::to_string()` form — "a.b.c.d:p"
-    /// for IPv4, "[::1]:p" for IPv6. Clients parse it with
-    /// `SocketAddr::from_str`.
-    ReflectResponse {
-        observed_addr: String,
-    },
-
-    // ── Phase 6: ICE-style path negotiation ─────────────────────
-
-    /// Phase 6: each side reports the result of its local dual-
-    /// path race to the other side through the relay. Both peers
-    /// send this after their race completes; both wait for the
-    /// other's report before committing a transport to the
-    /// CallEngine.
-    ///
-    /// The decision rule is: if BOTH sides report `direct_ok =
-    /// true`, use the direct P2P connection. If EITHER reports
-    /// `direct_ok = false`, BOTH fall back to relay. This
-    /// eliminates the race condition where one side picks Direct
-    /// and the other picks Relay — they now agree on the path
-    /// before any media flows.
-    MediaPathReport {
-        call_id: String,
-        /// Did the direct QUIC connection (P2P dial or accept)
-        /// complete successfully on this side?
-        direct_ok: bool,
-        /// Which future won the local tokio::select race?
-        /// "Direct" or "Relay" — informational for debug logs.
-        #[serde(default)]
-        race_winner: String,
-    },
-
-    // ── Phase 4: cross-relay direct-call signaling ────────────────────
-
-    /// Phase 4: relay-to-relay envelope for forwarding direct-call
-    /// signaling across a federation link. When Alice on Relay A
-    /// sends a `DirectCallOffer` for Bob whose fingerprint isn't
-    /// in A's local SignalHub, Relay A wraps the offer in this
-    /// envelope and broadcasts it over every active federation
-    /// peer link. Whichever peer has Bob registered unwraps the
-    /// inner message and delivers it locally.
-    ///
-    /// Never originated by clients — only relays create and
-    /// consume this variant.
-    ///
-    /// Loop prevention: the receiving relay drops any forward
-    /// where `origin_relay_fp` matches its own federation TLS
-    /// fingerprint. With broadcast-to-all-peers this prevents
-    /// A→B→A echo loops; proper TTL + dedup will land when
-    /// multi-hop federation is added (Phase 4.2).
-    FederatedSignalForward {
-        /// The signal message being forwarded
-        /// (`DirectCallOffer`, `DirectCallAnswer`, `CallRinging`,
-        /// `Hangup`, ...). Boxed because `SignalMessage` is
-        /// relatively large and JSON serde handles recursion
-        /// cleanly.
-        inner: Box<SignalMessage>,
-        /// Federation TLS fingerprint of the sending relay.
-        /// Used (a) for loop prevention by the receiver and (b)
-        /// to route the peer's reply back through the same
-        /// federation link via `send_signal_to_peer`.
-        origin_relay_fp: String,
-    },
-
-    /// Relay-initiated quality directive: all participants should switch
-    /// to the recommended profile to match the weakest link.
-    QualityDirective {
-        recommended_profile: crate::QualityProfile,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        reason: Option<String>,
-    },
 }
 
 /// How the callee responds to a direct call.
@@ -1063,272 +908,6 @@ mod tests {
         assert_eq!(packet.quality_report, decoded.quality_report);
     }
 
-    #[test]
-    fn reflect_serialize_roundtrip() {
-        // Reflect is a unit variant — the client sends it with no
-        // payload and the relay answers with the observed source addr.
-        let req = SignalMessage::Reflect;
-        let json = serde_json::to_string(&req).unwrap();
-        let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-        assert!(matches!(decoded, SignalMessage::Reflect));
-
-        // ReflectResponse carries a string — exercise both IPv4 and
-        // IPv6 shapes because SocketAddr::to_string uses [::1]:port
-        // for v6 and the client side has to parse that back.
-        for addr in ["192.0.2.17:4433", "[2001:db8::1]:4433", "127.0.0.1:54321"] {
-            let resp = SignalMessage::ReflectResponse {
-                observed_addr: addr.to_string(),
-            };
-            let json = serde_json::to_string(&resp).unwrap();
-            let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-            match decoded {
-                SignalMessage::ReflectResponse { observed_addr } => {
-                    assert_eq!(observed_addr, addr);
-                    // Must parse back to a SocketAddr cleanly.
-                    let _parsed: std::net::SocketAddr = observed_addr.parse()
-                        .expect("observed_addr must parse as SocketAddr");
-                }
-                _ => panic!("wrong variant after roundtrip"),
-            }
-        }
-    }
-
-    #[test]
-    fn federated_signal_forward_roundtrip() {
-        // Wrap a DirectCallOffer inside FederatedSignalForward and
-        // prove both directions of serde preserve every field.
-        let inner = SignalMessage::DirectCallOffer {
-            caller_fingerprint: "alice".into(),
-            caller_alias: Some("Alice".into()),
-            target_fingerprint: "bob".into(),
-            call_id: "c1".into(),
-            identity_pub: [1u8; 32],
-            ephemeral_pub: [2u8; 32],
-            signature: vec![3u8; 64],
-            supported_profiles: vec![],
-            caller_reflexive_addr: Some("192.0.2.1:4433".into()),
-            caller_local_addrs: Vec::new(),
-            caller_build_version: None,
-        };
-        let forward = SignalMessage::FederatedSignalForward {
-            inner: Box::new(inner),
-            origin_relay_fp: "relay-a-tls-fp".into(),
-        };
-        let json = serde_json::to_string(&forward).unwrap();
-        let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-        match decoded {
-            SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
-                assert_eq!(origin_relay_fp, "relay-a-tls-fp");
-                match *inner {
-                    SignalMessage::DirectCallOffer {
-                        caller_fingerprint,
-                        target_fingerprint,
-                        caller_reflexive_addr,
-                        ..
-                    } => {
-                        assert_eq!(caller_fingerprint, "alice");
-                        assert_eq!(target_fingerprint, "bob");
-                        assert_eq!(caller_reflexive_addr.as_deref(), Some("192.0.2.1:4433"));
-                    }
-                    _ => panic!("inner was not DirectCallOffer after roundtrip"),
-                }
-            }
-            _ => panic!("outer was not FederatedSignalForward"),
-        }
-    }
-
-    #[test]
-    fn federated_signal_forward_can_nest_any_inner() {
-        // Sanity check that every direct-call signaling variant
-        // we intend to forward survives being boxed + re-serialized.
-        let cases: Vec<SignalMessage> = vec![
-            SignalMessage::DirectCallAnswer {
-                call_id: "c1".into(),
-                accept_mode: CallAcceptMode::AcceptTrusted,
-                identity_pub: None,
-                ephemeral_pub: None,
-                signature: None,
-                chosen_profile: None,
-                callee_reflexive_addr: Some("198.51.100.9:4433".into()),
-                callee_local_addrs: Vec::new(),
-                callee_build_version: None,
-            },
-            SignalMessage::CallRinging { call_id: "c1".into() },
-            SignalMessage::Hangup { reason: HangupReason::Normal, call_id: None },
-        ];
-        for inner in cases {
-            let inner_disc = std::mem::discriminant(&inner);
-            let forward = SignalMessage::FederatedSignalForward {
-                inner: Box::new(inner),
-                origin_relay_fp: "r".into(),
-            };
-            let json = serde_json::to_string(&forward).unwrap();
-            let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-            match decoded {
-                SignalMessage::FederatedSignalForward { inner, .. } => {
-                    assert_eq!(std::mem::discriminant(&*inner), inner_disc);
-                }
-                _ => panic!("outer variant lost"),
-            }
-        }
-    }
-
-    #[test]
-    fn hole_punching_optional_fields_roundtrip() {
-        // DirectCallOffer with Some(caller_reflexive_addr)
-        let offer = SignalMessage::DirectCallOffer {
-            caller_fingerprint: "alice".into(),
-            caller_alias: None,
-            target_fingerprint: "bob".into(),
-            call_id: "c1".into(),
-            identity_pub: [0; 32],
-            ephemeral_pub: [0; 32],
-            signature: vec![],
-            supported_profiles: vec![],
-            caller_reflexive_addr: Some("192.0.2.1:4433".into()),
-            caller_local_addrs: Vec::new(),
-            caller_build_version: None,
-        };
-        let json = serde_json::to_string(&offer).unwrap();
-        assert!(
-            json.contains("caller_reflexive_addr"),
-            "Some field must serialize: {json}"
-        );
-        let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-        match decoded {
-            SignalMessage::DirectCallOffer { caller_reflexive_addr, .. } => {
-                assert_eq!(caller_reflexive_addr.as_deref(), Some("192.0.2.1:4433"));
-            }
-            _ => panic!("wrong variant"),
-        }
-
-        // DirectCallOffer with None — skip_serializing_if must
-        // OMIT the field from the JSON so older relays that don't
-        // know about caller_reflexive_addr don't see it.
-        let offer_none = SignalMessage::DirectCallOffer {
-            caller_fingerprint: "alice".into(),
-            caller_alias: None,
-            target_fingerprint: "bob".into(),
-            call_id: "c1".into(),
-            identity_pub: [0; 32],
-            ephemeral_pub: [0; 32],
-            signature: vec![],
-            supported_profiles: vec![],
-            caller_reflexive_addr: None,
-            caller_local_addrs: Vec::new(),
-            caller_build_version: None,
-        };
-        let json_none = serde_json::to_string(&offer_none).unwrap();
-        assert!(
-            !json_none.contains("caller_reflexive_addr"),
-            "None field must NOT serialize: {json_none}"
-        );
-
-        // DirectCallAnswer with callee_reflexive_addr.
-        let answer = SignalMessage::DirectCallAnswer {
-            call_id: "c1".into(),
-            accept_mode: CallAcceptMode::AcceptTrusted,
-            identity_pub: None,
-            ephemeral_pub: None,
-            signature: None,
-            chosen_profile: None,
-            callee_reflexive_addr: Some("198.51.100.9:4433".into()),
-            callee_local_addrs: Vec::new(),
-            callee_build_version: None,
-        };
-        let decoded: SignalMessage =
-            serde_json::from_str(&serde_json::to_string(&answer).unwrap()).unwrap();
-        match decoded {
-            SignalMessage::DirectCallAnswer { callee_reflexive_addr, .. } => {
-                assert_eq!(
-                    callee_reflexive_addr.as_deref(),
-                    Some("198.51.100.9:4433")
-                );
-            }
-            _ => panic!("wrong variant"),
-        }
-
-        // CallSetup with peer_direct_addr.
-        let setup = SignalMessage::CallSetup {
-            call_id: "c1".into(),
-            room: "call-c1".into(),
-            relay_addr: "203.0.113.5:4433".into(),
-            peer_direct_addr: Some("192.0.2.1:4433".into()),
-            peer_local_addrs: Vec::new(),
-        };
-        let decoded: SignalMessage =
-            serde_json::from_str(&serde_json::to_string(&setup).unwrap()).unwrap();
-        match decoded {
-            SignalMessage::CallSetup { peer_direct_addr, .. } => {
-                assert_eq!(peer_direct_addr.as_deref(), Some("192.0.2.1:4433"));
-            }
-            _ => panic!("wrong variant"),
-        }
-    }
-
-    #[test]
-    fn hole_punching_backward_compat_old_json_parses() {
-        // An older client/relay wouldn't include the new fields at
-        // all — the new code must still accept that JSON because
-        // of #[serde(default)] on the Option<String>.
-        let old_offer_json = r#"{
-            "DirectCallOffer": {
-                "caller_fingerprint": "alice",
-                "caller_alias": null,
-                "target_fingerprint": "bob",
-                "call_id": "c1",
-                "identity_pub": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
-                "ephemeral_pub": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
-                "signature": [],
-                "supported_profiles": []
-            }
-        }"#;
-        let decoded: SignalMessage = serde_json::from_str(old_offer_json).unwrap();
-        match decoded {
-            SignalMessage::DirectCallOffer { caller_reflexive_addr, .. } => {
-                assert!(caller_reflexive_addr.is_none());
-            }
-            _ => panic!("wrong variant"),
-        }
-
-        let old_setup_json = r#"{
-            "CallSetup": {
-                "call_id": "c1",
-                "room": "call-c1",
-                "relay_addr": "203.0.113.5:4433"
-            }
-        }"#;
-        let decoded: SignalMessage = serde_json::from_str(old_setup_json).unwrap();
-        match decoded {
-            SignalMessage::CallSetup { peer_direct_addr, .. } => {
-                assert!(peer_direct_addr.is_none());
-            }
-            _ => panic!("wrong variant"),
-        }
-    }
-
-    #[test]
-    fn reflect_backward_compat_with_existing_variants() {
-        // Adding Reflect/ReflectResponse at the end of the enum must
-        // not break JSON round-tripping of existing variants. Smoke-
-        // test a sample of the pre-existing ones.
-        let cases = vec![
-            SignalMessage::Ping { timestamp_ms: 12345 },
-            SignalMessage::Hold,
-            SignalMessage::Hangup { reason: HangupReason::Normal, call_id: None },
-            SignalMessage::CallRinging { call_id: "abcd".into() },
-        ];
-        for m in cases {
-            let json = serde_json::to_string(&m).unwrap();
-            let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-            // Discriminant equality proves variant tag survived.
-            assert_eq!(
-                std::mem::discriminant(&m),
-                std::mem::discriminant(&decoded)
-            );
-        }
-    }
-
     #[test]
     fn hold_unhold_serialize() {
         let hold = SignalMessage::Hold;
@@ -1673,41 +1252,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn quality_directive_roundtrip() {
-        let msg = SignalMessage::QualityDirective {
-            recommended_profile: crate::QualityProfile::DEGRADED,
-            reason: Some("weakest link degraded".into()),
-        };
-        let json = serde_json::to_string(&msg).unwrap();
-        let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-        match decoded {
-            SignalMessage::QualityDirective { recommended_profile, reason } => {
-                assert_eq!(recommended_profile.codec, CodecId::Opus6k);
-                assert_eq!(reason.as_deref(), Some("weakest link degraded"));
-            }
-            _ => panic!("wrong variant"),
-        }
-    }
-
-    #[test]
-    fn quality_directive_without_reason_roundtrip() {
-        let msg = SignalMessage::QualityDirective {
-            recommended_profile: crate::QualityProfile::GOOD,
-            reason: None,
-        };
-        let json = serde_json::to_string(&msg).unwrap();
-        // None reason should be omitted from JSON
-        assert!(!json.contains("reason"));
-        let decoded: SignalMessage = serde_json::from_str(&json).unwrap();
-        match decoded {
-            SignalMessage::QualityDirective { reason, .. } => {
-                assert!(reason.is_none());
-            }
-            _ => panic!("wrong variant"),
-        }
-    }
-
     #[test]
     fn mini_frame_disabled() {
         // Simulate disabled mini-frames by always keeping frames_since_full at 0

crates/wzp-proto/src/traits.rs

@@ -28,13 +28,6 @@ pub trait AudioEncoder: Send + Sync {
 
     /// Enable/disable DTX (discontinuous transmission). No-op for Codec2.
     fn set_dtx(&mut self, _enabled: bool) {}
-
-    /// Hint the encoder about expected packet loss (0–100). In DRED mode the
-    /// encoder floors this at 15% internally. No-op for Codec2.
-    fn set_expected_loss(&mut self, _loss_pct: u8) {}
-
-    /// Set DRED duration in 10 ms frame units (0–104). No-op for Codec2.
-    fn set_dred_duration(&mut self, _frames: u8) {}
 }
 
 /// Decodes compressed frames back to PCM audio.

crates/wzp-relay/src/call_registry.rs

@@ -31,36 +31,6 @@ pub struct DirectCall {
     pub created_at: Instant,
     pub answered_at: Option<Instant>,
     pub ended_at: Option<Instant>,
-    /// Phase 3 (hole-punching): caller's server-reflexive address
-    /// as carried in the `DirectCallOffer`. The relay stashes it
-    /// here when the offer arrives so it can later inject it as
-    /// `peer_direct_addr` into the callee's `CallSetup`.
-    pub caller_reflexive_addr: Option<String>,
-    /// Phase 3 (hole-punching): callee's server-reflexive address
-    /// as carried in the `DirectCallAnswer`. Only populated for
-    /// `AcceptTrusted` answers — privacy-mode answers leave this
-    /// `None`. Fed into the caller's `CallSetup.peer_direct_addr`.
-    pub callee_reflexive_addr: Option<String>,
-    /// Phase 4 (cross-relay): federation TLS fingerprint of the
-    /// PEER RELAY that forwarded the offer/answer for this call.
-    /// `None` for local calls — caller and callee both
-    /// registered on this relay. `Some(fp)` when one side of
-    /// the call is on a remote relay reached through the
-    /// federation link identified by `fp`. The
-    /// `DirectCallAnswer` handling uses this to route the reply
-    /// back through the SAME link instead of broadcasting again.
-    pub peer_relay_fp: Option<String>,
-    /// Phase 5.5 (ICE host candidates): caller's LAN-local
-    /// interface addresses from the `DirectCallOffer`. Cross-
-    /// wired into the callee's `CallSetup.peer_local_addrs` so
-    /// the callee can direct-dial the caller over the same LAN
-    /// without going through the WAN reflex addr (NAT
-    /// hairpinning often doesn't work for same-LAN peers).
-    pub caller_local_addrs: Vec<String>,
-    /// Phase 5.5 (ICE host candidates): callee's LAN-local
-    /// interface addresses from the `DirectCallAnswer`. Cross-
-    /// wired into the caller's `CallSetup.peer_local_addrs`.
-    pub callee_local_addrs: Vec<String>,
 }
 
 /// Registry of active direct calls.
@@ -87,61 +57,11 @@ impl CallRegistry {
             created_at: Instant::now(),
             answered_at: None,
             ended_at: None,
-            caller_reflexive_addr: None,
-            callee_reflexive_addr: None,
-            peer_relay_fp: None,
-            caller_local_addrs: Vec::new(),
-            callee_local_addrs: Vec::new(),
         };
         self.calls.insert(call_id.clone(), call);
         self.calls.get(&call_id).unwrap()
     }
 
-    /// Phase 5.5: stash the caller's LAN host candidates from
-    /// the `DirectCallOffer`. Empty Vec is a valid value meaning
-    /// "caller has no LAN candidates" (e.g. old client).
-    pub fn set_caller_local_addrs(&mut self, call_id: &str, addrs: Vec<String>) {
-        if let Some(call) = self.calls.get_mut(call_id) {
-            call.caller_local_addrs = addrs;
-        }
-    }
-
-    /// Phase 5.5: stash the callee's LAN host candidates from
-    /// the `DirectCallAnswer`.
-    pub fn set_callee_local_addrs(&mut self, call_id: &str, addrs: Vec<String>) {
-        if let Some(call) = self.calls.get_mut(call_id) {
-            call.callee_local_addrs = addrs;
-        }
-    }
-
-    /// Phase 4: stash the federation TLS fingerprint of the peer
-    /// relay that originated (or will receive) the cross-relay
-    /// forward for this call. Safe to call with `None` to clear
-    /// a previously-set value.
-    pub fn set_peer_relay_fp(&mut self, call_id: &str, fp: Option<String>) {
-        if let Some(call) = self.calls.get_mut(call_id) {
-            call.peer_relay_fp = fp;
-        }
-    }
-
-    /// Phase 3: stash the caller's server-reflexive address read
-    /// off a `DirectCallOffer`. Safe to call on any call state;
-    /// a no-op if the call doesn't exist.
-    pub fn set_caller_reflexive_addr(&mut self, call_id: &str, addr: Option<String>) {
-        if let Some(call) = self.calls.get_mut(call_id) {
-            call.caller_reflexive_addr = addr;
-        }
-    }
-
-    /// Phase 3: stash the callee's server-reflexive address read
-    /// off a `DirectCallAnswer`. Safe to call on any call state;
-    /// a no-op if the call doesn't exist.
-    pub fn set_callee_reflexive_addr(&mut self, call_id: &str, addr: Option<String>) {
-        if let Some(call) = self.calls.get_mut(call_id) {
-            call.callee_reflexive_addr = addr;
-        }
-    }
-
     /// Get a call by ID.
     pub fn get(&self, call_id: &str) -> Option<&DirectCall> {
         self.calls.get(call_id)
@@ -276,79 +196,4 @@ mod tests {
         assert_eq!(reg.peer_fingerprint("c1", "alice"), Some("bob"));
         assert_eq!(reg.peer_fingerprint("c1", "bob"), Some("alice"));
     }
-
-    #[test]
-    fn call_registry_stores_reflexive_addrs() {
-        let mut reg = CallRegistry::new();
-        reg.create_call("c1".into(), "alice".into(), "bob".into());
-
-        // Default: both addrs are None.
-        let c = reg.get("c1").unwrap();
-        assert!(c.caller_reflexive_addr.is_none());
-        assert!(c.callee_reflexive_addr.is_none());
-
-        // Caller advertises its reflex addr via DirectCallOffer.
-        reg.set_caller_reflexive_addr("c1", Some("192.0.2.1:4433".into()));
-        assert_eq!(
-            reg.get("c1").unwrap().caller_reflexive_addr.as_deref(),
-            Some("192.0.2.1:4433")
-        );
-
-        // Callee responds with AcceptTrusted + its own reflex addr.
-        reg.set_callee_reflexive_addr("c1", Some("198.51.100.9:4433".into()));
-        assert_eq!(
-            reg.get("c1").unwrap().callee_reflexive_addr.as_deref(),
-            Some("198.51.100.9:4433")
-        );
-
-        // Both addrs are independently readable — the relay uses
-        // them to cross-wire peer_direct_addr in CallSetup.
-        let c = reg.get("c1").unwrap();
-        assert_eq!(
-            c.caller_reflexive_addr.as_deref(),
-            Some("192.0.2.1:4433")
-        );
-        assert_eq!(
-            c.callee_reflexive_addr.as_deref(),
-            Some("198.51.100.9:4433")
-        );
-
-        // Setter on an unknown call is a no-op, not a panic.
-        reg.set_caller_reflexive_addr("does-not-exist", Some("x".into()));
-    }
-
-    #[test]
-    fn call_registry_stores_peer_relay_fp() {
-        let mut reg = CallRegistry::new();
-        reg.create_call("c1".into(), "alice".into(), "bob".into());
-
-        // Default: no peer relay.
-        assert!(reg.get("c1").unwrap().peer_relay_fp.is_none());
-
-        // Cross-relay call: origin relay's fp is stashed.
-        reg.set_peer_relay_fp("c1", Some("relay-a-tls-fp".into()));
-        assert_eq!(
-            reg.get("c1").unwrap().peer_relay_fp.as_deref(),
-            Some("relay-a-tls-fp")
-        );
-
-        // Clearing with None is a valid no-op and empties the field.
-        reg.set_peer_relay_fp("c1", None);
-        assert!(reg.get("c1").unwrap().peer_relay_fp.is_none());
-
-        // Unknown call is a no-op, not a panic.
-        reg.set_peer_relay_fp("does-not-exist", Some("x".into()));
-    }
-
-    #[test]
-    fn call_registry_clearing_reflex_addr_works() {
-        // Passing None to the setter must clear a previously-set value
-        // so callers that downgrade to privacy mode mid-flow don't
-        // leak a stale addr into CallSetup.
-        let mut reg = CallRegistry::new();
-        reg.create_call("c1".into(), "alice".into(), "bob".into());
-        reg.set_caller_reflexive_addr("c1", Some("192.0.2.1:4433".into()));
-        reg.set_caller_reflexive_addr("c1", None);
-        assert!(reg.get("c1").unwrap().caller_reflexive_addr.is_none());
-    }
 }

crates/wzp-relay/src/event_log.rs

@@ -5,6 +5,7 @@
 //! Use `wzp-analyzer` to correlate events across multiple relays.
 
 use std::path::PathBuf;
+use std::sync::Arc;
 
 use serde::Serialize;
 use tokio::sync::mpsc;

crates/wzp-relay/src/federation.rs

@@ -142,18 +142,13 @@ pub struct FederationManager {
     peer_links: Arc<Mutex<HashMap<String, PeerLink>>>,
     /// Dedup filter for incoming federation datagrams.
     dedup: Mutex<Deduplicator>,
+    /// Per-room seq counter for federation media delivered to local clients.
+    /// Ensures clients see monotonically increasing seq regardless of federation sender.
+    local_delivery_seq: std::sync::atomic::AtomicU16,
     /// JSONL event log for protocol analysis.
     event_log: EventLogger,
     /// Per-room rate limiters for inbound federation media.
     rate_limiters: Mutex<HashMap<String, RateLimiter>>,
-    /// Phase 4: channel for handing cross-relay direct-call
-    /// signaling (inner message + origin relay fp) back to the
-    /// main signal loop in `main.rs`. Set once at startup via
-    /// `set_cross_relay_tx`. `None` when the main loop hasn't
-    /// wired it up yet (e.g. during startup warmup) — forwards
-    /// that arrive before wiring are dropped with a warning.
-    cross_relay_signal_tx:
-        Mutex<Option<tokio::sync::mpsc::Sender<(wzp_proto::SignalMessage, String)>>>,
 }
 
 impl FederationManager {
@@ -177,133 +172,34 @@ impl FederationManager {
             metrics,
             peer_links: Arc::new(Mutex::new(HashMap::new())),
             dedup: Mutex::new(Deduplicator::new(DEDUP_WINDOW_SIZE)),
+            local_delivery_seq: std::sync::atomic::AtomicU16::new(0),
             event_log,
             rate_limiters: Mutex::new(HashMap::new()),
-            cross_relay_signal_tx: Mutex::new(None),
-        }
-    }
-
-    /// Phase 4: expose this relay's federation TLS fingerprint so
-    /// the main signal loop can populate
-    /// `SignalMessage::FederatedSignalForward.origin_relay_fp`.
-    pub fn local_tls_fp(&self) -> &str {
-        &self.local_tls_fp
-    }
-
-    /// Phase 4: wire the channel that the main signal loop uses
-    /// to receive unwrapped cross-relay direct-call signals. Called
-    /// once at startup from `main.rs`.
-    pub async fn set_cross_relay_tx(
-        &self,
-        tx: tokio::sync::mpsc::Sender<(wzp_proto::SignalMessage, String)>,
-    ) {
-        *self.cross_relay_signal_tx.lock().await = Some(tx);
-    }
-
-    /// Phase 4: broadcast a `SignalMessage::FederatedSignalForward`
-    /// to every active federation peer link. Returns the number of
-    /// peers the broadcast reached (not the number that successfully
-    /// delivered the message further). Used when the local relay
-    /// doesn't know which peer holds the target fingerprint for a
-    /// `DirectCallOffer` — whichever peer has it will unwrap and
-    /// handle locally; the rest drop silently after "target not
-    /// local" check.
-    ///
-    /// Loop prevention: the receiving relay checks
-    /// `origin_relay_fp` against its own fp and drops self-sourced
-    /// forwards.
-    pub async fn broadcast_signal(&self, msg: &wzp_proto::SignalMessage) -> usize {
-        let links = self.peer_links.lock().await;
-        let mut count = 0;
-        for (fp, link) in links.iter() {
-            match link.transport.send_signal(msg).await {
-                Ok(()) => {
-                    count += 1;
-                    tracing::debug!(peer = %link.label, %fp, "federation: broadcast signal ok");
-                }
-                Err(e) => {
-                    tracing::warn!(peer = %link.label, %fp, error = %e, "federation: broadcast signal failed");
-                }
-            }
-        }
-        count
-    }
-
-    /// Phase 4: targeted send — used by the
-    /// `DirectCallAnswer` path when the registry knows exactly
-    /// which peer relay to route the reply back to. More efficient
-    /// than re-broadcasting and avoids leaking the call to
-    /// uninvolved peers.
-    ///
-    /// Returns `Ok(())` on success, `Err(String)` when the peer
-    /// isn't currently linked or the send fails.
-    pub async fn send_signal_to_peer(
-        &self,
-        peer_relay_fp: &str,
-        msg: &wzp_proto::SignalMessage,
-    ) -> Result<(), String> {
-        let normalized = normalize_fp(peer_relay_fp);
-        let links = self.peer_links.lock().await;
-        match links.get(&normalized) {
-            Some(link) => link
-                .transport
-                .send_signal(msg)
-                .await
-                .map_err(|e| format!("send to peer {normalized}: {e}")),
-            None => Err(format!("no active federation link for {normalized}")),
         }
     }
 
     /// Check if a room name (which may be hashed) is a global room.
-    ///
-    /// Phase 4.1: ALL `call-*` rooms are implicitly global for
-    /// federation. This is the simplest path to cross-relay direct
-    /// calling with relay-mediated media fallback: when both peers
-    /// join the same `call-<id>` room on their respective relays,
-    /// the federation media pipeline automatically forwards
-    /// datagrams between them. The relay's existing ACL (`call-*`
-    /// rooms are restricted to the two authorized participants in
-    /// the call registry) prevents random clients from creating or
-    /// joining `call-*` rooms.
     pub fn is_global_room(&self, room: &str) -> bool {
-        if room.starts_with("call-") {
-            return true;
-        }
         self.resolve_global_room(room).is_some()
     }
 
     /// Resolve a room name (raw or hashed) to the canonical global room name.
     /// Returns the configured global room name if it matches.
-    ///
-    /// Phase 4.1: `call-*` rooms resolve to themselves (they ARE
-    /// the canonical name — no hashing or aliasing involved).
-    ///
-    /// Returns `Option<String>` (owned) instead of `Option<&str>`
-    /// because call-* room names aren't stored on `self` — they
-    /// come from the caller and we just confirm "yes, this is
-    /// global" by returning it back. Pre-4.1 callers that used
-    /// the reference for equality checks or hashing work
-    /// unchanged via String/&str auto-deref.
-    pub fn resolve_global_room(&self, room: &str) -> Option<String> {
-        // Phase 4.1: call-* rooms are implicitly global, resolve
-        // to themselves
-        if room.starts_with("call-") {
-            return Some(room.to_string());
-        }
+    pub fn resolve_global_room(&self, room: &str) -> Option<&str> {
         // Direct match (raw room name, e.g. Android clients)
         if self.global_rooms.contains(room) {
-            return Some(room.to_string());
+            return Some(self.global_rooms.iter().find(|n| n.as_str() == room).unwrap());
         }
         // Hashed match (desktop clients hash room names for SNI privacy)
         self.global_rooms.iter().find(|name| {
             wzp_crypto::hash_room_name(name) == room
-        }).map(|s| s.to_string())
+        }).map(|s| s.as_str())
     }
 
     /// Get the canonical federation room hash for a room.
     /// Always uses the configured global room name, not the client-provided name.
     pub fn global_room_hash(&self, room: &str) -> [u8; 8] {
-        if let Some(ref canonical) = self.resolve_global_room(room) {
+        if let Some(canonical) = self.resolve_global_room(room) {
             room_hash(canonical)
         } else {
             room_hash(room)
@@ -375,8 +271,8 @@ impl FederationManager {
         let mut result = Vec::new();
         for link in links.values() {
             // Check canonical name
-            if let Some(ref c) = canonical {
-                if let Some(remote) = link.remote_participants.get(c.as_str()) {
+            if let Some(c) = canonical {
+                if let Some(remote) = link.remote_participants.get(c) {
                     result.extend(remote.iter().cloned());
                 }
                 // Also check raw room name, but only if different from canonical
@@ -400,12 +296,7 @@ impl FederationManager {
     /// Forward locally-generated media to all connected peers.
     /// For locally-originated media, we send to ALL peers (they decide whether to deliver).
     /// For forwarded media (multi-hop), handle_datagram filters by active_rooms.
-    ///
-    /// `_room_name` is kept in the signature for caller-site symmetry with
-    /// the other room-tagged helpers and for future per-room-name logging
-    /// or rate limiting; the body currently forwards on `room_hash` alone
-    /// because that's what the wire format carries.
-    pub async fn forward_to_peers(&self, _room_name: &str, room_hash: &[u8; 8], media_data: &Bytes) {
+    pub async fn forward_to_peers(&self, room_name: &str, room_hash: &[u8; 8], media_data: &Bytes) {
         let links = self.peer_links.lock().await;
         if links.is_empty() {
             return;
@@ -732,20 +623,11 @@ async fn run_federation_link(
         }
     };
 
-    // RTT monitor: periodically sample QUIC RTT for this peer and push it
-    // into the `wzp_federation_peer_rtt_ms` gauge. The gauge is registered
-    // in metrics.rs but previously never received any samples — the task
-    // computed rtt_ms and dropped it on the floor, leaving the Grafana
-    // panel blank. Fixed as part of the workspace warning sweep.
+    // RTT monitor: periodically sample QUIC RTT for this peer
     let rtt_task = async move {
         loop {
             tokio::time::sleep(Duration::from_secs(5)).await;
             let rtt_ms = rtt_transport.connection().stats().path.rtt.as_millis() as f64;
-            fm_rtt
-                .metrics
-                .federation_peer_rtt_ms
-                .with_label_values(&[&label_rtt])
-                .set(rtt_ms);
         }
     };
 
@@ -835,12 +717,12 @@ async fn handle_signal(
                         let mut all_participants = mgr.local_participant_list(&local_room);
                         let links = fm.peer_links.lock().await;
                         for link in links.values() {
-                            if let Some(ref canonical) = fm.resolve_global_room(&local_room) {
-                                if let Some(remote) = link.remote_participants.get(canonical.as_str()) {
+                            if let Some(canonical) = fm.resolve_global_room(&local_room) {
+                                if let Some(remote) = link.remote_participants.get(canonical) {
                                     all_participants.extend(remote.iter().cloned());
                                 }
                                 // Also check raw room name, but only if different from canonical
-                                if canonical != &local_room {
+                                if canonical != local_room {
                                     if let Some(remote) = link.remote_participants.get(&local_room) {
                                         all_participants.extend(remote.iter().cloned());
                                     }
@@ -871,8 +753,8 @@ async fn handle_signal(
                 // Clear remote participants for this peer+room
                 link.remote_participants.remove(&room);
                 // Also try canonical name
-                if let Some(ref canonical) = fm.resolve_global_room(&room) {
-                    link.remote_participants.remove(canonical.as_str());
+                if let Some(canonical) = fm.resolve_global_room(&room) {
+                    link.remote_participants.remove(canonical);
                 }
             }
 
@@ -886,8 +768,8 @@ async fn handle_signal(
                 let mut result = Vec::new();
                 for (fp, link) in links.iter() {
                     if fp == peer_fp { continue; }
-                    if let Some(ref c) = canonical {
-                        if let Some(remote) = link.remote_participants.get(c.as_str()) {
+                    if let Some(c) = canonical {
+                        if let Some(remote) = link.remote_participants.get(c) {
                             result.extend(remote.iter().cloned());
                         }
                     }
@@ -960,57 +842,6 @@ async fn handle_signal(
                 }
             }
         }
-        // Phase 4: cross-relay direct-call signal envelope.
-        //
-        // Unwrap the inner message and hand it off to the main
-        // signal loop via the cross_relay_signal_tx channel. The
-        // main loop will then dispatch the inner DirectCallOffer/
-        // Answer/Ringing/Hangup exactly as if it had arrived on a
-        // local signal transport — with the extra context that
-        // the call is "federated" (origin_relay_fp).
-        //
-        // Loop prevention: drop any forward whose origin matches
-        // our own federation TLS fingerprint. With
-        // broadcast-to-all-peers this prevents A→B→A echo loops.
-        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
-            if origin_relay_fp == fm.local_tls_fp {
-                tracing::debug!(
-                    peer = %peer_label,
-                    "federation: dropping self-sourced FederatedSignalForward (loop prevention)"
-                );
-                return;
-            }
-            let tx_opt = {
-                let guard = fm.cross_relay_signal_tx.lock().await;
-                guard.clone()
-            };
-            match tx_opt {
-                Some(tx) => {
-                    let inner_discriminant = std::mem::discriminant(&*inner);
-                    if let Err(e) = tx.send((*inner, origin_relay_fp.clone())).await {
-                        warn!(
-                            peer = %peer_label,
-                            ?inner_discriminant,
-                            error = %e,
-                            "federation: cross-relay signal dispatcher full / closed"
-                        );
-                    } else {
-                        tracing::debug!(
-                            peer = %peer_label,
-                            ?inner_discriminant,
-                            %origin_relay_fp,
-                            "federation: forwarded cross-relay signal to main dispatcher"
-                        );
-                    }
-                }
-                None => {
-                    warn!(
-                        peer = %peer_label,
-                        "federation: cross_relay_signal_tx not wired yet — dropping forward"
-                    );
-                }
-            }
-        }
         _ => {} // ignore other signals
     }
 }
@@ -1077,7 +908,7 @@ async fn handle_datagram(
         // First: check local rooms (has participants)
         active.iter().find(|r| room_hash(r) == rh).cloned()
             .or_else(|| active.iter().find(|r| fm.global_room_hash(r) == rh).cloned())
-            // Second: check static global room config (hub relay may have no local participants)
+            // Second: check global room config (hub relay may have no local participants)
             .or_else(|| {
                 fm.global_rooms.iter().find(|name| room_hash(name) == rh).cloned()
             })
@@ -1087,23 +918,6 @@ async fn handle_datagram(
         Some(r) => r,
         None => {
             fm.event_log.emit(Event::new("room_not_found").seq(pkt.header.seq).peer(&peer_label));
-            // Phase 4.1 diagnostic: log the hash + active rooms
-            // so we can diagnose cross-relay call-* media routing
-            // failures. This fires when a peer relay sends media
-            // for a room we don't have locally — could be a
-            // timing issue (peer joined before us) or a hash
-            // mismatch.
-            let active = {
-                let mgr = fm.room_mgr.lock().await;
-                mgr.active_rooms()
-            };
-            warn!(
-                room_hash = ?rh,
-                active_rooms = ?active,
-                seq = pkt.header.seq,
-                peer = %peer_label,
-                "federation datagram for unknown room — no local room matches hash"
-            );
             return;
         }
     };

crates/wzp-relay/src/handshake.rs

@@ -94,13 +94,9 @@ pub async fn accept_handshake(
 }
 
 /// Select the best quality profile from those the caller supports.
-///
-/// The `_supported` list is currently ignored — we hardcode GOOD (24k) until
-/// studio tiers (32k/48k/64k) have been validated across federation (large
-/// packets may exceed path MTU and fragment in unpleasant ways). Once that's
-/// tested, the body should pick the highest supported profile ≤ the relay's
-/// configured ceiling.
-fn choose_profile(_supported: &[QualityProfile]) -> QualityProfile {
+fn choose_profile(supported: &[QualityProfile]) -> QualityProfile {
+    // Cap at GOOD (24k) for now — studio tiers (32k/48k/64k) not yet tested
+    // for federation reliability (large packets may exceed path MTU).
     QualityProfile::GOOD
 }
 

crates/wzp-relay/src/main.rs

@@ -13,7 +13,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use tokio::sync::Mutex;
-use tracing::{debug, error, info, warn};
+use tracing::{error, info, warn};
 
 use wzp_proto::{MediaTransport, SignalMessage};
 use wzp_relay::config::RelayConfig;
@@ -272,7 +272,7 @@ const BUILD_GIT_HASH: &str = env!("WZP_BUILD_HASH");
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    let CliResult { config, identity_path, config_file, config_needs_create } = parse_args();
+    let CliResult { mut config, identity_path, config_file, config_needs_create } = parse_args();
     tracing_subscriber::fmt().init();
     info!(version = BUILD_GIT_HASH, "wzp-relay build");
     rustls::crypto::ring::default_provider()
@@ -378,31 +378,6 @@ async fn main() -> anyhow::Result<()> {
     }
     let endpoint = wzp_transport::create_endpoint(config.listen_addr, Some(server_config))?;
 
-    // Compute the IP address we should advertise in CallSetup for direct
-    // calls. If the relay is bound to a specific IP, use it as-is; if bound
-    // to 0.0.0.0, use the trick of "connect" a UDP socket to an arbitrary
-    // external address and read its local_addr — the OS binds to whichever
-    // local interface IP would route packets to that destination, which is
-    // the primary outbound interface. This is the same IP clients on the
-    // LAN use to reach us.
-    let advertised_ip: std::net::IpAddr = {
-        let listen_ip = config.listen_addr.ip();
-        if !listen_ip.is_unspecified() {
-            listen_ip
-        } else {
-            // Probe via a dummy "connected" UDP socket. Never actually sends.
-            match std::net::UdpSocket::bind("0.0.0.0:0")
-                .and_then(|s| { s.connect("8.8.8.8:80").map(|_| s) })
-                .and_then(|s| s.local_addr())
-            {
-                Ok(a) if !a.ip().is_loopback() => a.ip(),
-                _ => std::net::IpAddr::from([127u8, 0, 0, 1]),
-            }
-        }
-    };
-    let advertised_addr_str = format!("{}:{}", advertised_ip, config.listen_addr.port());
-    info!(%advertised_addr_str, "relay advertised address for CallSetup");
-
     // Forward mode
     let remote_transport: Option<Arc<wzp_transport::QuinnTransport>> =
         if let Some(remote_addr) = config.remote_relay {
@@ -453,21 +428,6 @@ async fn main() -> anyhow::Result<()> {
     let signal_hub = Arc::new(Mutex::new(wzp_relay::signal_hub::SignalHub::new()));
     let call_registry = Arc::new(Mutex::new(wzp_relay::call_registry::CallRegistry::new()));
 
-    // Phase 4: cross-relay direct-call signal dispatcher.
-    //
-    // The federation layer unwraps incoming
-    // `SignalMessage::FederatedSignalForward` envelopes and pushes
-    // (inner, origin_relay_fp) onto this channel. A dedicated task
-    // further down reads from it and routes the inner message
-    // through signal_hub / call_registry exactly as if it had
-    // arrived on a local signal transport — with the extra
-    // context that a peer relay is on the other side of the call.
-    let (cross_relay_tx, mut cross_relay_rx) =
-        tokio::sync::mpsc::channel::<(wzp_proto::SignalMessage, String)>(32);
-    if let Some(ref fm) = federation_mgr {
-        fm.set_cross_relay_tx(cross_relay_tx.clone()).await;
-    }
-
     // Spawn inter-relay health probes via ProbeMesh coordinator
     if !config.probe_targets.is_empty() {
         let mesh = wzp_relay::probe::ProbeMesh::new(
@@ -512,256 +472,12 @@ async fn main() -> anyhow::Result<()> {
         info!(filter = %tap, "debug tap enabled — logging packet headers");
     }
 
-    // Phase 4: cross-relay direct-call dispatcher task.
-    //
-    // Reads unwrapped (inner, origin_relay_fp) tuples that the
-    // federation layer pushes out of its `handle_signal` arm for
-    // `FederatedSignalForward`, and routes the inner message
-    // through the local signal_hub / call_registry exactly as if
-    // the message had arrived on a local client signal transport.
-    //
-    // In Phase 4 MVP the dispatcher handles:
-    //   * DirectCallOffer  — if target is local, stash in registry
-    //                        with peer_relay_fp and deliver to
-    //                        local callee via signal_hub.
-    //   * DirectCallAnswer — stash callee addr, forward answer to
-    //                        local caller, emit local CallSetup.
-    //   * CallRinging     — forward to local caller for UX.
-    //   * Hangup          — forward to the local participant(s).
-    // Everything else is dropped.
-    {
-        let signal_hub_d = signal_hub.clone();
-        let call_registry_d = call_registry.clone();
-        let advertised_addr_d = advertised_addr_str.clone();
-        let federation_mgr_d = federation_mgr.clone();
-        tokio::spawn(async move {
-            use wzp_proto::{CallAcceptMode, SignalMessage};
-            while let Some((inner, origin_relay_fp)) = cross_relay_rx.recv().await {
-                match inner {
-                    SignalMessage::DirectCallOffer {
-                        ref target_fingerprint,
-                        ref caller_fingerprint,
-                        ref call_id,
-                        ref caller_reflexive_addr,
-                        ref caller_local_addrs,
-                        ..
-                    } => {
-                        // Is the target on THIS relay? If not, drop —
-                        // Phase 4 MVP is single-hop federation only.
-                        let online = {
-                            let hub = signal_hub_d.lock().await;
-                            hub.is_online(target_fingerprint)
-                        };
-                        if !online {
-                            tracing::debug!(
-                                target = %target_fingerprint,
-                                %origin_relay_fp,
-                                "cross-relay: offer target not local, dropping (no multi-hop)"
-                            );
-                            continue;
-                        }
-                        // Stash in local registry so the answer path
-                        // can find the call + route the reply back
-                        // through the same federation link. Include
-                        // Phase 5.5 LAN host candidates too.
-                        {
-                            let mut reg = call_registry_d.lock().await;
-                            reg.create_call(
-                                call_id.clone(),
-                                caller_fingerprint.clone(),
-                                target_fingerprint.clone(),
-                            );
-                            reg.set_caller_reflexive_addr(call_id, caller_reflexive_addr.clone());
-                            reg.set_caller_local_addrs(call_id, caller_local_addrs.clone());
-                            reg.set_peer_relay_fp(call_id, Some(origin_relay_fp.clone()));
-                        }
-                        // Deliver the offer to the local target.
-                        let hub = signal_hub_d.lock().await;
-                        if let Err(e) = hub.send_to(target_fingerprint, &inner).await {
-                            tracing::warn!(
-                                target = %target_fingerprint,
-                                error = %e,
-                                "cross-relay: failed to deliver forwarded offer"
-                            );
-                        }
-                    }
-
-                    SignalMessage::DirectCallAnswer {
-                        ref call_id,
-                        accept_mode,
-                        ref callee_reflexive_addr,
-                        ref callee_local_addrs,
-                        ..
-                    } => {
-                        // Look up the local caller fp from the registry.
-                        let caller_fp = {
-                            let reg = call_registry_d.lock().await;
-                            reg.get(call_id).map(|c| c.caller_fingerprint.clone())
-                        };
-                        let Some(caller_fp) = caller_fp else {
-                            tracing::debug!(%call_id, "cross-relay: answer for unknown call, dropping");
-                            continue;
-                        };
-
-                        if accept_mode == CallAcceptMode::Reject {
-                            // Forward hangup to local caller + clean up registry.
-                            let hub = signal_hub_d.lock().await;
-                            let _ = hub
-                                .send_to(
-                                    &caller_fp,
-                                    &SignalMessage::Hangup {
-                                        reason: wzp_proto::HangupReason::Normal,
-                                        call_id: None,
-                                    },
-                                )
-                                .await;
-                            drop(hub);
-                            let mut reg = call_registry_d.lock().await;
-                            reg.end_call(call_id);
-                            continue;
-                        }
-
-                        // Accept — stash the callee's reflex addr + LAN
-                        // host candidates + mark the call active,
-                        // then read back everything needed to cross-
-                        // wire peer_direct_addr + peer_local_addrs in
-                        // the local CallSetup.
-                        // Also set peer_relay_fp so the originating
-                        // relay knows where to forward MediaPathReport.
-                        let room_name = format!("call-{call_id}");
-                        let (callee_addr_for_setup, callee_local_for_setup) = {
-                            let mut reg = call_registry_d.lock().await;
-                            reg.set_active(call_id, accept_mode, room_name.clone());
-                            reg.set_peer_relay_fp(call_id, Some(origin_relay_fp.clone()));
-                            reg.set_callee_reflexive_addr(
-                                call_id,
-                                callee_reflexive_addr.clone(),
-                            );
-                            reg.set_callee_local_addrs(call_id, callee_local_addrs.clone());
-                            let c = reg.get(call_id);
-                            (
-                                c.and_then(|c| c.callee_reflexive_addr.clone()),
-                                c.map(|c| c.callee_local_addrs.clone()).unwrap_or_default(),
-                            )
-                        };
-
-                        // Forward the raw answer to the local caller so
-                        // the JS side sees DirectCallAnswer (fires any
-                        // "call answered" UX that looks at this message).
-                        {
-                            let hub = signal_hub_d.lock().await;
-                            let _ = hub.send_to(&caller_fp, &inner).await;
-                        }
-
-                        // Emit the LOCAL CallSetup to our local caller.
-                        // relay_addr = our own advertised addr so if P2P
-                        // fails the caller will at least dial OUR relay
-                        // (single-relay fallback — Phase 4.1 will wire
-                        // federated media so that actually reaches the
-                        // peer). peer_direct_addr = the callee's reflex
-                        // addr carried in the answer. peer_local_addrs
-                        // = callee's LAN host candidates (Phase 5.5 ICE).
-                        let setup = SignalMessage::CallSetup {
-                            call_id: call_id.clone(),
-                            room: room_name.clone(),
-                            relay_addr: advertised_addr_d.clone(),
-                            peer_direct_addr: callee_addr_for_setup,
-                            peer_local_addrs: callee_local_for_setup,
-                        };
-                        let hub = signal_hub_d.lock().await;
-                        let _ = hub.send_to(&caller_fp, &setup).await;
-
-                        tracing::info!(
-                            %call_id,
-                            %caller_fp,
-                            %origin_relay_fp,
-                            "cross-relay: delivered answer + CallSetup to local caller"
-                        );
-                    }
-
-                    SignalMessage::CallRinging { ref call_id } => {
-                        // Forward to local caller for "ringing..." UX.
-                        let caller_fp = {
-                            let reg = call_registry_d.lock().await;
-                            reg.get(call_id).map(|c| c.caller_fingerprint.clone())
-                        };
-                        if let Some(fp) = caller_fp {
-                            let hub = signal_hub_d.lock().await;
-                            let _ = hub.send_to(&fp, &inner).await;
-                        }
-                    }
-
-                    // Phase 6: MediaPathReport forwarded across
-                    // federation — deliver to the LOCAL participant.
-                    // The report comes from the remote side, so we
-                    // deliver to whichever participant is local. In
-                    // the cross-relay case, one is local and one is
-                    // remote. Try both — send_to is a no-op if the
-                    // target isn't connected to this relay.
-                    SignalMessage::MediaPathReport { ref call_id, .. } => {
-                        let (caller_fp, callee_fp) = {
-                            let reg = call_registry_d.lock().await;
-                            match reg.get(call_id) {
-                                Some(c) => (
-                                    Some(c.caller_fingerprint.clone()),
-                                    Some(c.callee_fingerprint.clone()),
-                                ),
-                                None => (None, None),
-                            }
-                        };
-                        let hub = signal_hub_d.lock().await;
-                        if let Some(fp) = caller_fp {
-                            let _ = hub.send_to(&fp, &inner).await;
-                        }
-                        if let Some(fp) = callee_fp {
-                            let _ = hub.send_to(&fp, &inner).await;
-                        }
-                    }
-
-                    SignalMessage::Hangup { .. } => {
-                        // Best-effort: broadcast the hangup to every
-                        // local participant of any call that currently
-                        // has this origin as its peer_relay_fp.
-                        // The forwarded hangup doesn't carry a call_id
-                        // so we can't target precisely — Phase 4.1 will
-                        // tighten this once hangup tracking is stricter.
-                        tracing::debug!(
-                            %origin_relay_fp,
-                            "cross-relay: forwarded Hangup (Phase 4.1 will target by call_id)"
-                        );
-                    }
-
-                    _ => {
-                        tracing::debug!(
-                            %origin_relay_fp,
-                            "cross-relay: dispatcher ignoring unsupported inner variant"
-                        );
-                    }
-                }
-            }
-            // Suppress the warning if federation_mgr_d is unused —
-            // it's held here so the Arc doesn't drop during the
-            // dispatcher's lifetime.
-            drop(federation_mgr_d);
-        });
-    }
-
     info!("Listening for connections...");
 
     loop {
-        // Pull the next Incoming off the queue. Deliberately do NOT await
-        // the QUIC handshake here — move that into the per-connection
-        // spawned task below. Previously we used wzp_transport::accept
-        // which did both, which meant a single slow handshake would block
-        // the entire accept loop and prevent ALL subsequent connections
-        // from being processed. Surfaced as direct-call hangs where the
-        // callee's call-* connection never completes its QUIC handshake.
-        let incoming = match endpoint.accept().await {
-            Some(inc) => inc,
-            None => {
-                error!("endpoint.accept() returned None — endpoint closed");
-                break;
-            }
+        let connection = match wzp_transport::accept(&endpoint).await {
+            Ok(conn) => conn,
+            Err(e) => { error!("accept: {e}"); continue; }
         };
 
         let remote_transport = remote_transport.clone();
@@ -777,26 +493,9 @@ async fn main() -> anyhow::Result<()> {
         let federation_mgr = federation_mgr.clone();
         let signal_hub = signal_hub.clone();
         let call_registry = call_registry.clone();
-        let advertised_addr_str = advertised_addr_str.clone();
-        // Phase 4: per-task clone of this relay's federation TLS
-        // fingerprint so the FederatedSignalForward envelopes the
-        // spawned signal handler builds carry `origin_relay_fp`.
-        let tls_fp = tls_fp.clone();
-
-        let incoming_addr = incoming.remote_address();
-        info!(%incoming_addr, "accept queue: new Incoming, spawning handshake task");
+        let listen_addr_str = config.listen_addr.to_string();
 
         tokio::spawn(async move {
-            // Drive the QUIC handshake inside the spawned task so that
-            // slow or hung handshakes never block the outer accept loop.
-            let connection = match incoming.await {
-                Ok(c) => c,
-                Err(e) => {
-                    error!(%incoming_addr, "QUIC handshake failed: {e}");
-                    return;
-                }
-            };
-            info!(%incoming_addr, "QUIC handshake complete");
             let addr = connection.remote_address();
 
             let room_name = connection
@@ -1010,7 +709,6 @@ async fn main() -> anyhow::Result<()> {
                 let _ = transport.send_signal(&SignalMessage::RegisterPresenceAck {
                     success: true,
                     error: None,
-                    relay_build: Some(BUILD_GIT_HASH.to_string()),
                 }).await;
 
                 info!(%addr, fingerprint = %client_fp, alias = ?client_alias, "signal client registered");
@@ -1020,17 +718,9 @@ async fn main() -> anyhow::Result<()> {
                     match transport.recv_signal().await {
                         Ok(Some(msg)) => {
                             match msg {
-                                SignalMessage::DirectCallOffer {
-                                    ref target_fingerprint,
-                                    ref call_id,
-                                    ref caller_reflexive_addr,
-                                    ref caller_local_addrs,
-                                    ..
-                                } => {
+                                SignalMessage::DirectCallOffer { ref target_fingerprint, ref call_id, ref caller_alias, .. } => {
                                     let target_fp = target_fingerprint.clone();
                                     let call_id = call_id.clone();
-                                    let caller_addr_for_registry = caller_reflexive_addr.clone();
-                                    let caller_local_for_registry = caller_local_addrs.clone();
 
                                     // Check if target is online
                                     let online = {
@@ -1038,92 +728,17 @@ async fn main() -> anyhow::Result<()> {
                                         hub.is_online(&target_fp)
                                     };
                                     if !online {
-                                        // Phase 4: maybe the target is on a
-                                        // federation peer. Wrap the offer in
-                                        // FederatedSignalForward and broadcast
-                                        // it over every active peer link —
-                                        // whichever relay has the target will
-                                        // unwrap and dispatch locally. We also
-                                        // stash the call in OUR registry so
-                                        // the eventual answer coming back via
-                                        // federation has a matching entry.
-                                        let forwarded = if let Some(ref fm) = federation_mgr {
-                                            let forward = SignalMessage::FederatedSignalForward {
-                                                inner: Box::new(msg.clone()),
-                                                origin_relay_fp: tls_fp.clone(),
-                                            };
-                                            let count = fm.broadcast_signal(&forward).await;
-                                            if count > 0 {
-                                                info!(
-                                                    %addr,
-                                                    target = %target_fp,
-                                                    peers = count,
-                                                    "direct-call offer forwarded to federation peers"
-                                                );
-                                                true
-                                            } else {
-                                                false
-                                            }
-                                        } else {
-                                            false
-                                        };
-
-                                        if !forwarded {
-                                            info!(%addr, target = %target_fp, "call target not online (no federation route)");
-                                            let _ = transport.send_signal(&SignalMessage::Hangup {
-                                                reason: wzp_proto::HangupReason::Normal,
-                                                call_id: None,
-                                            }).await;
-                                            continue;
-                                        }
-
-                                        // Create call in registry with the
-                                        // caller's reflex addr + LAN host
-                                        // candidates, and mark it as
-                                        // cross-relay so the answer path knows
-                                        // to route the CallSetup's
-                                        // peer_direct_addr from what the
-                                        // federated answer carries. peer_relay_fp
-                                        // stays None here because we broadcast —
-                                        // the receiving relay picks itself as
-                                        // the answer source and its forwarded
-                                        // answer will identify itself there.
-                                        {
-                                            let mut reg = call_registry.lock().await;
-                                            reg.create_call(
-                                                call_id.clone(),
-                                                client_fp.clone(),
-                                                target_fp.clone(),
-                                            );
-                                            reg.set_caller_reflexive_addr(
-                                                &call_id,
-                                                caller_addr_for_registry.clone(),
-                                            );
-                                            reg.set_caller_local_addrs(
-                                                &call_id,
-                                                caller_local_for_registry.clone(),
-                                            );
-                                        }
-
-                                        // Send ringing to caller immediately
-                                        // so the UI shows feedback while the
-                                        // federated delivery is in flight.
-                                        let _ = transport.send_signal(&SignalMessage::CallRinging {
-                                            call_id: call_id.clone(),
+                                        info!(%addr, target = %target_fp, "call target not online");
+                                        let _ = transport.send_signal(&SignalMessage::Hangup {
+                                            reason: wzp_proto::HangupReason::Normal,
                                         }).await;
                                         continue;
                                     }
 
-                                    // Create call in registry + stash the caller's
-                                    // reflex addr (Phase 3 hole-punching) AND its
-                                    // LAN host candidates (Phase 5.5 ICE). The
-                                    // relay treats both as opaque. Both are
-                                    // injected later into the callee's CallSetup.
+                                    // Create call in registry
                                     {
                                         let mut reg = call_registry.lock().await;
                                         reg.create_call(call_id.clone(), client_fp.clone(), target_fp.clone());
-                                        reg.set_caller_reflexive_addr(&call_id, caller_addr_for_registry);
-                                        reg.set_caller_local_addrs(&call_id, caller_local_for_registry);
                                     }
 
                                     // Forward offer to callee
@@ -1140,37 +755,16 @@ async fn main() -> anyhow::Result<()> {
                                     }).await;
                                 }
 
-                                SignalMessage::DirectCallAnswer {
-                                    ref call_id,
-                                    ref accept_mode,
-                                    ref callee_reflexive_addr,
-                                    ref callee_local_addrs,
-                                    ..
-                                } => {
+                                SignalMessage::DirectCallAnswer { ref call_id, ref accept_mode, .. } => {
                                     let call_id = call_id.clone();
                                     let mode = *accept_mode;
-                                    let callee_addr_for_registry = callee_reflexive_addr.clone();
-                                    let callee_local_for_registry = callee_local_addrs.clone();
 
-                                    // Phase 4: look up peer fingerprint AND
-                                    // peer_relay_fp in one lock acquisition.
-                                    // peer_relay_fp being Some means the
-                                    // caller is on a remote federation peer
-                                    // and we have to route the answer /
-                                    // hangup back through that link instead
-                                    // of local signal_hub.
-                                    let (peer_fp, peer_relay_fp) = {
+                                    let peer_fp = {
                                         let reg = call_registry.lock().await;
-                                        match reg.get(&call_id) {
-                                            Some(c) => (
-                                                Some(reg.peer_fingerprint(&call_id, &client_fp).map(|s| s.to_string())),
-                                                c.peer_relay_fp.clone(),
-                                            ),
-                                            None => (None, None),
-                                        }
+                                        reg.peer_fingerprint(&call_id, &client_fp).map(|s| s.to_string())
                                     };
 
-                                    let Some(Some(peer_fp)) = peer_fp else {
+                                    let Some(peer_fp) = peer_fp else {
                                         warn!(call_id = %call_id, "answer for unknown call");
                                         continue;
                                     };
@@ -1180,211 +774,73 @@ async fn main() -> anyhow::Result<()> {
                                         let mut reg = call_registry.lock().await;
                                         reg.end_call(&call_id);
                                         drop(reg);
-
-                                        // Phase 4: cross-relay reject —
-                                        // forward the hangup to the origin
-                                        // relay instead of local signal_hub.
-                                        if let Some(ref origin_fp) = peer_relay_fp {
-                                            if let Some(ref fm) = federation_mgr {
-                                                let hangup = SignalMessage::Hangup {
-                                                    reason: wzp_proto::HangupReason::Normal,
-                                                    call_id: Some(call_id.clone()),
-                                                };
-                                                let forward = SignalMessage::FederatedSignalForward {
-                                                    inner: Box::new(hangup),
-                                                    origin_relay_fp: tls_fp.clone(),
-                                                };
-                                                if let Err(e) = fm.send_signal_to_peer(origin_fp, &forward).await {
-                                                    warn!(%call_id, %origin_fp, error = %e, "cross-relay reject forward failed");
-                                                }
-                                            }
-                                        } else {
-                                            let hub = signal_hub.lock().await;
-                                            let _ = hub.send_to(&peer_fp, &SignalMessage::Hangup {
-                                                reason: wzp_proto::HangupReason::Normal,
-                                                call_id: Some(call_id.clone()),
-                                            }).await;
-                                        }
+                                        let hub = signal_hub.lock().await;
+                                        let _ = hub.send_to(&peer_fp, &SignalMessage::Hangup {
+                                            reason: wzp_proto::HangupReason::Normal,
+                                        }).await;
                                     } else {
-                                        // Accept — create private room + stash the
-                                        // callee's reflex addr if it advertised one
-                                        // (AcceptTrusted only — privacy-mode answers
-                                        // leave it None by design). Then read back
-                                        // BOTH parties' addrs so we can cross-wire
-                                        // peer_direct_addr on the CallSetups below.
+                                        // Accept — create private room
                                         let room = format!("call-{call_id}");
-                                        let (caller_addr, callee_addr, caller_local, callee_local) = {
+                                        {
                                             let mut reg = call_registry.lock().await;
                                             reg.set_active(&call_id, mode, room.clone());
-                                            reg.set_callee_reflexive_addr(&call_id, callee_addr_for_registry);
-                                            reg.set_callee_local_addrs(&call_id, callee_local_for_registry.clone());
-                                            let call = reg.get(&call_id);
-                                            (
-                                                call.and_then(|c| c.caller_reflexive_addr.clone()),
-                                                call.and_then(|c| c.callee_reflexive_addr.clone()),
-                                                call.map(|c| c.caller_local_addrs.clone()).unwrap_or_default(),
-                                                call.map(|c| c.callee_local_addrs.clone()).unwrap_or_default(),
-                                            )
-                                        };
-                                        info!(
-                                            call_id = %call_id,
-                                            room = %room,
-                                            ?mode,
-                                            p2p_viable = caller_addr.is_some() && callee_addr.is_some(),
-                                            "call accepted, creating room"
-                                        );
+                                        }
+                                        info!(call_id = %call_id, room = %room, mode = ?mode, "call accepted, creating room");
 
-                                        let relay_addr_for_setup = advertised_addr_str.clone();
-
-                                        if let Some(ref origin_fp) = peer_relay_fp {
-                                            // Phase 4 cross-relay: the caller
-                                            // is on a remote peer. Forward the
-                                            // raw answer (which carries the
-                                            // callee's reflex addr) back over
-                                            // federation — the peer's
-                                            // cross-relay dispatcher will
-                                            // deliver it to the local caller
-                                            // AND emit a CallSetup on that
-                                            // side with peer_direct_addr =
-                                            // callee_addr.
-                                            //
-                                            // Here we emit only the LOCAL
-                                            // CallSetup (to our callee) with
-                                            // peer_direct_addr = caller_addr.
-                                            if let Some(ref fm) = federation_mgr {
-                                                let forward = SignalMessage::FederatedSignalForward {
-                                                    inner: Box::new(msg.clone()),
-                                                    origin_relay_fp: tls_fp.clone(),
-                                                };
-                                                if let Err(e) = fm.send_signal_to_peer(origin_fp, &forward).await {
-                                                    warn!(
-                                                        %call_id,
-                                                        %origin_fp,
-                                                        error = %e,
-                                                        "cross-relay answer forward failed"
-                                                    );
-                                                }
-                                            }
-
-                                            let setup_for_callee = SignalMessage::CallSetup {
-                                                call_id: call_id.clone(),
-                                                room: room.clone(),
-                                                relay_addr: relay_addr_for_setup,
-                                                peer_direct_addr: caller_addr.clone(),
-                                                peer_local_addrs: caller_local.clone(),
-                                            };
+                                        // Forward answer to caller
+                                        {
                                             let hub = signal_hub.lock().await;
-                                            let _ = hub.send_to(&client_fp, &setup_for_callee).await;
+                                            let _ = hub.send_to(&peer_fp, &msg).await;
+                                        }
+
+                                        // Send CallSetup to both parties
+                                        // Use the address the client connected to (their remote addr
+                                        // is our perspective, but we need our listen addr).
+                                        // Replace 0.0.0.0 with the client's destination IP.
+                                        let relay_addr_for_setup = if listen_addr_str.starts_with("0.0.0.0:") {
+                                            let port = &listen_addr_str[8..];
+                                            // Use the local IP from the client's connection
+                                            let local_ip = addr.ip();
+                                            if local_ip.is_loopback() {
+                                                format!("127.0.0.1:{port}")
+                                            } else {
+                                                format!("{local_ip}:{port}")
+                                            }
                                         } else {
-                                            // Local call (existing Phase 3 path).
-                                            // Forward answer to caller
-                                            {
-                                                let hub = signal_hub.lock().await;
-                                                let _ = hub.send_to(&peer_fp, &msg).await;
-                                            }
-
-                                            // Send CallSetup to BOTH parties with
-                                            // cross-wired peer_direct_addr +
-                                            // peer_local_addrs (Phase 5.5 ICE).
-                                            let setup_for_caller = SignalMessage::CallSetup {
-                                                call_id: call_id.clone(),
-                                                room: room.clone(),
-                                                relay_addr: relay_addr_for_setup.clone(),
-                                                peer_direct_addr: callee_addr.clone(),
-                                                peer_local_addrs: callee_local.clone(),
-                                            };
-                                            let setup_for_callee = SignalMessage::CallSetup {
-                                                call_id: call_id.clone(),
-                                                room: room.clone(),
-                                                relay_addr: relay_addr_for_setup,
-                                                peer_direct_addr: caller_addr.clone(),
-                                                peer_local_addrs: caller_local.clone(),
-                                            };
+                                            listen_addr_str.clone()
+                                        };
+                                        let setup = SignalMessage::CallSetup {
+                                            call_id: call_id.clone(),
+                                            room: room.clone(),
+                                            relay_addr: relay_addr_for_setup,
+                                        };
+                                        {
                                             let hub = signal_hub.lock().await;
-                                            let _ = hub.send_to(&peer_fp, &setup_for_caller).await;
-                                            let _ = hub.send_to(&client_fp, &setup_for_callee).await;
+                                            let _ = hub.send_to(&peer_fp, &setup).await;
+                                            let _ = hub.send_to(&client_fp, &setup).await;
                                         }
                                     }
                                 }
 
-                                SignalMessage::Hangup { ref call_id, .. } => {
-                                    // If the client sent a call_id, only end
-                                    // that specific call. Otherwise (old clients)
-                                    // fall back to ending ALL active calls for
-                                    // this user — which can race with new calls.
+                                SignalMessage::Hangup { .. } => {
+                                    // Forward hangup to all active calls for this user
                                     let calls = {
                                         let reg = call_registry.lock().await;
-                                        if let Some(cid) = call_id {
-                                            // Targeted hangup: only the named call
-                                            reg.get(cid)
-                                                .map(|c| vec![(c.call_id.clone(), if c.caller_fingerprint == client_fp {
-                                                    c.callee_fingerprint.clone()
-                                                } else {
-                                                    c.caller_fingerprint.clone()
-                                                })])
-                                                .unwrap_or_default()
-                                        } else {
-                                            // Legacy: end all calls for this user
-                                            reg.calls_for_fingerprint(&client_fp)
-                                                .iter()
-                                                .map(|c| (c.call_id.clone(), if c.caller_fingerprint == client_fp {
-                                                    c.callee_fingerprint.clone()
-                                                } else {
-                                                    c.caller_fingerprint.clone()
-                                                }))
-                                                .collect::<Vec<_>>()
-                                        }
+                                        reg.calls_for_fingerprint(&client_fp)
+                                            .iter()
+                                            .map(|c| (c.call_id.clone(), if c.caller_fingerprint == client_fp {
+                                                c.callee_fingerprint.clone()
+                                            } else {
+                                                c.caller_fingerprint.clone()
+                                            }))
+                                            .collect::<Vec<_>>()
                                     };
-                                    for (cid, peer_fp) in &calls {
+                                    for (call_id, peer_fp) in &calls {
                                         let hub = signal_hub.lock().await;
                                         let _ = hub.send_to(peer_fp, &msg).await;
                                         drop(hub);
                                         let mut reg = call_registry.lock().await;
-                                        reg.end_call(cid);
-                                    }
-                                }
-
-                                // Phase 6: forward MediaPathReport to the
-                                // call peer so both sides can negotiate
-                                // the media path before committing.
-                                SignalMessage::MediaPathReport { ref call_id, .. } => {
-                                    // Look up peer AND check if this is a
-                                    // cross-relay call (same pattern as
-                                    // DirectCallAnswer).
-                                    let (peer_fp, peer_relay_fp) = {
-                                        let reg = call_registry.lock().await;
-                                        match reg.get(call_id) {
-                                            Some(c) => (
-                                                reg.peer_fingerprint(call_id, &client_fp)
-                                                    .map(|s| s.to_string()),
-                                                c.peer_relay_fp.clone(),
-                                            ),
-                                            None => (None, None),
-                                        }
-                                    };
-
-                                    if let Some(fp) = peer_fp {
-                                        if let Some(ref origin_fp) = peer_relay_fp {
-                                            // Cross-relay: wrap and forward
-                                            if let Some(ref fm) = federation_mgr {
-                                                let forward = SignalMessage::FederatedSignalForward {
-                                                    inner: Box::new(msg.clone()),
-                                                    origin_relay_fp: tls_fp.clone(),
-                                                };
-                                                if let Err(e) = fm.send_signal_to_peer(origin_fp, &forward).await {
-                                                    warn!(
-                                                        %call_id,
-                                                        %origin_fp,
-                                                        error = %e,
-                                                        "cross-relay MediaPathReport forward failed"
-                                                    );
-                                                }
-                                            }
-                                        } else {
-                                            // Local call
-                                            let hub = signal_hub.lock().await;
-                                            let _ = hub.send_to(&fp, &msg).await;
-                                        }
+                                        reg.end_call(call_id);
                                     }
                                 }
 
@@ -1392,31 +848,6 @@ async fn main() -> anyhow::Result<()> {
                                     let _ = transport.send_signal(&SignalMessage::Pong { timestamp_ms }).await;
                                 }
 
-                                // QUIC-native NAT reflection ("STUN for QUIC").
-                                // The client asks "what source address do you
-                                // see for me?" and we reply with whatever
-                                // quinn reports as this connection's remote
-                                // address — i.e. the post-NAT public address
-                                // as observed from the server side of the TLS
-                                // session. Used by the P2P path to learn the
-                                // client's server-reflexive address without
-                                // running a separate STUN server. No auth or
-                                // rate-limit in Phase 1 — the client is
-                                // already TLS-authenticated by the time it
-                                // reaches this match arm.
-                                SignalMessage::Reflect => {
-                                    let observed_addr = addr.to_string();
-                                    if let Err(e) = transport.send_signal(
-                                        &SignalMessage::ReflectResponse {
-                                            observed_addr: observed_addr.clone(),
-                                        },
-                                    ).await {
-                                        warn!(%addr, error = %e, "reflect: failed to send response");
-                                    } else {
-                                        debug!(%addr, %observed_addr, "reflect: responded");
-                                    }
-                                }
-
                                 other => {
                                     warn!(%addr, "signal: unexpected message: {:?}", std::mem::discriminant(&other));
                                 }
@@ -1426,16 +857,6 @@ async fn main() -> anyhow::Result<()> {
                             info!(%addr, "signal connection closed");
                             break;
                         }
-                        Err(wzp_proto::TransportError::Deserialize(e)) => {
-                            // Forward-compat: the peer sent a
-                            // SignalMessage variant we don't know
-                            // (newer client, newer federation peer).
-                            // Log and continue — tearing down the
-                            // connection on unknown variants would
-                            // silently kill interop across minor
-                            // protocol version bumps.
-                            warn!(%addr, "signal deserialize (unknown variant?), continuing: {e}");
-                        }
                         Err(e) => {
                             warn!(%addr, "signal recv error: {e}");
                             break;
@@ -1459,7 +880,6 @@ async fn main() -> anyhow::Result<()> {
                     let hub = signal_hub.lock().await;
                     let _ = hub.send_to(peer_fp, &SignalMessage::Hangup {
                         reason: wzp_proto::HangupReason::Normal,
-                        call_id: Some(call_id.clone()),
                     }).await;
                     drop(hub);
                     let mut reg = call_registry.lock().await;
@@ -1733,5 +1153,4 @@ async fn main() -> anyhow::Result<()> {
             }
         });
     }
-    Ok(())
 }

crates/wzp-relay/src/room.rs

@@ -10,11 +10,9 @@ use std::time::Duration;
 
 use bytes::Bytes;
 use tokio::sync::Mutex;
-use tracing::{error, info, warn};
+use tracing::{debug, error, info, trace, warn};
 
 use wzp_proto::packet::TrunkFrame;
-use wzp_proto::quality::{AdaptiveQualityController, Tier};
-use wzp_proto::traits::QualityController;
 use wzp_proto::MediaTransport;
 
 use crate::metrics::RelayMetrics;
@@ -52,45 +50,6 @@ impl DebugTap {
     }
 }
 
-/// Tracks network quality for a single participant in a room.
-struct ParticipantQuality {
-    controller: AdaptiveQualityController,
-    current_tier: Tier,
-}
-
-impl ParticipantQuality {
-    fn new() -> Self {
-        Self {
-            controller: AdaptiveQualityController::new(),
-            current_tier: Tier::Good,
-        }
-    }
-
-    /// Feed a quality report and return the new tier if it changed.
-    fn observe(&mut self, report: &wzp_proto::packet::QualityReport) -> Option<Tier> {
-        let _ = self.controller.observe(report);
-        let new_tier = self.controller.tier();
-        if new_tier != self.current_tier {
-            self.current_tier = new_tier;
-            Some(new_tier)
-        } else {
-            None
-        }
-    }
-}
-
-/// Compute the weakest (worst) quality tier across all tracked participants.
-fn weakest_tier<'a>(qualities: impl Iterator<Item = &'a ParticipantQuality>) -> Tier {
-    qualities
-        .map(|pq| pq.current_tier)
-        .min_by_key(|t| match t {
-            Tier::Good => 2,
-            Tier::Degraded => 1,
-            Tier::Catastrophic => 0,
-        })
-        .unwrap_or(Tier::Good)
-}
-
 /// Unique participant ID within a room.
 pub type ParticipantId = u64;
 
@@ -249,10 +208,6 @@ pub struct RoomManager {
     acl: Option<HashMap<String, HashSet<String>>>,
     /// Channel for room lifecycle events (federation subscribes).
     event_tx: tokio::sync::broadcast::Sender<RoomEvent>,
-    /// Per-participant quality tracking, keyed by (room_name, participant_id).
-    qualities: HashMap<(String, ParticipantId), ParticipantQuality>,
-    /// Current room-wide tier per room (to avoid repeated broadcasts).
-    room_tiers: HashMap<String, Tier>,
 }
 
 impl RoomManager {
@@ -262,8 +217,6 @@ impl RoomManager {
             rooms: HashMap::new(),
             acl: None,
             event_tx,
-            qualities: HashMap::new(),
-            room_tiers: HashMap::new(),
         }
     }
 
@@ -274,8 +227,6 @@ impl RoomManager {
             rooms: HashMap::new(),
             acl: Some(HashMap::new()),
             event_tx,
-            qualities: HashMap::new(),
-            room_tiers: HashMap::new(),
         }
     }
 
@@ -326,7 +277,6 @@ impl RoomManager {
             || self.rooms.get(room_name).map_or(true, |r| r.is_empty());
         let room = self.rooms.entry(room_name.to_string()).or_insert_with(Room::new);
         let id = room.add(addr, sender, fingerprint.map(|s| s.to_string()), alias.map(|s| s.to_string()));
-        self.qualities.insert((room_name.to_string(), id), ParticipantQuality::new());
         if was_empty {
             let _ = self.event_tx.send(RoomEvent::LocalJoin { room: room_name.to_string() });
         }
@@ -373,12 +323,10 @@ impl RoomManager {
 
     /// Leave a room. Returns (room_update_msg, remaining_senders) for broadcasting, or None if room is now empty.
     pub fn leave(&mut self, room_name: &str, participant_id: ParticipantId) -> Option<(wzp_proto::SignalMessage, Vec<ParticipantSender>)> {
-        self.qualities.remove(&(room_name.to_string(), participant_id));
         if let Some(room) = self.rooms.get_mut(room_name) {
             room.remove(participant_id);
             if room.is_empty() {
                 self.rooms.remove(room_name);
-                self.room_tiers.remove(room_name);
                 let _ = self.event_tx.send(RoomEvent::LocalLeave { room: room_name.to_string() });
                 info!(room = room_name, "room closed (empty)");
                 return None;
@@ -415,58 +363,6 @@ impl RoomManager {
     pub fn list(&self) -> Vec<(String, usize)> {
         self.rooms.iter().map(|(k, v)| (k.clone(), v.len())).collect()
     }
-
-    /// Feed a quality report from a participant. If the room-wide weakest
-    /// tier changes, returns `(QualityDirective signal, all senders)` for
-    /// broadcasting.
-    pub fn observe_quality(
-        &mut self,
-        room_name: &str,
-        participant_id: ParticipantId,
-        report: &wzp_proto::packet::QualityReport,
-    ) -> Option<(wzp_proto::SignalMessage, Vec<ParticipantSender>)> {
-        let key = (room_name.to_string(), participant_id);
-        let tier_changed = self.qualities
-            .get_mut(&key)
-            .and_then(|pq| pq.observe(report))
-            .is_some();
-
-        if !tier_changed {
-            return None;
-        }
-
-        // Compute the weakest tier across all participants in this room
-        let room_qualities = self.qualities.iter()
-            .filter(|((rn, _), _)| rn == room_name)
-            .map(|(_, pq)| pq);
-        let weakest = weakest_tier(room_qualities);
-
-        let current_room_tier = self.room_tiers.get(room_name).copied().unwrap_or(Tier::Good);
-        if weakest == current_room_tier {
-            return None;
-        }
-
-        // Room-wide tier changed — update and broadcast directive
-        self.room_tiers.insert(room_name.to_string(), weakest);
-        let profile = weakest.profile();
-        info!(
-            room = room_name,
-            old_tier = ?current_room_tier,
-            new_tier = ?weakest,
-            codec = ?profile.codec,
-            fec_ratio = profile.fec_ratio,
-            "room quality directive"
-        );
-
-        let directive = wzp_proto::SignalMessage::QualityDirective {
-            recommended_profile: profile,
-            reason: Some(format!("weakest link: {weakest:?}")),
-        };
-        let senders = self.rooms.get(room_name)
-            .map(|r| r.all_senders())
-            .unwrap_or_default();
-        Some((directive, senders))
-    }
 }
 
 // ---------------------------------------------------------------------------
@@ -486,32 +382,18 @@ impl TrunkedForwarder {
     /// Create a new trunked forwarder.
     ///
     /// `session_id` tags every entry pushed into the batcher so the receiver
-    /// can demultiplex packets by session. The batcher's `max_bytes` is
-    /// initialized from the transport's current PMTUD-discovered MTU so that
-    /// trunk frames fill the largest datagram the path supports (instead of
-    /// the conservative 1200-byte default).
+    /// can demultiplex packets by session.
     pub fn new(transport: Arc<wzp_transport::QuinnTransport>, session_id: [u8; 2]) -> Self {
-        let mut batcher = TrunkBatcher::new();
-        if let Some(mtu) = transport.max_datagram_size() {
-            batcher.max_bytes = mtu;
-        }
         Self {
             transport,
-            batcher,
+            batcher: TrunkBatcher::new(),
             session_id,
         }
     }
 
     /// Push a media packet into the batcher.  If the batcher is full it will
     /// flush automatically and the resulting trunk frame is sent immediately.
-    ///
-    /// Also refreshes `max_bytes` from the transport's PMTUD-discovered MTU
-    /// so the batcher fills larger datagrams as the path MTU grows.
     pub async fn send(&mut self, pkt: &wzp_proto::MediaPacket) -> anyhow::Result<()> {
-        // Refresh batcher limit from PMTUD (cheap: reads an atomic in quinn).
-        if let Some(mtu) = self.transport.max_datagram_size() {
-            self.batcher.max_bytes = mtu;
-        }
         let payload: Bytes = pkt.to_bytes();
         if let Some(frame) = self.batcher.push(self.session_id, payload) {
             self.send_frame(&frame)?;
@@ -601,6 +483,7 @@ async fn run_participant_plain(
     );
 
     loop {
+        let recv_start = std::time::Instant::now();
         let pkt = match transport.recv_media().await {
             Ok(Some(pkt)) => pkt,
             Ok(None) => {
@@ -639,17 +522,11 @@ async fn run_participant_plain(
             metrics.update_session_quality(session_id, report);
         }
 
-        // Get current list of other participants + check quality directive
+        // Get current list of other participants
         let lock_start = std::time::Instant::now();
-        let (others, quality_directive) = {
-            let mut mgr = room_mgr.lock().await;
-            let directive = if let Some(ref report) = pkt.quality_report {
-                mgr.observe_quality(&room_name, participant_id, report)
-            } else {
-                None
-            };
-            let o = mgr.others(&room_name, participant_id);
-            (o, directive)
+        let others = {
+            let mgr = room_mgr.lock().await;
+            mgr.others(&room_name, participant_id)
         };
         let lock_ms = lock_start.elapsed().as_millis() as u64;
         if lock_ms > 10 {
@@ -661,11 +538,6 @@ async fn run_participant_plain(
             );
         }
 
-        // Broadcast quality directive to all participants if tier changed
-        if let Some((directive, all_senders)) = quality_directive {
-            broadcast_signal(&all_senders, &directive).await;
-        }
-
         // Debug tap: log packet metadata
         if let Some(ref tap) = debug_tap {
             if tap.matches(&room_name) {
@@ -834,15 +706,9 @@ async fn run_participant_trunked(
                 }
 
                 let lock_start = std::time::Instant::now();
-                let (others, quality_directive) = {
-                    let mut mgr = room_mgr.lock().await;
-                    let directive = if let Some(ref report) = pkt.quality_report {
-                        mgr.observe_quality(&room_name, participant_id, report)
-                    } else {
-                        None
-                    };
-                    let o = mgr.others(&room_name, participant_id);
-                    (o, directive)
+                let others = {
+                    let mgr = room_mgr.lock().await;
+                    mgr.others(&room_name, participant_id)
                 };
                 let lock_ms = lock_start.elapsed().as_millis() as u64;
                 if lock_ms > 10 {
@@ -854,11 +720,6 @@ async fn run_participant_trunked(
                     );
                 }
 
-                // Broadcast quality directive to all participants if tier changed
-                if let Some((directive, all_senders)) = quality_directive {
-                    broadcast_signal(&all_senders, &directive).await;
-                }
-
                 let fwd_start = std::time::Instant::now();
                 let pkt_bytes = pkt.payload.len() as u64;
                 for other in &others {
@@ -977,7 +838,7 @@ mod tests {
 
     #[test]
     fn room_join_leave() {
-        let mgr = RoomManager::new();
+        let mut mgr = RoomManager::new();
         assert_eq!(mgr.room_size("test"), 0);
         assert!(mgr.list().is_empty());
     }
@@ -1099,47 +960,4 @@ mod tests {
         // Batcher should now be empty — nothing to flush.
         assert!(batcher.flush().is_none());
     }
-
-    fn make_report(loss_pct_f: f32, rtt_ms: u16) -> wzp_proto::packet::QualityReport {
-        wzp_proto::packet::QualityReport {
-            loss_pct: (loss_pct_f / 100.0 * 255.0) as u8,
-            rtt_4ms: (rtt_ms / 4) as u8,
-            jitter_ms: 10,
-            bitrate_cap_kbps: 200,
-        }
-    }
-
-    #[test]
-    fn participant_quality_starts_good() {
-        let pq = ParticipantQuality::new();
-        assert_eq!(pq.current_tier, Tier::Good);
-    }
-
-    #[test]
-    fn participant_quality_degrades_on_bad_reports() {
-        let mut pq = ParticipantQuality::new();
-        let bad = make_report(50.0, 300);
-        // Feed enough bad reports to trigger downgrade (3 consecutive)
-        for _ in 0..5 {
-            pq.observe(&bad);
-        }
-        assert_ne!(pq.current_tier, Tier::Good, "should degrade from Good");
-    }
-
-    #[test]
-    fn weakest_tier_picks_worst() {
-        let good = ParticipantQuality::new();
-        // good stays at Good tier
-
-        let mut bad = ParticipantQuality::new();
-        let bad_report = make_report(50.0, 300);
-        for _ in 0..5 {
-            bad.observe(&bad_report);
-        }
-        // bad should be degraded or catastrophic
-
-        let participants = vec![good, bad];
-        let weakest = weakest_tier(participants.iter());
-        assert_ne!(weakest, Tier::Good, "weakest should not be Good when one participant is bad");
-    }
 }

crates/wzp-relay/src/signal_hub.rs

@@ -7,7 +7,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Instant;
 
-use tracing::info;
+use tracing::{info, warn};
 use wzp_proto::{MediaTransport, SignalMessage};
 use wzp_transport::QuinnTransport;
 
@@ -94,7 +94,7 @@ mod tests {
 
     #[test]
     fn register_unregister() {
-        let hub = SignalHub::new();
+        let mut hub = SignalHub::new();
         assert_eq!(hub.online_count(), 0);
         assert!(!hub.is_online("alice"));
 

crates/wzp-relay/tests/cross_relay_direct_call.rs

@@ -1,317 +0,0 @@
-//! Phase 4 integration test for cross-relay direct calling
-//! (PRD: .taskmaster/docs/prd_phase4_cross_relay_p2p.txt).
-//!
-//! Drives the call-registry cross-wiring + a simulated federation
-//! forward without spinning up actual relay binaries. The real
-//! main-loop and dispatcher code are exercised end-to-end in
-//! `reflect.rs` / `hole_punching.rs` already; this file focuses on
-//! the *new* invariants Phase 4 adds:
-//!
-//! 1. When Relay A forwards a DirectCallOffer, its local registry
-//!    stashes caller_reflexive_addr and leaves peer_relay_fp
-//!    unset (broadcast, answer-side will identify itself).
-//! 2. When Relay B's cross-relay dispatcher receives the forward,
-//!    its local registry stores the call with
-//!    peer_relay_fp = Some(relay_a_tls_fp).
-//! 3. When Relay B processes the local callee's answer, it sees
-//!    peer_relay_fp.is_some() and MUST NOT deliver the answer via
-//!    local signal_hub — instead it routes through federation.
-//! 4. When Relay A receives the forwarded answer via its
-//!    cross-relay dispatcher, it stashes callee_reflexive_addr
-//!    and emits a CallSetup to its local caller with
-//!    peer_direct_addr = callee_addr.
-//! 5. Final state: Alice's CallSetup carries Bob's reflex addr,
-//!    Bob's CallSetup carries Alice's reflex addr — cross-wired
-//!    through two relays + a federation link.
-
-use wzp_proto::{CallAcceptMode, SignalMessage};
-use wzp_relay::call_registry::CallRegistry;
-
-// ────────────────────────────────────────────────────────────────
-// Simulated dispatch helpers — these reproduce the exact logic
-// in main.rs without the tokio + federation boilerplate.
-// ────────────────────────────────────────────────────────────────
-
-const RELAY_A_TLS_FP: &str = "relay-A-tls-fingerprint";
-const RELAY_B_TLS_FP: &str = "relay-B-tls-fingerprint";
-const ALICE_ADDR: &str = "192.0.2.1:4433";
-const BOB_ADDR: &str = "198.51.100.9:4433";
-const RELAY_A_ADDR: &str = "203.0.113.5:4433";
-const RELAY_B_ADDR: &str = "203.0.113.10:4433";
-
-/// Helper that Alice's place_call sends.
-fn alice_offer(call_id: &str) -> SignalMessage {
-    SignalMessage::DirectCallOffer {
-        caller_fingerprint: "alice".into(),
-        caller_alias: None,
-        target_fingerprint: "bob".into(),
-        call_id: call_id.into(),
-        identity_pub: [0; 32],
-        ephemeral_pub: [0; 32],
-        signature: vec![],
-        supported_profiles: vec![],
-        caller_reflexive_addr: Some(ALICE_ADDR.into()),
-        caller_local_addrs: Vec::new(),
-        caller_build_version: None,
-    }
-}
-
-/// Relay A receives Alice's offer. Target Bob is not local.
-/// Relay A wraps + broadcasts over federation, stashes the call
-/// locally with peer_relay_fp = None (broadcast — answer-side
-/// identifies itself).
-fn relay_a_handle_offer(reg_a: &mut CallRegistry, offer: &SignalMessage) -> SignalMessage {
-    match offer {
-        SignalMessage::DirectCallOffer {
-            caller_fingerprint,
-            target_fingerprint,
-            call_id,
-            caller_reflexive_addr,
-            ..
-        } => {
-            reg_a.create_call(
-                call_id.clone(),
-                caller_fingerprint.clone(),
-                target_fingerprint.clone(),
-            );
-            reg_a.set_caller_reflexive_addr(call_id, caller_reflexive_addr.clone());
-            // peer_relay_fp stays None — we don't know which peer
-            // will respond yet.
-        }
-        _ => panic!("not an offer"),
-    }
-    // Build the federation envelope the main loop would
-    // broadcast.
-    SignalMessage::FederatedSignalForward {
-        inner: Box::new(offer.clone()),
-        origin_relay_fp: RELAY_A_TLS_FP.into(),
-    }
-}
-
-/// Relay B receives a FederatedSignalForward(DirectCallOffer).
-/// This is the cross-relay dispatcher task code in main.rs —
-/// reproduced here for the test.
-fn relay_b_handle_forwarded_offer(reg_b: &mut CallRegistry, forward: &SignalMessage) {
-    let (inner, origin_relay_fp) = match forward {
-        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
-            (inner.as_ref().clone(), origin_relay_fp.clone())
-        }
-        _ => panic!("not a forward"),
-    };
-    // Loop-prevention: drop self-sourced.
-    assert_ne!(origin_relay_fp, RELAY_B_TLS_FP);
-
-    let SignalMessage::DirectCallOffer {
-        caller_fingerprint,
-        target_fingerprint,
-        call_id,
-        caller_reflexive_addr,
-        ..
-    } = inner
-    else {
-        panic!("inner was not DirectCallOffer");
-    };
-
-    // Simulated: target is local to B (Bob is registered here).
-    reg_b.create_call(
-        call_id.clone(),
-        caller_fingerprint,
-        target_fingerprint,
-    );
-    reg_b.set_caller_reflexive_addr(&call_id, caller_reflexive_addr);
-    reg_b.set_peer_relay_fp(&call_id, Some(origin_relay_fp));
-}
-
-/// Bob's answer — AcceptTrusted with his reflex addr.
-fn bob_answer(call_id: &str) -> SignalMessage {
-    SignalMessage::DirectCallAnswer {
-        call_id: call_id.into(),
-        accept_mode: CallAcceptMode::AcceptTrusted,
-        identity_pub: None,
-        ephemeral_pub: None,
-        signature: None,
-        chosen_profile: None,
-        callee_reflexive_addr: Some(BOB_ADDR.into()),
-        callee_local_addrs: Vec::new(),
-        callee_build_version: None,
-    }
-}
-
-/// Relay B handles the LOCAL callee's answer. If peer_relay_fp
-/// is Some, wrap the answer in a FederatedSignalForward + emit the
-/// local CallSetup to Bob. Returns the (forward_envelope,
-/// bob_call_setup) pair.
-fn relay_b_handle_local_answer(
-    reg_b: &mut CallRegistry,
-    answer: &SignalMessage,
-) -> (SignalMessage, SignalMessage) {
-    let (call_id, mode, callee_addr) = match answer {
-        SignalMessage::DirectCallAnswer {
-            call_id,
-            accept_mode,
-            callee_reflexive_addr,
-            ..
-        } => (call_id.clone(), *accept_mode, callee_reflexive_addr.clone()),
-        _ => panic!(),
-    };
-    // Stash callee addr + activate.
-    reg_b.set_active(&call_id, mode, format!("call-{call_id}"));
-    reg_b.set_callee_reflexive_addr(&call_id, callee_addr);
-    let call = reg_b.get(&call_id).unwrap();
-    let caller_addr = call.caller_reflexive_addr.clone();
-    let callee_addr = call.callee_reflexive_addr.clone();
-    assert!(
-        call.peer_relay_fp.is_some(),
-        "Relay B must know this call is cross-relay"
-    );
-
-    // Forward the answer back over federation.
-    let forward = SignalMessage::FederatedSignalForward {
-        inner: Box::new(answer.clone()),
-        origin_relay_fp: RELAY_B_TLS_FP.into(),
-    };
-
-    // Local CallSetup for Bob — peer_direct_addr = Alice's addr.
-    let setup_for_bob = SignalMessage::CallSetup {
-        call_id: call_id.clone(),
-        room: format!("call-{call_id}"),
-        relay_addr: RELAY_B_ADDR.into(),
-        peer_direct_addr: caller_addr,
-        peer_local_addrs: Vec::new(),
-    };
-    let _ = callee_addr;
-    (forward, setup_for_bob)
-}
-
-/// Relay A's cross-relay dispatcher receives the forwarded answer.
-/// It stashes the callee addr, forwards the raw answer to local
-/// Alice, and emits a CallSetup with peer_direct_addr = Bob's addr.
-fn relay_a_handle_forwarded_answer(
-    reg_a: &mut CallRegistry,
-    forward: &SignalMessage,
-) -> SignalMessage {
-    let (inner, origin_relay_fp) = match forward {
-        SignalMessage::FederatedSignalForward { inner, origin_relay_fp } => {
-            (inner.as_ref().clone(), origin_relay_fp.clone())
-        }
-        _ => panic!("not a forward"),
-    };
-    assert_ne!(origin_relay_fp, RELAY_A_TLS_FP);
-
-    let SignalMessage::DirectCallAnswer {
-        call_id,
-        accept_mode,
-        callee_reflexive_addr,
-        ..
-    } = inner
-    else {
-        panic!("inner was not DirectCallAnswer");
-    };
-    assert_eq!(accept_mode, CallAcceptMode::AcceptTrusted);
-
-    reg_a.set_active(&call_id, accept_mode, format!("call-{call_id}"));
-    reg_a.set_callee_reflexive_addr(&call_id, callee_reflexive_addr.clone());
-
-    // Alice's CallSetup — peer_direct_addr = Bob's addr.
-    SignalMessage::CallSetup {
-        call_id: call_id.clone(),
-        room: format!("call-{call_id}"),
-        relay_addr: RELAY_A_ADDR.into(),
-        peer_direct_addr: callee_reflexive_addr,
-        peer_local_addrs: Vec::new(),
-    }
-}
-
-// ────────────────────────────────────────────────────────────────
-// Tests
-// ────────────────────────────────────────────────────────────────
-
-#[test]
-fn cross_relay_offer_forwards_and_stashes_peer_relay_fp() {
-    let mut reg_a = CallRegistry::new();
-    let mut reg_b = CallRegistry::new();
-
-    let offer = alice_offer("c-xrelay-1");
-    let forward = relay_a_handle_offer(&mut reg_a, &offer);
-
-    // Relay A's local view: call exists, caller addr stashed,
-    // peer_relay_fp still None (broadcast — answer identifies the
-    // peer).
-    let call_a = reg_a.get("c-xrelay-1").unwrap();
-    assert_eq!(call_a.caller_fingerprint, "alice");
-    assert_eq!(call_a.callee_fingerprint, "bob");
-    assert_eq!(call_a.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
-    assert!(call_a.peer_relay_fp.is_none());
-
-    // Relay B dispatches the forward: creates the call locally
-    // and stashes peer_relay_fp = Relay A.
-    relay_b_handle_forwarded_offer(&mut reg_b, &forward);
-    let call_b = reg_b.get("c-xrelay-1").unwrap();
-    assert_eq!(call_b.caller_fingerprint, "alice");
-    assert_eq!(call_b.callee_fingerprint, "bob");
-    assert_eq!(call_b.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
-    assert_eq!(call_b.peer_relay_fp.as_deref(), Some(RELAY_A_TLS_FP));
-}
-
-#[test]
-fn cross_relay_answer_crosswires_peer_direct_addrs() {
-    let mut reg_a = CallRegistry::new();
-    let mut reg_b = CallRegistry::new();
-
-    // Full round trip: offer → forward → dispatch → answer →
-    // forward back → dispatch → both CallSetups.
-    let offer = alice_offer("c-xrelay-2");
-    let offer_forward = relay_a_handle_offer(&mut reg_a, &offer);
-    relay_b_handle_forwarded_offer(&mut reg_b, &offer_forward);
-
-    // Bob answers on Relay B.
-    let answer = bob_answer("c-xrelay-2");
-    let (answer_forward, setup_for_bob) =
-        relay_b_handle_local_answer(&mut reg_b, &answer);
-
-    // Bob's CallSetup carries Alice's addr.
-    match setup_for_bob {
-        SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
-            assert_eq!(peer_direct_addr.as_deref(), Some(ALICE_ADDR));
-            assert_eq!(relay_addr, RELAY_B_ADDR);
-        }
-        _ => panic!("wrong variant"),
-    }
-
-    // Alice's dispatcher receives the forwarded answer and builds
-    // her CallSetup.
-    let setup_for_alice = relay_a_handle_forwarded_answer(&mut reg_a, &answer_forward);
-    match setup_for_alice {
-        SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
-            assert_eq!(peer_direct_addr.as_deref(), Some(BOB_ADDR));
-            assert_eq!(relay_addr, RELAY_A_ADDR);
-        }
-        _ => panic!("wrong variant"),
-    }
-
-    // Both registries agree on caller + callee reflex addrs after
-    // the full round-trip.
-    for reg in [&reg_a, &reg_b] {
-        let c = reg.get("c-xrelay-2").unwrap();
-        assert_eq!(c.caller_reflexive_addr.as_deref(), Some(ALICE_ADDR));
-        assert_eq!(c.callee_reflexive_addr.as_deref(), Some(BOB_ADDR));
-    }
-}
-
-#[test]
-fn cross_relay_loop_prevention_drops_self_sourced_forward() {
-    // A FederatedSignalForward that circles back to the origin
-    // relay should be dropped before it hits the call registry.
-    let forward = SignalMessage::FederatedSignalForward {
-        inner: Box::new(alice_offer("c-loop")),
-        origin_relay_fp: RELAY_B_TLS_FP.into(),
-    };
-    // The dispatcher in main.rs calls this explicit check before
-    // doing any work. Reproduce it inline.
-    let origin = match &forward {
-        SignalMessage::FederatedSignalForward { origin_relay_fp, .. } => origin_relay_fp.clone(),
-        _ => unreachable!(),
-    };
-    // Relay B sees origin == its own fp → drop.
-    assert_eq!(origin, RELAY_B_TLS_FP, "loop-prevention triggers on self-fp");
-}

crates/wzp-relay/tests/handshake_integration.rs

@@ -63,11 +63,11 @@ async fn handshake_succeeds() {
         accept_handshake(server_t.as_ref(), &callee_seed).await
     });
 
-    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed, None)
+    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed)
         .await
         .expect("perform_handshake should succeed");
 
-    let (callee_session, chosen_profile, _caller_fp, _caller_alias) = callee_handle
+    let (callee_session, chosen_profile) = callee_handle
         .await
         .expect("join callee task")
         .expect("accept_handshake should succeed");
@@ -124,11 +124,11 @@ async fn handshake_verifies_identity() {
         accept_handshake(server_t.as_ref(), &callee_seed).await
     });
 
-    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed, None)
+    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed)
         .await
         .expect("handshake must succeed even with different identities");
 
-    let (callee_session, _profile, _caller_fp, _caller_alias) = callee_handle
+    let (callee_session, _profile) = callee_handle
         .await
         .expect("join")
         .expect("accept_handshake must succeed");
@@ -183,7 +183,7 @@ async fn auth_then_handshake() {
         };
 
         // 2. Run the cryptographic handshake
-        let (session, profile, _caller_fp, _caller_alias) = accept_handshake(server_t.as_ref(), &callee_seed)
+        let (session, profile) = accept_handshake(server_t.as_ref(), &callee_seed)
             .await
             .expect("accept_handshake after auth");
 
@@ -199,7 +199,7 @@ async fn auth_then_handshake() {
         .await
         .expect("send AuthToken");
 
-    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed, None)
+    let caller_session = perform_handshake(client_transport.as_ref(), &caller_seed)
         .await
         .expect("perform_handshake after auth");
 
@@ -270,7 +270,6 @@ async fn handshake_rejects_bad_signature() {
         ephemeral_pub,
         signature,
         supported_profiles: vec![wzp_proto::QualityProfile::GOOD],
-        alias: None,
     };
 
     client_transport

crates/wzp-relay/tests/hole_punching.rs

@@ -1,294 +0,0 @@
-//! Phase 3 integration tests for hole-punching advertising
-//! (PRD: .taskmaster/docs/prd_hole_punching.txt).
-//!
-//! These verify the end-to-end protocol cross-wiring:
-//!   caller (places offer with caller_reflexive_addr=A)
-//!     → relay (stashes A in registry)
-//!       → callee (reads A off the forwarded offer)
-//!   callee (sends AcceptTrusted answer with callee_reflexive_addr=B)
-//!     → relay (stashes B, emits CallSetup to both parties)
-//!       → caller receives CallSetup.peer_direct_addr = B
-//!       → callee receives CallSetup.peer_direct_addr = A
-//!
-//! The actual QUIC hole-punch race is a Phase 3.5 follow-up.
-//! These tests only cover the signal-plane plumbing — that the
-//! addrs make it from each peer's offer/answer through the relay
-//! cross-wiring back out in CallSetup with the peer's addr.
-//!
-//! We drive the call registry + a minimal routing function
-//! directly instead of spinning up a full relay process — easier
-//! to reason about, no real network, and what we actually want to
-//! test is the cross-wiring logic, not the whole signal stack.
-
-use wzp_proto::{CallAcceptMode, SignalMessage};
-use wzp_relay::call_registry::CallRegistry;
-
-/// Helper: simulate the relay's handling of a DirectCallOffer. In
-/// `wzp-relay/src/main.rs` this is the match arm that creates the
-/// call in the registry and stashes the caller's reflex addr.
-fn handle_offer(reg: &mut CallRegistry, offer: &SignalMessage) -> String {
-    match offer {
-        SignalMessage::DirectCallOffer {
-            caller_fingerprint,
-            target_fingerprint,
-            call_id,
-            caller_reflexive_addr,
-            ..
-        } => {
-            reg.create_call(
-                call_id.clone(),
-                caller_fingerprint.clone(),
-                target_fingerprint.clone(),
-            );
-            reg.set_caller_reflexive_addr(call_id, caller_reflexive_addr.clone());
-            call_id.clone()
-        }
-        _ => panic!("not an offer"),
-    }
-}
-
-/// Helper: simulate the relay's handling of a DirectCallAnswer +
-/// the subsequent CallSetup emission. Returns the two CallSetup
-/// messages the relay would push: (for_caller, for_callee).
-fn handle_answer_and_build_setups(
-    reg: &mut CallRegistry,
-    answer: &SignalMessage,
-) -> (SignalMessage, SignalMessage) {
-    let (call_id, mode, callee_addr) = match answer {
-        SignalMessage::DirectCallAnswer {
-            call_id,
-            accept_mode,
-            callee_reflexive_addr,
-            ..
-        } => (call_id.clone(), *accept_mode, callee_reflexive_addr.clone()),
-        _ => panic!("not an answer"),
-    };
-
-    reg.set_callee_reflexive_addr(&call_id, callee_addr);
-    let room = format!("call-{call_id}");
-    reg.set_active(&call_id, mode, room.clone());
-
-    let (caller_addr, callee_addr) = {
-        let c = reg.get(&call_id).unwrap();
-        (
-            c.caller_reflexive_addr.clone(),
-            c.callee_reflexive_addr.clone(),
-        )
-    };
-
-    let setup_for_caller = SignalMessage::CallSetup {
-        call_id: call_id.clone(),
-        room: room.clone(),
-        relay_addr: "203.0.113.5:4433".into(),
-        peer_direct_addr: callee_addr,
-        peer_local_addrs: Vec::new(),
-    };
-    let setup_for_callee = SignalMessage::CallSetup {
-        call_id,
-        room,
-        relay_addr: "203.0.113.5:4433".into(),
-        peer_direct_addr: caller_addr,
-        peer_local_addrs: Vec::new(),
-    };
-    (setup_for_caller, setup_for_callee)
-}
-
-fn mk_offer(call_id: &str, caller_reflexive_addr: Option<&str>) -> SignalMessage {
-    SignalMessage::DirectCallOffer {
-        caller_fingerprint: "alice".into(),
-        caller_alias: None,
-        target_fingerprint: "bob".into(),
-        call_id: call_id.into(),
-        identity_pub: [0; 32],
-        ephemeral_pub: [0; 32],
-        signature: vec![],
-        supported_profiles: vec![],
-        caller_reflexive_addr: caller_reflexive_addr.map(String::from),
-        caller_local_addrs: Vec::new(),
-        caller_build_version: None,
-    }
-}
-
-fn mk_answer(
-    call_id: &str,
-    mode: CallAcceptMode,
-    callee_reflexive_addr: Option<&str>,
-) -> SignalMessage {
-    SignalMessage::DirectCallAnswer {
-        call_id: call_id.into(),
-        accept_mode: mode,
-        identity_pub: None,
-        ephemeral_pub: None,
-        signature: None,
-        chosen_profile: None,
-        callee_reflexive_addr: callee_reflexive_addr.map(String::from),
-        callee_local_addrs: Vec::new(),
-        callee_build_version: None,
-    }
-}
-
-// -----------------------------------------------------------------------
-// Test 1: both peers advertise — CallSetup cross-wires correctly
-// -----------------------------------------------------------------------
-
-#[test]
-fn both_peers_advertise_reflex_addrs_cross_wire_in_setup() {
-    let mut reg = CallRegistry::new();
-
-    let caller_addr = "192.0.2.1:4433";
-    let callee_addr = "198.51.100.9:4433";
-
-    let offer = mk_offer("c1", Some(caller_addr));
-    let call_id = handle_offer(&mut reg, &offer);
-    assert_eq!(call_id, "c1");
-    assert_eq!(
-        reg.get("c1").unwrap().caller_reflexive_addr.as_deref(),
-        Some(caller_addr)
-    );
-
-    let answer = mk_answer("c1", CallAcceptMode::AcceptTrusted, Some(callee_addr));
-    let (setup_caller, setup_callee) =
-        handle_answer_and_build_setups(&mut reg, &answer);
-
-    // The CALLER's setup should carry the CALLEE's addr as peer_direct_addr.
-    match setup_caller {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            assert_eq!(
-                peer_direct_addr.as_deref(),
-                Some(callee_addr),
-                "caller's CallSetup must contain callee's addr"
-            );
-        }
-        _ => panic!("wrong variant"),
-    }
-
-    // The CALLEE's setup should carry the CALLER's addr.
-    match setup_callee {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            assert_eq!(
-                peer_direct_addr.as_deref(),
-                Some(caller_addr),
-                "callee's CallSetup must contain caller's addr"
-            );
-        }
-        _ => panic!("wrong variant"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// Test 2: callee uses AcceptGeneric (privacy) — no addr leaks
-// -----------------------------------------------------------------------
-
-#[test]
-fn privacy_mode_answer_omits_callee_addr_from_setup() {
-    let mut reg = CallRegistry::new();
-    let caller_addr = "192.0.2.1:4433";
-
-    handle_offer(&mut reg, &mk_offer("c2", Some(caller_addr)));
-
-    // AcceptGeneric explicitly passes None for callee_reflexive_addr —
-    // the whole point is to hide the callee's IP from the caller.
-    let answer = mk_answer("c2", CallAcceptMode::AcceptGeneric, None);
-    let (setup_caller, setup_callee) =
-        handle_answer_and_build_setups(&mut reg, &answer);
-
-    // CALLER should see peer_direct_addr = None (privacy preserved).
-    match setup_caller {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            assert!(
-                peer_direct_addr.is_none(),
-                "privacy mode must not leak callee addr to caller"
-            );
-        }
-        _ => panic!("wrong variant"),
-    }
-
-    // CALLEE still gets the caller's addr — only the callee opted for
-    // privacy, the caller already volunteered its addr in the offer.
-    match setup_callee {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            assert_eq!(
-                peer_direct_addr.as_deref(),
-                Some(caller_addr),
-                "callee's CallSetup should still carry caller's volunteered addr"
-            );
-        }
-        _ => panic!("wrong variant"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// Test 3: old caller (no addr) + new callee — relay path only
-// -----------------------------------------------------------------------
-
-#[test]
-fn pre_phase3_caller_leaves_both_setups_relay_only() {
-    let mut reg = CallRegistry::new();
-
-    // Pre-Phase-3 client doesn't know about caller_reflexive_addr
-    // so the field is None.
-    handle_offer(&mut reg, &mk_offer("c3", None));
-
-    // New callee advertises its addr — doesn't matter because
-    // without caller_reflexive_addr the caller has nothing to
-    // attempt a direct handshake to, so the cross-wiring should
-    // still leave the caller's CallSetup without peer_direct_addr.
-    let answer = mk_answer(
-        "c3",
-        CallAcceptMode::AcceptTrusted,
-        Some("198.51.100.9:4433"),
-    );
-    let (setup_caller, setup_callee) =
-        handle_answer_and_build_setups(&mut reg, &answer);
-
-    match setup_caller {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            // Phase 3 relay behavior: we always inject whatever
-            // addrs are in the registry, regardless of who
-            // advertised. The caller here gets the callee's addr
-            // because the callee did advertise.
-            assert_eq!(peer_direct_addr.as_deref(), Some("198.51.100.9:4433"));
-        }
-        _ => panic!("wrong variant"),
-    }
-
-    // The callee's setup has no caller addr (pre-Phase-3 offer).
-    match setup_callee {
-        SignalMessage::CallSetup { peer_direct_addr, .. } => {
-            assert!(
-                peer_direct_addr.is_none(),
-                "callee should see no caller addr when offer was pre-Phase-3"
-            );
-        }
-        _ => panic!("wrong variant"),
-    }
-}
-
-// -----------------------------------------------------------------------
-// Test 4: neither side advertises — both CallSetups fall back cleanly
-// -----------------------------------------------------------------------
-
-#[test]
-fn neither_peer_advertises_both_setups_are_relay_only() {
-    let mut reg = CallRegistry::new();
-
-    handle_offer(&mut reg, &mk_offer("c4", None));
-    let answer = mk_answer("c4", CallAcceptMode::AcceptTrusted, None);
-    let (setup_caller, setup_callee) =
-        handle_answer_and_build_setups(&mut reg, &answer);
-
-    for (label, setup) in [("caller", setup_caller), ("callee", setup_callee)] {
-        match setup {
-            SignalMessage::CallSetup { peer_direct_addr, relay_addr, .. } => {
-                assert!(
-                    peer_direct_addr.is_none(),
-                    "{label}'s CallSetup must have no peer_direct_addr"
-                );
-                // Relay addr is always filled — that's the fallback
-                // path and the existing behavior.
-                assert!(!relay_addr.is_empty(), "{label} relay_addr must be set");
-            }
-            _ => panic!("wrong variant"),
-        }
-    }
-}

crates/wzp-relay/tests/multi_reflect.rs

@@ -1,229 +0,0 @@
-//! Phase 2 integration tests for multi-relay NAT reflection
-//! (PRD: .taskmaster/docs/prd_multi_relay_reflect.txt).
-//!
-//! These spin up one or two mock relays that implement the full
-//! pre-reflect dance — RegisterPresence → RegisterPresenceAck →
-//! Reflect → ReflectResponse — which is what the transient
-//! probe helper in `wzp_client::reflect::probe_reflect_addr` does
-//! against a real relay.
-//!
-//! Test matrix:
-//!   1. `probe_reflect_addr_happy_path`
-//!      — single mock relay, assert the probe helper returns the
-//!        observed addr as 127.0.0.1:<client ephemeral port>
-//!   2. `detect_nat_type_two_loopback_relays_is_cone`
-//!      — two mock relays, one client; loopback single-host means
-//!        every probe sees the same (127.0.0.1, same_port) so the
-//!        classifier returns `Cone` + a consensus addr
-//!   3. `detect_nat_type_dead_relay_is_unknown`
-//!      — one alive relay + one dead address; aggregator returns
-//!        `Unknown` with a non-empty `error` field on the failed
-//!        probe
-
-use std::net::{Ipv4Addr, SocketAddr};
-use std::sync::Arc;
-use std::time::Duration;
-
-use wzp_client::reflect::{detect_nat_type, probe_reflect_addr, NatType};
-use wzp_proto::{MediaTransport, SignalMessage};
-use wzp_transport::{create_endpoint, server_config, QuinnTransport};
-
-/// Minimal mock relay that loops accepting connections, handles
-/// RegisterPresence + Reflect, and responds correctly. Mirrors the
-/// two match arms from `wzp-relay/src/main.rs` that matter here.
-///
-/// Each accepted connection gets its own inner task so multiple
-/// simultaneous probes work.
-async fn spawn_mock_relay() -> (SocketAddr, tokio::task::JoinHandle<()>) {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-    let (sc, _cert_der) = server_config();
-    let bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let endpoint = create_endpoint(bind, Some(sc)).expect("server endpoint");
-    let listen_addr = endpoint.local_addr().expect("local_addr");
-
-    let handle = tokio::spawn(async move {
-        loop {
-            // Accept the next incoming connection. `wzp_transport::accept`
-            // returns the established `quinn::Connection`.
-            let conn = match wzp_transport::accept(&endpoint).await {
-                Ok(c) => c,
-                Err(_) => break, // endpoint closed
-            };
-            let observed_addr = conn.remote_address();
-            let transport = Arc::new(QuinnTransport::new(conn));
-
-            // Per-connection handler. Keep servicing messages until
-            // the peer closes so one probe connection can do
-            // RegisterPresence → Ack → Reflect → Response without
-            // racing other incoming connections.
-            let t = transport;
-            tokio::spawn(async move {
-                loop {
-                    match t.recv_signal().await {
-                        Ok(Some(SignalMessage::RegisterPresence { .. })) => {
-                            let _ = t
-                                .send_signal(&SignalMessage::RegisterPresenceAck {
-                                    success: true,
-                                    error: None,
-                                    relay_build: None,
-                                })
-                                .await;
-                        }
-                        Ok(Some(SignalMessage::Reflect)) => {
-                            let _ = t
-                                .send_signal(&SignalMessage::ReflectResponse {
-                                    observed_addr: observed_addr.to_string(),
-                                })
-                                .await;
-                        }
-                        Ok(Some(_other)) => { /* ignore */ }
-                        Ok(None) => break,
-                        Err(_) => break,
-                    }
-                }
-            });
-        }
-    });
-
-    (listen_addr, handle)
-}
-
-// -----------------------------------------------------------------------
-// Test 1: probe_reflect_addr against a single mock relay
-// -----------------------------------------------------------------------
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn probe_reflect_addr_happy_path() {
-    let (relay_addr, _relay_handle) = spawn_mock_relay().await;
-
-    let (observed, latency_ms) = tokio::time::timeout(
-        Duration::from_secs(3),
-        probe_reflect_addr(relay_addr, 2000, None),
-    )
-    .await
-    .expect("probe must complete within 3s")
-    .expect("probe must succeed");
-
-    assert_eq!(
-        observed.ip().to_string(),
-        "127.0.0.1",
-        "loopback test should see 127.0.0.1"
-    );
-    assert_ne!(observed.port(), 0, "observed port must be non-zero");
-    // Latency on same host is dominated by the handshake — generously
-    // allow up to 2s (the timeout) rather than picking a tight number
-    // that would be flaky on busy CI runners.
-    assert!(latency_ms < 2000, "latency {latency_ms}ms too high");
-}
-
-// -----------------------------------------------------------------------
-// Test 2: two loopback relays → probes succeed, classification is Unknown
-// -----------------------------------------------------------------------
-//
-// With the private-IP filter added in the NAT classifier, loopback
-// reflex addrs (127.0.0.1) are dropped before classification —
-// they can't possibly indicate public-internet NAT state. So the
-// test now asserts:
-//   - both probes succeed end-to-end (wire plumbing works)
-//   - both return 127.0.0.1 (same-host is visible)
-//   - the aggregated verdict is Unknown (no public probes)
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn detect_nat_type_two_loopback_relays_probes_work_but_classify_unknown() {
-    let (addr_a, _h_a) = spawn_mock_relay().await;
-    let (addr_b, _h_b) = spawn_mock_relay().await;
-
-    let detection = detect_nat_type(
-        vec![
-            ("RelayA".into(), addr_a),
-            ("RelayB".into(), addr_b),
-        ],
-        2000,
-        None,
-    )
-    .await;
-
-    assert_eq!(detection.probes.len(), 2);
-    for p in &detection.probes {
-        assert!(
-            p.observed_addr.is_some(),
-            "probe {:?} failed: {:?}",
-            p.relay_name,
-            p.error
-        );
-    }
-    let observed_ips: Vec<String> = detection
-        .probes
-        .iter()
-        .map(|p| {
-            p.observed_addr
-                .as_ref()
-                .and_then(|s| s.parse::<SocketAddr>().ok())
-                .map(|a| a.ip().to_string())
-                .unwrap_or_default()
-        })
-        .collect();
-    assert_eq!(observed_ips[0], "127.0.0.1");
-    assert_eq!(observed_ips[1], "127.0.0.1");
-
-    // Classification: loopback probes are filtered out of the
-    // public-NAT classifier, so with 0 public probes the result
-    // is Unknown.
-    assert_eq!(
-        detection.nat_type,
-        NatType::Unknown,
-        "loopback-only probes must not contribute to public NAT classification"
-    );
-    assert!(detection.consensus_addr.is_none());
-}
-
-// -----------------------------------------------------------------------
-// Test 3: one alive relay + one dead address → Unknown
-// -----------------------------------------------------------------------
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn detect_nat_type_dead_relay_is_unknown() {
-    let (alive_addr, _alive_handle) = spawn_mock_relay().await;
-
-    // Dead relay: a port that nothing is listening on. OS will drop
-    // the packets, the probe should time out within the 600ms budget
-    // we give it. Pick a port unlikely to be in use — port 1 on
-    // loopback works on every OS I care about and fails fast.
-    let dead_addr: SocketAddr = "127.0.0.1:1".parse().unwrap();
-
-    let detection = detect_nat_type(
-        vec![
-            ("Alive".into(), alive_addr),
-            ("Dead".into(), dead_addr),
-        ],
-        600, // tight timeout so the dead probe fails fast
-        None,
-    )
-    .await;
-
-    assert_eq!(detection.probes.len(), 2);
-
-    // Find the alive and dead probes by name (order of JoinSet
-    // completions is not guaranteed).
-    let alive = detection.probes.iter().find(|p| p.relay_name == "Alive").unwrap();
-    let dead = detection.probes.iter().find(|p| p.relay_name == "Dead").unwrap();
-
-    assert!(
-        alive.observed_addr.is_some(),
-        "alive probe must succeed: {:?}",
-        alive.error
-    );
-    assert!(
-        dead.observed_addr.is_none(),
-        "dead probe must fail, got addr {:?}",
-        dead.observed_addr
-    );
-    assert!(
-        dead.error.is_some(),
-        "dead probe must surface an error string"
-    );
-
-    // With only 1 successful probe, the classifier returns Unknown.
-    assert_eq!(detection.nat_type, NatType::Unknown);
-    assert!(detection.consensus_addr.is_none());
-}

crates/wzp-relay/tests/reflect.rs

@@ -1,318 +0,0 @@
-//! Integration tests for the "STUN for QUIC" reflect protocol
-//! (PRD: .taskmaster/docs/prd_reflect_over_quic.txt, Phase 1).
-//!
-//! We don't spin up the full relay binary — instead we exercise the
-//! same wire-level request/response dance with a mock relay loop
-//! that implements exactly the match arm added to
-//! `wzp-relay/src/main.rs`. This isolates the protocol test from the
-//! rest of the relay state (rooms, federation, call registry, ...).
-//!
-//! Three test cases:
-//!  1. `reflect_happy_path` — client sends `Reflect`, mock relay
-//!     replies with `ReflectResponse { observed_addr }`, client
-//!     parses it back to a `SocketAddr` and confirms the IP is
-//!     `127.0.0.1` and the port matches its own bound port.
-//!  2. `reflect_two_clients_distinct_ports` — two simultaneous
-//!     client connections on different ephemeral ports get back
-//!     different reflected ports, proving the relay uses
-//!     per-connection `remote_address` rather than a global.
-//!  3. `reflect_old_relay_times_out` — mock relay that *doesn't*
-//!     handle `Reflect`; client side times out in the expected
-//!     window and does not hang.
-//!
-//! The third test uses a `tokio::time::timeout` wrapper directly
-//! (the client-side `request_reflect` helper lives in
-//! `desktop/src-tauri/src/lib.rs` which isn't a library we can
-//! depend on from here, so we reproduce the timeout semantics
-//! inline).
-
-use std::net::{Ipv4Addr, SocketAddr};
-use std::sync::Arc;
-use std::time::Duration;
-
-use wzp_proto::{MediaTransport, SignalMessage};
-use wzp_transport::{client_config, create_endpoint, server_config, QuinnTransport};
-
-/// Spawn a minimal mock relay that loops over `recv_signal`,
-/// matches on `Reflect`, and responds with `ReflectResponse` using
-/// the remote_address observed for this connection. Mirrors the
-/// match arm in `crates/wzp-relay/src/main.rs`.
-async fn spawn_mock_relay_with_reflect(
-    server_transport: Arc<QuinnTransport>,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
-        // Observed remote address at the time the connection was
-        // accepted. Stable for the life of the connection under quinn's
-        // normal operation. This is exactly what the real relay does.
-        let observed = server_transport.connection().remote_address();
-        loop {
-            match server_transport.recv_signal().await {
-                Ok(Some(SignalMessage::Reflect)) => {
-                    let resp = SignalMessage::ReflectResponse {
-                        observed_addr: observed.to_string(),
-                    };
-                    // If the send fails the client has gone; just exit.
-                    if server_transport.send_signal(&resp).await.is_err() {
-                        break;
-                    }
-                }
-                Ok(Some(_other)) => {
-                    // Ignore anything else — not relevant to this test.
-                }
-                Ok(None) => break,
-                Err(_e) => break,
-            }
-        }
-    })
-}
-
-/// Spawn a mock relay that intentionally DOES NOT handle Reflect.
-/// Models a pre-Phase-1 relay — it keeps reading signal messages and
-/// logs them to stderr, but never produces a `ReflectResponse`.
-async fn spawn_mock_relay_without_reflect(
-    server_transport: Arc<QuinnTransport>,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
-        loop {
-            match server_transport.recv_signal().await {
-                Ok(Some(_msg)) => {
-                    // Deliberately do nothing. Old relay.
-                }
-                Ok(None) => break,
-                Err(_) => break,
-            }
-        }
-    })
-}
-
-/// Build an in-process QUIC client/server pair on loopback and
-/// return (client_transport, server_transport, endpoints). The
-/// endpoints tuple must be kept alive for the test duration.
-///
-/// `client_port_hint` of 0 means "let OS pick". Pass an explicit
-/// port to pin the client's source port (useful for the
-/// distinct-ports test).
-async fn connected_pair_with_port(
-    _client_port_hint: u16,
-) -> (Arc<QuinnTransport>, Arc<QuinnTransport>, (quinn::Endpoint, quinn::Endpoint)) {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
-    let (sc, _cert_der) = server_config();
-    let server_addr: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let server_ep = create_endpoint(server_addr, Some(sc)).expect("server endpoint");
-    let server_listen = server_ep.local_addr().expect("server local addr");
-
-    // Always bind the client to an ephemeral port — we'll read back
-    // the actual assigned port via `local_addr()` in the assertions.
-    let client_bind: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let client_ep = create_endpoint(client_bind, None).expect("client endpoint");
-
-    let server_ep_clone = server_ep.clone();
-    let accept_fut = tokio::spawn(async move {
-        let conn = wzp_transport::accept(&server_ep_clone).await.expect("accept");
-        Arc::new(QuinnTransport::new(conn))
-    });
-
-    let client_conn =
-        wzp_transport::connect(&client_ep, server_listen, "localhost", client_config())
-            .await
-            .expect("connect");
-    let client_transport = Arc::new(QuinnTransport::new(client_conn));
-    let server_transport = accept_fut.await.expect("join accept task");
-
-    (client_transport, server_transport, (server_ep, client_ep))
-}
-
-// -----------------------------------------------------------------------
-// Test 1: happy path — client learns its own port via Reflect
-// -----------------------------------------------------------------------
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn reflect_happy_path() {
-    let (client_transport, server_transport, (_server_ep, client_ep)) =
-        connected_pair_with_port(0).await;
-
-    // Grab the client's actual bound port so we can cross-check
-    // against the reflected response.
-    let client_port = client_ep
-        .local_addr()
-        .expect("client local addr")
-        .port();
-    assert_ne!(client_port, 0, "client must have a real bound port");
-
-    // Start the mock relay's reflect handler.
-    let _relay_handle = spawn_mock_relay_with_reflect(Arc::clone(&server_transport)).await;
-
-    // Client sends Reflect and awaits the response. The real
-    // request_reflect helper in desktop/src-tauri/src/lib.rs uses a
-    // oneshot channel driven off the spawned recv loop; here we just
-    // do it inline because there's no spawned loop yet in this test
-    // — this isolates the wire protocol from the client-side state
-    // machine.
-    client_transport
-        .send_signal(&SignalMessage::Reflect)
-        .await
-        .expect("send Reflect");
-
-    let resp = tokio::time::timeout(Duration::from_secs(2), client_transport.recv_signal())
-        .await
-        .expect("reflect response should arrive within 2s")
-        .expect("recv_signal ok")
-        .expect("some message");
-
-    let observed_addr = match resp {
-        SignalMessage::ReflectResponse { observed_addr } => observed_addr,
-        other => panic!("expected ReflectResponse, got {:?}", std::mem::discriminant(&other)),
-    };
-
-    let parsed: SocketAddr = observed_addr
-        .parse()
-        .expect("ReflectResponse.observed_addr must parse as SocketAddr");
-
-    // The relay should see the client on 127.0.0.1 (loopback in the
-    // test harness) and on the client's bound ephemeral port.
-    assert_eq!(parsed.ip().to_string(), "127.0.0.1");
-    assert_eq!(
-        parsed.port(),
-        client_port,
-        "reflected port must match the client's local_addr port"
-    );
-
-    drop(client_transport);
-    drop(server_transport);
-}
-
-// -----------------------------------------------------------------------
-// Test 2: two clients get DIFFERENT reflected ports
-// -----------------------------------------------------------------------
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn reflect_two_clients_distinct_ports() {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
-    // Shared server: one endpoint, two incoming accepts.
-    let (sc, _cert_der) = server_config();
-    let server_addr: SocketAddr = (Ipv4Addr::LOCALHOST, 0).into();
-    let server_ep = create_endpoint(server_addr, Some(sc)).expect("server endpoint");
-    let server_listen = server_ep.local_addr().expect("server local addr");
-
-    // Accept two clients in parallel.
-    let server_ep_a = server_ep.clone();
-    let accept_a = tokio::spawn(async move {
-        let conn = wzp_transport::accept(&server_ep_a).await.expect("accept A");
-        Arc::new(QuinnTransport::new(conn))
-    });
-    let server_ep_b = server_ep.clone();
-    let accept_b = tokio::spawn(async move {
-        let conn = wzp_transport::accept(&server_ep_b).await.expect("accept B");
-        Arc::new(QuinnTransport::new(conn))
-    });
-
-    // Client A
-    let client_ep_a = create_endpoint((Ipv4Addr::LOCALHOST, 0).into(), None).expect("ep A");
-    let conn_a =
-        wzp_transport::connect(&client_ep_a, server_listen, "localhost", client_config())
-            .await
-            .expect("connect A");
-    let client_a = Arc::new(QuinnTransport::new(conn_a));
-    let port_a = client_ep_a.local_addr().unwrap().port();
-
-    // Client B
-    let client_ep_b = create_endpoint((Ipv4Addr::LOCALHOST, 0).into(), None).expect("ep B");
-    let conn_b =
-        wzp_transport::connect(&client_ep_b, server_listen, "localhost", client_config())
-            .await
-            .expect("connect B");
-    let client_b = Arc::new(QuinnTransport::new(conn_b));
-    let port_b = client_ep_b.local_addr().unwrap().port();
-
-    assert_ne!(
-        port_a, port_b,
-        "preconditions: OS must assign two clients different ephemeral ports"
-    );
-
-    let server_a = accept_a.await.expect("join A");
-    let server_b = accept_b.await.expect("join B");
-
-    // Spawn a reflect handler for each server-side transport.
-    let _relay_a = spawn_mock_relay_with_reflect(Arc::clone(&server_a)).await;
-    let _relay_b = spawn_mock_relay_with_reflect(Arc::clone(&server_b)).await;
-
-    // Each client requests reflect concurrently.
-    let reflect_for = |t: Arc<QuinnTransport>| async move {
-        t.send_signal(&SignalMessage::Reflect).await.expect("send");
-        let resp = tokio::time::timeout(Duration::from_secs(2), t.recv_signal())
-            .await
-            .expect("timeout")
-            .expect("ok")
-            .expect("some");
-        match resp {
-            SignalMessage::ReflectResponse { observed_addr } => observed_addr,
-            _ => panic!("wrong variant"),
-        }
-    };
-
-    let (addr_a, addr_b) = tokio::join!(reflect_for(client_a.clone()), reflect_for(client_b.clone()));
-
-    let parsed_a: SocketAddr = addr_a.parse().unwrap();
-    let parsed_b: SocketAddr = addr_b.parse().unwrap();
-
-    assert_eq!(parsed_a.port(), port_a, "client A's reflected port");
-    assert_eq!(parsed_b.port(), port_b, "client B's reflected port");
-    assert_ne!(
-        parsed_a.port(),
-        parsed_b.port(),
-        "each client must see its own port, not a shared one"
-    );
-
-    drop(client_a);
-    drop(client_b);
-    drop(server_a);
-    drop(server_b);
-}
-
-// -----------------------------------------------------------------------
-// Test 3: old relay never answers — client times out cleanly
-// -----------------------------------------------------------------------
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn reflect_old_relay_times_out() {
-    let (client_transport, server_transport, _endpoints) =
-        connected_pair_with_port(0).await;
-
-    // Mock relay that ignores Reflect — simulates a pre-Phase-1 build.
-    let _relay_handle =
-        spawn_mock_relay_without_reflect(Arc::clone(&server_transport)).await;
-
-    client_transport
-        .send_signal(&SignalMessage::Reflect)
-        .await
-        .expect("send Reflect");
-
-    // 1100ms ceiling matches the 1s timeout baked into
-    // get_reflected_address plus a tiny bit of slack. If this
-    // regression ever fires it probably means recv_signal blocked
-    // longer than expected and the Tauri command would hang the UI.
-    let start = std::time::Instant::now();
-    let result =
-        tokio::time::timeout(Duration::from_millis(1100), client_transport.recv_signal()).await;
-    let elapsed = start.elapsed();
-
-    assert!(
-        result.is_err(),
-        "recv_signal must time out when the relay ignores Reflect"
-    );
-    assert!(
-        elapsed >= Duration::from_millis(1000),
-        "timeout fired too early ({:?})",
-        elapsed
-    );
-    assert!(
-        elapsed < Duration::from_millis(1200),
-        "timeout fired too late ({:?}), client would feel unresponsive",
-        elapsed
-    );
-
-    drop(client_transport);
-    drop(server_transport);
-}

crates/wzp-transport/Cargo.toml

@@ -15,7 +15,6 @@ tracing = { workspace = true }
 async-trait = { workspace = true }
 serde_json = "1"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
-socket2 = { workspace = true }
 rcgen = "0.13"
 ed25519-dalek = { workspace = true }
 hkdf = { workspace = true }

crates/wzp-transport/src/config.rs

@@ -123,6 +123,7 @@ fn transport_config() -> quinn::TransportConfig {
     config.keep_alive_interval(Some(Duration::from_secs(5)));
 
     // Enable DATAGRAM extension for unreliable media packets.
+    // Allow datagrams up to 1200 bytes (conservative for lossy links).
     config.datagram_receive_buffer_size(Some(65536));
 
     // Conservative flow control for bandwidth-constrained links
@@ -133,26 +134,6 @@ fn transport_config() -> quinn::TransportConfig {
     // Aggressive initial RTT estimate for high-latency links
     config.initial_rtt(Duration::from_millis(300));
 
-    // PMTUD (Path MTU Discovery) — quinn 0.11 enables this by default but
-    // with conservative bounds (initial 1200, upper 1452). We keep the safe
-    // initial_mtu of 1200 so the first packets always get through, but raise
-    // upper_bound so the binary search can discover larger MTUs on paths that
-    // support them. Typical results:
-    //   - Ethernet/fiber: discovers ~1452 (Ethernet MTU minus IP/UDP/QUIC)
-    //   - WireGuard/VPN: discovers ~1380-1420
-    //   - Starlink: discovers ~1400-1452
-    //   - Cellular: stays at 1200-1300
-    // Black hole detection automatically falls back to 1200 if probes fail.
-    // This matters for future video frames which can be 1-50 KB and benefit
-    // from fewer application-layer fragments per frame.
-    let mut mtu_config = quinn::MtuDiscoveryConfig::default();
-    mtu_config
-        .upper_bound(1452)
-        .interval(Duration::from_secs(300))       // re-probe every 5 min
-        .black_hole_cooldown(Duration::from_secs(30)); // retry faster on lossy links
-    config.mtu_discovery_config(Some(mtu_config));
-    config.initial_mtu(1200); // safe starting point
-
     config
 }
 

crates/wzp-transport/src/connection.rs

@@ -39,71 +39,6 @@ pub async fn connect(
     Ok(connection)
 }
 
-/// Create an IPv6-only QUIC endpoint with `IPV6_V6ONLY=1`.
-///
-/// Tries `[::]:preferred_port` first (same port as the IPv4 signal
-/// endpoint — allowed on Linux/Android when the AFs differ and
-/// V6ONLY is set). Falls back to `[::]:0` (OS-assigned) if the
-/// preferred port is already taken.
-///
-/// Must be called from within a tokio runtime (quinn needs the
-/// async runtime handle for its I/O driver).
-pub fn create_ipv6_endpoint(
-    preferred_port: u16,
-    server_config: Option<quinn::ServerConfig>,
-) -> Result<quinn::Endpoint, TransportError> {
-    use socket2::{Domain, Protocol, Socket, Type};
-    use std::net::{Ipv6Addr, SocketAddrV6};
-
-    let sock = Socket::new(Domain::IPV6, Type::DGRAM, Some(Protocol::UDP))
-        .map_err(|e| TransportError::Internal(format!("ipv6 socket: {e}")))?;
-
-    // Critical: IPv6-only so this socket never intercepts IPv4.
-    // On Android some kernels default to V6ONLY=1 anyway, but we
-    // set it explicitly for cross-platform consistency.
-    sock.set_only_v6(true)
-        .map_err(|e| TransportError::Internal(format!("set_only_v6: {e}")))?;
-
-    sock.set_reuse_address(true)
-        .map_err(|e| TransportError::Internal(format!("set_reuse_address: {e}")))?;
-
-    // Try the preferred port (same as IPv4 signal endpoint), fall
-    // back to ephemeral if the OS rejects it.
-    let bind_addr = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, preferred_port, 0, 0);
-    if let Err(e) = sock.bind(&bind_addr.into()) {
-        if preferred_port != 0 {
-            tracing::debug!(
-                preferred_port,
-                error = %e,
-                "ipv6 bind to preferred port failed, falling back to ephemeral"
-            );
-            let fallback = SocketAddrV6::new(Ipv6Addr::UNSPECIFIED, 0, 0, 0);
-            sock.bind(&fallback.into())
-                .map_err(|e| TransportError::Internal(format!("ipv6 bind fallback: {e}")))?;
-        } else {
-            return Err(TransportError::Internal(format!("ipv6 bind: {e}")));
-        }
-    }
-
-    sock.set_nonblocking(true)
-        .map_err(|e| TransportError::Internal(format!("set_nonblocking: {e}")))?;
-
-    let udp_socket: std::net::UdpSocket = sock.into();
-
-    let runtime = quinn::default_runtime()
-        .ok_or_else(|| TransportError::Internal("no async runtime for ipv6 endpoint".into()))?;
-
-    let endpoint = quinn::Endpoint::new(
-        quinn::EndpointConfig::default(),
-        server_config,
-        udp_socket,
-        runtime,
-    )
-    .map_err(|e| TransportError::Internal(format!("ipv6 endpoint: {e}")))?;
-
-    Ok(endpoint)
-}
-
 /// Accept the next incoming connection on an endpoint.
 pub async fn accept(endpoint: &quinn::Endpoint) -> Result<quinn::Connection, TransportError> {
     let incoming = endpoint

crates/wzp-transport/src/lib.rs

@@ -23,12 +23,7 @@ pub mod quic;
 pub mod reliable;
 
 pub use config::{client_config, server_config, server_config_from_seed, tls_fingerprint};
-pub use connection::{accept, connect, create_endpoint, create_ipv6_endpoint};
+pub use connection::{accept, connect, create_endpoint};
 pub use path_monitor::PathMonitor;
-pub use quic::{QuinnPathSnapshot, QuinnTransport};
+pub use quic::QuinnTransport;
 pub use wzp_proto::{MediaTransport, PathQuality, TransportError};
-
-// Re-export the quinn Endpoint type so downstream crates (wzp-desktop) can
-// thread a shared endpoint between signaling and media connections without
-// needing to depend on quinn directly.
-pub use quinn::Endpoint;

crates/wzp-transport/src/path_monitor.rs

@@ -2,17 +2,11 @@
 //!
 //! Tracks packet loss (via sequence number gaps), RTT, jitter, and bandwidth.
 
-use std::collections::VecDeque;
-
 use wzp_proto::PathQuality;
 
 /// EWMA smoothing factor.
 const ALPHA: f64 = 0.1;
 
-/// Maximum number of RTT samples in the jitter variance sliding window.
-/// At ~50 packets/sec (20 ms frame), 10 samples ≈ 200 ms.
-const JITTER_VARIANCE_WINDOW_SIZE: usize = 10;
-
 /// Monitors network path quality metrics.
 pub struct PathMonitor {
     /// EWMA-smoothed loss percentage (0.0 - 100.0).
@@ -37,8 +31,6 @@ pub struct PathMonitor {
     last_rtt_ms: Option<f64>,
     /// Whether we have any observations yet.
     initialized: bool,
-    /// Sliding window of recent RTT samples for variance calculation.
-    rtt_window: VecDeque<f64>,
 }
 
 impl PathMonitor {
@@ -59,7 +51,6 @@ impl PathMonitor {
             total_received: 0,
             last_rtt_ms: None,
             initialized: false,
-            rtt_window: VecDeque::with_capacity(JITTER_VARIANCE_WINDOW_SIZE),
         }
     }
 
@@ -131,12 +122,6 @@ impl PathMonitor {
         } else {
             self.rtt_ewma = ALPHA * rtt + (1.0 - ALPHA) * self.rtt_ewma;
         }
-
-        // Maintain sliding window for variance calculation
-        if self.rtt_window.len() >= JITTER_VARIANCE_WINDOW_SIZE {
-            self.rtt_window.pop_front();
-        }
-        self.rtt_window.push_back(rtt);
     }
 
     /// Get the current estimated path quality.
@@ -170,20 +155,6 @@ impl PathMonitor {
         0
     }
 
-    /// Compute the jitter (RTT standard deviation) over the sliding window.
-    ///
-    /// Returns the standard deviation in milliseconds, or 0.0 if insufficient
-    /// samples. Used by `DredTuner` for spike detection.
-    pub fn jitter_variance_ms(&self) -> f64 {
-        let n = self.rtt_window.len();
-        if n < 2 {
-            return 0.0;
-        }
-        let mean = self.rtt_window.iter().sum::<f64>() / n as f64;
-        let var = self.rtt_window.iter().map(|r| (r - mean).powi(2)).sum::<f64>() / n as f64;
-        var.sqrt()
-    }
-
     /// Detect whether a network handoff likely occurred.
     ///
     /// Returns `true` if the most recent RTT jitter measurement exceeds 3x

crates/wzp-transport/src/quic.rs

@@ -13,29 +13,6 @@ use crate::datagram;
 use crate::path_monitor::PathMonitor;
 use crate::reliable;
 
-/// Snapshot of quinn's QUIC-level path statistics.
-///
-/// Provides more accurate loss/RTT data than `PathMonitor`'s sequence-gap
-/// heuristic because quinn sees ACK frames and congestion signals directly.
-#[derive(Clone, Copy, Debug)]
-pub struct QuinnPathSnapshot {
-    /// Smoothed RTT in milliseconds (from quinn's congestion controller).
-    pub rtt_ms: u32,
-    /// Cumulative loss percentage (lost_packets / sent_packets × 100).
-    pub loss_pct: f32,
-    /// Total congestion events observed by the QUIC stack.
-    pub congestion_events: u64,
-    /// Current congestion window in bytes.
-    pub cwnd: u64,
-    /// Total packets sent on this path.
-    pub sent_packets: u64,
-    /// Total packets lost on this path.
-    pub lost_packets: u64,
-    /// Current PMTUD-discovered maximum datagram payload size (bytes).
-    /// Starts at `initial_mtu` (1200) and grows as PMTUD probes succeed.
-    pub current_mtu: usize,
-}
-
 /// QUIC-based transport implementing the `MediaTransport` trait.
 pub struct QuinnTransport {
     connection: quinn::Connection,
@@ -56,11 +33,6 @@ impl QuinnTransport {
         &self.connection
     }
 
-    /// Remote address of the peer on this connection.
-    pub fn remote_address(&self) -> std::net::SocketAddr {
-        self.connection.remote_address()
-    }
-
     /// Send raw bytes as a QUIC datagram (no MediaPacket framing).
     pub fn send_raw_datagram(&self, data: &[u8]) -> Result<(), TransportError> {
         self.connection
@@ -89,31 +61,6 @@ impl QuinnTransport {
         datagram::max_datagram_payload(&self.connection)
     }
 
-    /// Snapshot of QUIC-level path stats from quinn, useful for DRED tuning.
-    ///
-    /// Returns `(rtt_ms, loss_pct, congestion_events)` derived from quinn's
-    /// internal congestion controller — more accurate than our own sequence-gap
-    /// heuristic in `PathMonitor` because quinn sees ACK frames directly.
-    pub fn quinn_path_stats(&self) -> QuinnPathSnapshot {
-        let stats = self.connection.stats();
-        let rtt_ms = stats.path.rtt.as_millis() as u32;
-        let loss_pct = if stats.path.sent_packets > 0 {
-            (stats.path.lost_packets as f32 / stats.path.sent_packets as f32) * 100.0
-        } else {
-            0.0
-        };
-        let current_mtu = self.connection.max_datagram_size().unwrap_or(1200);
-        QuinnPathSnapshot {
-            rtt_ms,
-            loss_pct,
-            congestion_events: stats.path.congestion_events,
-            cwnd: stats.path.cwnd,
-            sent_packets: stats.path.sent_packets,
-            lost_packets: stats.path.lost_packets,
-            current_mtu,
-        }
-    }
-
     /// Send an encoded [`TrunkFrame`] as a single QUIC datagram.
     pub fn send_trunk(&self, frame: &TrunkFrame) -> Result<(), TransportError> {
         let data = frame.encode();

crates/wzp-transport/src/reliable.rs

@@ -53,13 +53,6 @@ pub async fn recv_signal(recv: &mut quinn::RecvStream) -> Result<SignalMessage,
         .await
         .map_err(|e| TransportError::Internal(format!("stream read payload error: {e}")))?;
 
-    serde_json::from_slice(&payload).map_err(|e| {
-        // Distinguish serde failures from transport failures so the
-        // caller (relay main loop, client recv loop) can continue on
-        // unknown-variant / parse errors instead of tearing down the
-        // whole signal connection. Forward-compat: adding a new
-        // `SignalMessage` variant in one side must not break the
-        // other side's signal connection.
-        TransportError::Deserialize(format!("{e}"))
-    })
+    serde_json::from_slice(&payload)
+        .map_err(|e| TransportError::Internal(format!("signal deserialize error: {e}")))
 }

crates/wzp-web/static/wasm/package.json

@@ -1,16 +0,0 @@
-{
-  "name": "wzp-wasm",
-  "type": "module",
-  "description": "WarzonePhone WASM bindings — FEC (RaptorQ) + crypto (ChaCha20-Poly1305, X25519)",
-  "version": "0.1.0",
-  "files": [
-    "wzp_wasm_bg.wasm",
-    "wzp_wasm.js",
-    "wzp_wasm.d.ts"
-  ],
-  "main": "wzp_wasm.js",
-  "types": "wzp_wasm.d.ts",
-  "sideEffects": [
-    "./snippets/*"
-  ]
-}

crates/wzp-web/static/wasm/wzp_wasm.d.ts

@@ -1,169 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-
-/**
- * Symmetric encryption session using ChaCha20-Poly1305.
- *
- * Mirrors `wzp-crypto::session::ChaChaSession` for WASM.  Nonce derivation
- * and key setup are identical so WASM and native peers interoperate.
- */
-export class WzpCryptoSession {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Decrypt a media payload with AAD.
-     *
-     * Returns plaintext on success, or throws on auth failure.
-     */
-    decrypt(header_aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
-    /**
-     * Encrypt a media payload with AAD (typically the 12-byte MediaHeader).
-     *
-     * Returns `ciphertext || poly1305_tag` (plaintext.len() + 16 bytes).
-     */
-    encrypt(header_aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
-    /**
-     * Create from a 32-byte shared secret (output of `WzpKeyExchange.derive_shared_secret`).
-     */
-    constructor(shared_secret: Uint8Array);
-    /**
-     * Current receive sequence number (for diagnostics / UI stats).
-     */
-    recv_seq(): number;
-    /**
-     * Current send sequence number (for diagnostics / UI stats).
-     */
-    send_seq(): number;
-}
-
-export class WzpFecDecoder {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Feed a received symbol.
-     *
-     * Returns the decoded block (concatenated original frames, unpadded) if
-     * enough symbols have been received to recover the block, or `undefined`.
-     */
-    add_symbol(block_id: number, symbol_idx: number, _is_repair: boolean, data: Uint8Array): Uint8Array | undefined;
-    /**
-     * Create a new FEC decoder.
-     *
-     * * `block_size` — expected number of source symbols per block.
-     * * `symbol_size` — padded byte size of each symbol (must match encoder).
-     */
-    constructor(block_size: number, symbol_size: number);
-}
-
-export class WzpFecEncoder {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Add a source symbol (audio frame).
-     *
-     * Returns encoded packets (all source + repair) when the block is complete,
-     * or `undefined` if the block is still accumulating.
-     *
-     * Each returned packet carries the 3-byte header:
-     *   `[block_id][symbol_idx][is_repair]` followed by `symbol_size` bytes.
-     */
-    add_symbol(data: Uint8Array): Uint8Array | undefined;
-    /**
-     * Force-flush the current (possibly partial) block.
-     *
-     * Returns all source + repair symbols with headers, or empty vec if no
-     * symbols have been accumulated.
-     */
-    flush(): Uint8Array;
-    /**
-     * Create a new FEC encoder.
-     *
-     * * `block_size` — number of source symbols (audio frames) per FEC block.
-     * * `symbol_size` — padded byte size of each symbol (default 256).
-     */
-    constructor(block_size: number, symbol_size: number);
-}
-
-/**
- * X25519 key exchange: generate ephemeral keypair and derive shared secret.
- *
- * Usage from JS:
- * ```js
- * const kx = new WzpKeyExchange();
- * const ourPub = kx.public_key();         // Uint8Array(32)
- * // ... send ourPub to peer, receive peerPub ...
- * const secret = kx.derive_shared_secret(peerPub); // Uint8Array(32)
- * const session = new WzpCryptoSession(secret);
- * ```
- */
-export class WzpKeyExchange {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Derive a 32-byte session key from the peer's public key.
-     *
-     * Raw DH output is expanded via HKDF-SHA256 with info="warzone-session-key",
-     * matching `wzp-crypto::handshake::WarzoneKeyExchange::derive_session`.
-     */
-    derive_shared_secret(peer_public: Uint8Array): Uint8Array;
-    /**
-     * Generate a new random X25519 keypair.
-     */
-    constructor();
-    /**
-     * Our public key (32 bytes).
-     */
-    public_key(): Uint8Array;
-}
-
-export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
-
-export interface InitOutput {
-    readonly memory: WebAssembly.Memory;
-    readonly __wbg_wzpcryptosession_free: (a: number, b: number) => void;
-    readonly __wbg_wzpfecdecoder_free: (a: number, b: number) => void;
-    readonly __wbg_wzpfecencoder_free: (a: number, b: number) => void;
-    readonly __wbg_wzpkeyexchange_free: (a: number, b: number) => void;
-    readonly wzpcryptosession_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-    readonly wzpcryptosession_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-    readonly wzpcryptosession_new: (a: number, b: number) => [number, number, number];
-    readonly wzpcryptosession_recv_seq: (a: number) => number;
-    readonly wzpcryptosession_send_seq: (a: number) => number;
-    readonly wzpfecdecoder_add_symbol: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
-    readonly wzpfecdecoder_new: (a: number, b: number) => number;
-    readonly wzpfecencoder_add_symbol: (a: number, b: number, c: number) => [number, number];
-    readonly wzpfecencoder_flush: (a: number) => [number, number];
-    readonly wzpfecencoder_new: (a: number, b: number) => number;
-    readonly wzpkeyexchange_derive_shared_secret: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly wzpkeyexchange_new: () => number;
-    readonly wzpkeyexchange_public_key: (a: number) => [number, number];
-    readonly __wbindgen_exn_store: (a: number) => void;
-    readonly __externref_table_alloc: () => number;
-    readonly __wbindgen_externrefs: WebAssembly.Table;
-    readonly __wbindgen_malloc: (a: number, b: number) => number;
-    readonly __externref_table_dealloc: (a: number) => void;
-    readonly __wbindgen_free: (a: number, b: number, c: number) => void;
-    readonly __wbindgen_start: () => void;
-}
-
-export type SyncInitInput = BufferSource | WebAssembly.Module;
-
-/**
- * Instantiates the given `module`, which can either be bytes or
- * a precompiled `WebAssembly.Module`.
- *
- * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
- *
- * @returns {InitOutput}
- */
-export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
-
-/**
- * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
- * for everything else, calls `WebAssembly.instantiate` directly.
- *
- * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
- *
- * @returns {Promise<InitOutput>}
- */
-export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;

crates/wzp-web/static/wasm/wzp_wasm_bg.wasm.d.ts

@@ -1,27 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-export const memory: WebAssembly.Memory;
-export const __wbg_wzpcryptosession_free: (a: number, b: number) => void;
-export const __wbg_wzpfecdecoder_free: (a: number, b: number) => void;
-export const __wbg_wzpfecencoder_free: (a: number, b: number) => void;
-export const __wbg_wzpkeyexchange_free: (a: number, b: number) => void;
-export const wzpcryptosession_decrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-export const wzpcryptosession_encrypt: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
-export const wzpcryptosession_new: (a: number, b: number) => [number, number, number];
-export const wzpcryptosession_recv_seq: (a: number) => number;
-export const wzpcryptosession_send_seq: (a: number) => number;
-export const wzpfecdecoder_add_symbol: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
-export const wzpfecdecoder_new: (a: number, b: number) => number;
-export const wzpfecencoder_add_symbol: (a: number, b: number, c: number) => [number, number];
-export const wzpfecencoder_flush: (a: number) => [number, number];
-export const wzpfecencoder_new: (a: number, b: number) => number;
-export const wzpkeyexchange_derive_shared_secret: (a: number, b: number, c: number) => [number, number, number, number];
-export const wzpkeyexchange_new: () => number;
-export const wzpkeyexchange_public_key: (a: number) => [number, number];
-export const __wbindgen_exn_store: (a: number) => void;
-export const __externref_table_alloc: () => number;
-export const __wbindgen_externrefs: WebAssembly.Table;
-export const __wbindgen_malloc: (a: number, b: number) => number;
-export const __externref_table_dealloc: (a: number) => void;
-export const __wbindgen_free: (a: number, b: number, c: number) => void;
-export const __wbindgen_start: () => void;

desktop/.gitignore

@@ -1,2 +0,0 @@
-node_modules/
-dist/

desktop/.vite/deps/_metadata.json

@@ -1,8 +0,0 @@
-{
-  "hash": "9046c0bf",
-  "configHash": "ef0fc96f",
-  "lockfileHash": "d66891b1",
-  "browserHash": "8171ed59",
-  "optimized": {},
-  "chunks": {}
-}

desktop/.vite/deps/package.json

@@ -1,3 +0,0 @@
-{
-  "type": "module"
-}

desktop/index.html

@@ -1,291 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta
-      name="viewport"
-      content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no, viewport-fit=cover"
-    />
-    <title>WarzonePhone</title>
-    <link rel="stylesheet" href="/src/style.css" />
-  </head>
-  <body>
-    <div id="app">
-      <!-- Connect screen -->
-      <div id="connect-screen">
-        <h1>WarzonePhone</h1>
-        <p class="subtitle">Encrypted Voice</p>
-        <div class="form">
-          <label>Relay
-            <button id="relay-selected" class="relay-selected" type="button">
-              <span id="relay-dot" class="dot"></span>
-              <span id="relay-label">Select relay...</span>
-              <span class="arrow">&#9881;</span>
-            </button>
-          </label>
-          <label>Room
-            <input id="room" type="text" value="general" />
-          </label>
-          <label>Alias
-            <input id="alias" type="text" placeholder="your name" />
-          </label>
-          <div class="form-row">
-            <label class="checkbox">
-              <input id="os-aec" type="checkbox" checked />
-              OS Echo Cancel
-            </label>
-            <button id="settings-btn-home" class="icon-btn" title="Settings (Cmd+,)">&#9881;</button>
-          </div>
-          <!-- Mode toggle -->
-          <div class="mode-toggle" style="display:flex;gap:8px;margin-bottom:8px;">
-            <button id="mode-room" class="mode-btn active" style="flex:1">Room</button>
-            <button id="mode-direct" class="mode-btn" style="flex:1">Direct Call</button>
-          </div>
-
-          <!-- Room mode (default) -->
-          <div id="room-mode">
-            <button id="connect-btn" class="primary">Connect</button>
-          </div>
-
-          <!-- Direct call mode -->
-          <div id="direct-mode" class="hidden">
-            <button id="register-btn" class="primary" style="background:#2196F3">Register on Relay</button>
-            <div id="direct-registered" class="hidden" style="margin-top:12px">
-              <div class="direct-registered-header">
-                <p id="registered-status" style="color:var(--green);font-size:13px;margin:0">&#x2705; Registered — waiting for calls</p>
-                <button id="deregister-btn" class="secondary-btn small">Deregister</button>
-              </div>
-              <div id="incoming-call-panel" class="hidden" style="background:#1B5E20;padding:12px;border-radius:8px;margin:8px 0">
-                <p style="font-weight:bold;margin:0 0 4px 0">Incoming Call</p>
-                <p id="incoming-caller" style="font-size:12px;opacity:0.8;margin:0 0 8px 0">From: unknown</p>
-                <div style="display:flex;gap:8px">
-                  <button id="accept-call-btn" style="flex:1;background:var(--green);color:white;border:none;padding:8px;border-radius:6px;cursor:pointer">Accept</button>
-                  <button id="reject-call-btn" style="flex:1;background:var(--red);color:white;border:none;padding:8px;border-radius:6px;cursor:pointer">Reject</button>
-                </div>
-              </div>
-
-              <!-- Recent contacts -->
-              <div id="recent-contacts-section" class="hidden">
-                <div class="history-header">Recent contacts</div>
-                <div id="recent-contacts-list" class="history-list"></div>
-              </div>
-
-              <!-- Call history -->
-              <div id="call-history-section" class="hidden">
-                <div class="history-header">
-                  History
-                  <button id="clear-history-btn" class="link-btn">clear</button>
-                </div>
-                <div id="call-history-list" class="history-list"></div>
-              </div>
-
-              <label style="margin-top:8px">Call by fingerprint
-                <input id="target-fp" type="text" placeholder="xxxx:xxxx:xxxx:..." />
-              </label>
-              <button id="call-btn" class="primary" style="margin-top:8px">Call</button>
-              <p id="call-status-text" style="color:var(--yellow);font-size:13px;margin-top:4px"></p>
-            </div>
-          </div>
-
-          <p id="connect-error" class="error"></p>
-        </div>
-        <div class="identity-info">
-          <span id="my-identicon"></span>
-          <span id="my-fingerprint" class="fp-display"></span>
-        </div>
-        <div class="recent-rooms" id="recent-rooms"></div>
-      </div>
-
-      <!-- In-call screen -->
-      <div id="call-screen" class="hidden">
-        <div class="call-header">
-          <div class="call-header-row">
-            <div id="room-name" class="room-name"></div>
-            <button id="settings-btn-call" class="icon-btn small" title="Settings (Cmd+,)">&#9881;</button>
-          </div>
-          <div class="call-meta">
-            <span id="call-status" class="status-dot"></span>
-            <span id="call-timer" class="call-timer">0:00</span>
-          </div>
-        </div>
-        <div class="level-meter">
-          <div id="level-bar" class="level-bar-fill"></div>
-        </div>
-        <!-- Direct-call phone layout — shown instead of the group
-             participant list when directCallPeer is set. Centered
-             identicon, name, fp, connection badge. Hidden for
-             room calls (directCallPeer == null). -->
-        <div id="direct-call-view" class="direct-call-view hidden">
-          <div id="dc-identicon" class="dc-identicon"></div>
-          <div id="dc-name" class="dc-name">Unknown</div>
-          <div id="dc-fp" class="dc-fp"></div>
-          <div id="dc-badge" class="dc-badge">Connecting...</div>
-        </div>
-        <div id="participants" class="participants"></div>
-        <div class="controls">
-          <button id="mic-btn" class="control-btn" title="Toggle Mic (m)">
-            <span class="icon" id="mic-icon">Mic</span>
-          </button>
-          <button id="hangup-btn" class="control-btn hangup" title="Hang Up (q)">
-            <span class="icon">End</span>
-          </button>
-          <button id="spk-btn" class="control-btn" title="Toggle Speaker (s)">
-            <span class="icon" id="spk-icon">Spk</span>
-          </button>
-        </div>
-        <div id="stats" class="stats"></div>
-      </div>
-
-      <!-- Settings panel -->
-      <div id="settings-panel" class="hidden">
-        <div class="settings-card">
-          <div class="settings-header">
-            <h2>Settings</h2>
-            <button id="settings-close" class="icon-btn">&times;</button>
-          </div>
-          <div class="settings-section">
-            <h3>Connection</h3>
-            <label>Default Room
-              <input id="s-room" type="text" />
-            </label>
-            <label>Alias
-              <input id="s-alias" type="text" />
-            </label>
-          </div>
-          <div class="settings-section">
-            <h3>Audio</h3>
-            <div class="quality-control">
-              <div class="quality-header">
-                <span class="setting-label">QUALITY</span>
-                <span id="s-quality-label" class="quality-label">Auto</span>
-              </div>
-              <input id="s-quality" type="range" min="0" max="7" step="1" value="3" class="quality-slider" />
-              <div class="quality-ticks">
-                <span>64k</span>
-                <span>48k</span>
-                <span>32k</span>
-                <span>Auto</span>
-                <span>24k</span>
-                <span>6k</span>
-                <span>C2</span>
-                <span>1.2k</span>
-              </div>
-            </div>
-            <label class="checkbox">
-              <input id="s-os-aec" type="checkbox" />
-              OS Echo Cancellation (macOS VoiceProcessingIO)
-            </label>
-            <label class="checkbox">
-              <input id="s-agc" type="checkbox" checked />
-              Automatic Gain Control
-            </label>
-            <label class="checkbox">
-              <input id="s-dred-debug" type="checkbox" />
-              DRED debug logs (verbose, dev only)
-            </label>
-            <label class="checkbox">
-              <input id="s-call-debug" type="checkbox" />
-              Call flow debug logs (trace every step of a call)
-            </label>
-          </div>
-          <div class="settings-section" id="s-call-debug-section" style="display:none">
-            <h3>Call Debug Log</h3>
-            <div id="s-call-debug-log" style="max-height:220px;overflow-y:auto;background:#0a0a0a;color:#e0e0e0;font-family:ui-monospace,Menlo,Monaco,'Courier New',monospace;font-size:10px;padding:6px;border-radius:4px;line-height:1.4;white-space:pre-wrap"></div>
-            <div style="display:flex;gap:6px;margin-top:6px">
-              <button id="s-call-debug-copy" class="secondary-btn" style="flex:1">Copy log</button>
-              <button id="s-call-debug-share" class="secondary-btn" style="flex:1">Share</button>
-              <button id="s-call-debug-clear" class="secondary-btn" style="flex:1">Clear log</button>
-            </div>
-            <small id="s-call-debug-copy-status" style="display:block;margin-top:4px;color:var(--text-dim);font-size:10px"></small>
-            <small style="color:var(--text-dim);display:block;margin-top:4px">
-              Rolling buffer of the last 200 call-flow events. Turned off by
-              default — the GUI overlay only populates when the checkbox above
-              is on, but logcat (adb) always keeps a copy regardless.
-            </small>
-          </div>
-          <div class="settings-section">
-            <h3>Identity</h3>
-            <div class="setting-row">
-              <span class="setting-label">Fingerprint</span>
-              <span id="s-fingerprint" class="fp-display-large"></span>
-            </div>
-            <div class="setting-row">
-              <span class="setting-label">Identity file</span>
-              <span class="fp-display">~/.wzp/identity</span>
-            </div>
-          </div>
-          <div class="settings-section">
-            <h3>Network</h3>
-            <div class="setting-row">
-              <span class="setting-label">Public address</span>
-              <span id="s-reflected-addr" class="fp-display">(not queried)</span>
-              <button id="s-reflect-btn" class="secondary-btn">Detect</button>
-            </div>
-            <small style="color:var(--text-dim);display:block;margin-top:4px">
-              Asks the registered relay to echo back the IP:port it sees for this
-              connection (QUIC-native NAT reflection, replaces STUN).
-            </small>
-            <div class="setting-row" style="margin-top:10px">
-              <span class="setting-label">NAT type</span>
-              <span id="s-nat-type" class="fp-display">(not detected)</span>
-              <button id="s-nat-detect-btn" class="secondary-btn">Detect NAT</button>
-            </div>
-            <div id="s-nat-probes" style="margin-top:6px;font-size:11px;color:var(--text-dim)"></div>
-            <small style="color:var(--text-dim);display:block;margin-top:4px">
-              Probes every configured relay in parallel and compares the results
-              to classify the NAT: cone (P2P viable), symmetric (must relay),
-              multiple, or unknown.
-            </small>
-          </div>
-          <div class="settings-section">
-            <h3>Recent Rooms</h3>
-            <div id="s-recent-rooms" class="recent-rooms-list"></div>
-            <button id="s-clear-recent" class="secondary-btn">Clear History</button>
-          </div>
-          <button id="settings-save" class="primary">Save</button>
-        </div>
-      </div>
-
-      <!-- Manage Relays dialog -->
-      <div id="relay-dialog" class="hidden">
-        <div class="settings-card relay-dialog-card">
-          <div class="settings-header">
-            <h2>Manage Relays</h2>
-            <button id="relay-dialog-close" class="icon-btn">&times;</button>
-          </div>
-          <div id="relay-dialog-list" class="relay-dialog-list"></div>
-          <div class="relay-add-row">
-            <div class="relay-add-inputs">
-              <input id="relay-add-name" type="text" placeholder="Name" />
-              <input id="relay-add-addr" type="text" placeholder="host:port" />
-            </div>
-            <button id="relay-add-btn" class="primary">Add Relay</button>
-          </div>
-        </div>
-      </div>
-      <!-- Key changed warning dialog -->
-      <div id="key-warning" class="hidden">
-        <div class="settings-card key-warning-card">
-          <div class="key-warning-icon">&#9888;</div>
-          <h2>Server Key Changed</h2>
-          <p class="key-warning-text">The relay's identity has changed since you last connected. This usually happens when the server was restarted, but could also indicate a security issue.</p>
-          <div class="key-warning-fps">
-            <div class="key-fp-row">
-              <span class="key-fp-label">Previously known</span>
-              <code id="kw-old-fp" class="key-fp"></code>
-            </div>
-            <div class="key-fp-row">
-              <span class="key-fp-label">New key</span>
-              <code id="kw-new-fp" class="key-fp"></code>
-            </div>
-          </div>
-          <div class="key-warning-actions">
-            <button id="kw-accept" class="primary">Accept New Key</button>
-            <button id="kw-cancel" class="secondary-btn">Cancel</button>
-          </div>
-        </div>
-      </div>
-    </div>
-    <script type="module" src="/src/main.ts"></script>
-  </body>
-</html>

desktop/package.json

@@ -1,19 +0,0 @@
-{
-  "name": "wzp-desktop",
-  "private": true,
-  "version": "0.1.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "tauri": "tauri"
-  },
-  "dependencies": {
-    "@tauri-apps/api": "^2"
-  },
-  "devDependencies": {
-    "typescript": "^5",
-    "vite": "^6",
-    "@tauri-apps/cli": "^2"
-  }
-}

desktop/src-tauri/Cargo.toml

@@ -1,108 +0,0 @@
-[package]
-name = "wzp-desktop"
-version = "0.1.0"
-edition = "2024"
-description = "WarzonePhone Desktop — encrypted VoIP client"
-default-run = "wzp-desktop"
-
-# Library target — required for Tauri mobile (Android/iOS link the app as a cdylib)
-# and also used by the desktop binary below.
-#
-# `staticlib` was DROPPED from crate-type because rust-lang/rust#104707
-# documents that having staticlib alongside cdylib leaks non-exported
-# symbols from staticlibs into the cdylib. Bionic's private `__init_tcb`
-# / `pthread_create` symbols end up bound LOCALLY inside our .so instead
-# of resolved dynamically against libc.so at dlopen time — which crashes
-# at launch as soon as tao tries to std::thread::spawn() from the JNI
-# onCreate callback. The legacy wzp-android crate uses ["cdylib", "rlib"]
-# and runs fine on the same phone with the same NDK + Rust toolchain.
-#
-# iOS Tauri builds that actually need staticlib can re-add it behind a
-# target cfg if we ever ship on iOS.
-[lib]
-name = "wzp_desktop_lib"
-crate-type = ["cdylib", "rlib"]
-
-[[bin]]
-name = "wzp-desktop"
-path = "src/main.rs"
-
-[build-dependencies]
-tauri-build = { version = "2", features = [] }
-# cc is no longer needed — all C++ moved to crates/wzp-native (built with
-# cargo-ndk and loaded via libloading at runtime). wzp-desktop's .so on
-# Android is now pure Rust.
-
-[dependencies]
-tauri = { version = "2", features = [] }
-tauri-plugin-shell = "2"
-tauri-plugin-notification = "2"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-tokio = { version = "1", features = ["full"] }
-tracing = "0.1"
-tracing-subscriber = "0.3"
-anyhow = "1"
-rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
-
-# WarzonePhone crates — protocol layer is platform-independent
-wzp-proto = { path = "../../crates/wzp-proto" }
-wzp-codec = { path = "../../crates/wzp-codec" }
-wzp-fec = { path = "../../crates/wzp-fec" }
-wzp-crypto = { path = "../../crates/wzp-crypto" }
-wzp-transport = { path = "../../crates/wzp-transport" }
-
-# wzp-client pulls in CPAL on every desktop target and, additionally on
-# macOS, VoiceProcessingIO (coreaudio-rs behind the "vpio" feature). The
-# vpio feature MUST NOT be enabled on Windows / Linux because coreaudio-rs
-# is Apple-framework-only and will fail to build. Task #24 will add a
-# matching Windows Voice Capture DSP path behind its own feature; until
-# then, Windows desktops use plain CPAL with AEC disabled.
-
-# macOS: CPAL + VoiceProcessingIO (hardware AEC via Core Audio).
-[target.'cfg(target_os = "macos")'.dependencies]
-wzp-client = { path = "../../crates/wzp-client", features = ["audio", "vpio"] }
-
-# Windows: CPAL for playback + direct WASAPI for capture with OS-level
-# AEC (AudioCategory_Communications). The wzp-client `windows-aec`
-# feature swaps the default CPAL AudioCapture for a WASAPI one that
-# opens the mic under AudioCategory_Communications, turning on Windows's
-# communications audio processing chain (AEC, NS, AGC). The reference
-# signal for AEC is the system render mix, so echo from our CPAL
-# playback is cancelled automatically without extra plumbing.
-[target.'cfg(target_os = "windows")'.dependencies]
-wzp-client = { path = "../../crates/wzp-client", features = ["audio", "windows-aec"] }
-
-# Linux: CPAL playback+capture baseline. AEC is enabled via the top-level
-# `linux-aec` feature in wzp-desktop, which forwards to wzp-client/linux-aec.
-# Keeping it opt-in at the wzp-desktop level (rather than forcing it always
-# on here) lets `cargo tauri build` produce two variants from the same
-# source tree — a noAEC baseline and an AEC build — by toggling the feature
-# at build time: `cargo tauri build -- --features wzp-desktop/linux-aec`.
-[target.'cfg(target_os = "linux")'.dependencies]
-wzp-client = { path = "../../crates/wzp-client", features = ["audio"] }
-
-# Android: no CPAL, no vpio — audio goes through the standalone wzp-native
-# cdylib that we dlopen via libloading at runtime. See the wzp_native
-# module in src/.
-[target.'cfg(target_os = "android")'.dependencies]
-wzp-client = { path = "../../crates/wzp-client", default-features = false }
-# libloading: runtime dlopen of libwzp_native.so — the standalone cdylib
-# crate that owns all C++ (Oboe bridge). Keeps wzp-desktop's .so free of
-# any C/C++ static archives that would otherwise leak bionic's internal
-# pthread_create into our cdylib and trigger the __init_tcb crash.
-libloading = "0.8"
-# jni + ndk-context: called from android_audio.rs to invoke
-# AudioManager.setSpeakerphoneOn on the JVM side at runtime, so the
-# Oboe playout stream (opened with Usage::VoiceCommunication) can route
-# between earpiece and loud speaker without restarting.
-jni = "0.21"
-ndk-context = "0.1"
-
-[features]
-default = ["custom-protocol"]
-custom-protocol = ["tauri/custom-protocol"]
-# linux-aec: forwards to wzp-client/linux-aec so `cargo tauri build -- --features
-# wzp-desktop/linux-aec` enables the WebRTC AEC3 backend on Linux. No-op on
-# other targets because wzp-client/linux-aec is itself cfg(target_os = "linux").
-linux-aec = ["wzp-client/linux-aec"]

desktop/src-tauri/Info.plist

@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <!--
-      Custom Info.plist keys merged into the bundled WarzonePhone.app by
-      tauri-bundler. The base Info.plist (CFBundleIdentifier, version,
-      etc.) is generated from tauri.conf.json — only put *additional*
-      keys here.
-
-      NSMicrophoneUsageDescription is required by macOS TCC for any
-      app that opens an audio input unit. Without this string the OS
-      silently denies CoreAudio capture (input callbacks return zeros)
-      and the app never appears in System Settings → Privacy &
-      Security → Microphone. This was the root cause of the desktop
-      mic regression where phones could not hear the desktop client.
-    -->
-    <key>NSMicrophoneUsageDescription</key>
-    <string>WarzonePhone needs microphone access to transmit your voice during calls.</string>
-</dict>
-</plist>

desktop/src-tauri/build.rs

@@ -1,26 +0,0 @@
-use std::process::Command;
-
-fn main() {
-    // Capture short git hash so the running app can prove which build it is.
-    // Falls back to "unknown" if git isn't available (e.g. when building from
-    // a tarball without a .git dir).
-    let git_hash = Command::new("git")
-        .args(["rev-parse", "--short", "HEAD"])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())
-        .and_then(|o| String::from_utf8(o.stdout).ok())
-        .map(|s| s.trim().to_string())
-        .unwrap_or_else(|| "unknown".into());
-
-    println!("cargo:rustc-env=WZP_GIT_HASH={git_hash}");
-    println!("cargo:rerun-if-changed=../../.git/HEAD");
-    println!("cargo:rerun-if-changed=../../.git/refs/heads");
-
-    // No cc::Build of ANY kind on Android — all C++ lives in the standalone
-    // `wzp-native` crate which is built separately with cargo-ndk and loaded
-    // via libloading at runtime. See docs/incident-tauri-android-init-tcb.md
-    // for why this split exists.
-
-    tauri_build::build()
-}

desktop/src-tauri/capabilities/default.json

@@ -1,30 +0,0 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "Default capability — grants core APIs (events, path, window, app, clipboard) to the main window on every platform we ship to.",
-  "windows": ["main"],
-  "platforms": [
-    "linux",
-    "macOS",
-    "windows",
-    "android",
-    "iOS"
-  ],
-  "permissions": [
-    "core:default",
-    "core:event:default",
-    "core:event:allow-listen",
-    "core:event:allow-unlisten",
-    "core:event:allow-emit",
-    "core:event:allow-emit-to",
-    "core:path:default",
-    "core:window:default",
-    "core:app:default",
-    "core:webview:default",
-    "shell:default",
-    "notification:default",
-    "notification:allow-notify",
-    "notification:allow-request-permission",
-    "notification:allow-is-permission-granted"
-  ]
-}

desktop/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -1,40 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.RECORD_AUDIO" />
-    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
-    <uses-feature android:name="android.hardware.microphone" android:required="true" />
-
-    <!-- AndroidTV support -->
-    <uses-feature android:name="android.software.leanback" android:required="false" />
-
-    <application
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:theme="@style/Theme.wzp_desktop"
-        android:usesCleartextTraffic="${usesCleartextTraffic}">
-        <activity
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
-            android:launchMode="singleTask"
-            android:label="@string/main_activity_title"
-            android:name=".MainActivity"
-            android:exported="true">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-                <!-- AndroidTV support -->
-                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
-            </intent-filter>
-        </activity>
-
-        <provider
-          android:name="androidx.core.content.FileProvider"
-          android:authorities="${applicationId}.fileprovider"
-          android:exported="false"
-          android:grantUriPermissions="true">
-          <meta-data
-            android:name="android.support.FILE_PROVIDER_PATHS"
-            android:resource="@xml/file_paths" />
-        </provider>
-    </application>
-</manifest>

desktop/src-tauri/gen/android/app/src/main/java/com/wzp/desktop/MainActivity.kt

@@ -1,103 +0,0 @@
-package com.wzp.desktop
-
-import android.Manifest
-import android.content.Context
-import android.content.pm.PackageManager
-import android.media.AudioManager
-import android.os.Bundle
-import android.util.Log
-import androidx.activity.enableEdgeToEdge
-import androidx.core.app.ActivityCompat
-import androidx.core.content.ContextCompat
-
-class MainActivity : TauriActivity() {
-  companion object {
-    private const val TAG = "WzpMainActivity"
-    private const val AUDIO_PERMISSIONS_REQUEST = 4242
-    private val REQUIRED_AUDIO_PERMISSIONS = arrayOf(
-      Manifest.permission.RECORD_AUDIO,
-      Manifest.permission.MODIFY_AUDIO_SETTINGS
-    )
-  }
-
-  override fun onCreate(savedInstanceState: Bundle?) {
-    enableEdgeToEdge()
-    super.onCreate(savedInstanceState)
-
-    // Request RECORD_AUDIO early so Oboe (inside libwzp_native.so) can open
-    // the AAudio input stream without silently failing. The grant is
-    // persisted, so after the first launch the dialog no longer appears.
-    // MODIFY_AUDIO_SETTINGS is needed to switch AudioManager mode + speaker.
-    val needsRequest = REQUIRED_AUDIO_PERMISSIONS.any {
-      ContextCompat.checkSelfPermission(this, it) != PackageManager.PERMISSION_GRANTED
-    }
-    if (needsRequest) {
-      Log.i(TAG, "requesting audio permissions")
-      ActivityCompat.requestPermissions(this, REQUIRED_AUDIO_PERMISSIONS, AUDIO_PERMISSIONS_REQUEST)
-    } else {
-      Log.i(TAG, "audio permissions already granted")
-      configureAudioForCall()
-    }
-  }
-
-  override fun onRequestPermissionsResult(
-    requestCode: Int,
-    permissions: Array<String>,
-    grantResults: IntArray
-  ) {
-    super.onRequestPermissionsResult(requestCode, permissions, grantResults)
-    if (requestCode == AUDIO_PERMISSIONS_REQUEST) {
-      val allGranted = grantResults.isNotEmpty() &&
-        grantResults.all { it == PackageManager.PERMISSION_GRANTED }
-      Log.i(TAG, "audio permissions result: allGranted=$allGranted grants=${grantResults.toList()}")
-      if (allGranted) {
-        configureAudioForCall()
-      }
-    }
-  }
-
-  /**
-   * Put the phone into VoIP call mode with handset (earpiece) as the
-   * default output. The Oboe playout stream is opened with
-   * Usage::VoiceCommunication which honours this routing, so:
-   *
-   *   MODE_IN_COMMUNICATION + speakerphoneOn=false  → earpiece (handset)
-   *   MODE_IN_COMMUNICATION + speakerphoneOn=true   → loudspeaker
-   *   MODE_IN_COMMUNICATION + bluetoothScoOn=true   → bluetooth headset
-   *
-   * The speaker/handset/BT toggle itself is wired up via the Tauri
-   * command `set_speakerphone(on)` in a follow-up build. For now the
-   * default is handset, matching the user's stated preference.
-   *
-   * STREAM_VOICE_CALL volume is cranked to max since the in-call volume
-   * slider is separate from media volume on most devices.
-   */
-  /**
-   * Pre-flight: only set volumes. Do NOT set MODE_IN_COMMUNICATION here —
-   * that hijacks the entire audio routing (music stops, BT A2DP drops to
-   * earpiece) even before a call starts. The Rust side sets the mode via
-   * JNI when the call engine actually starts, and restores MODE_NORMAL
-   * when the call ends.
-   */
-  private fun configureAudioForCall() {
-    try {
-      val am = getSystemService(Context.AUDIO_SERVICE) as AudioManager
-      Log.i(TAG, "audio state: mode=${am.mode} speaker=${am.isSpeakerphoneOn} " +
-        "voiceVol=${am.getStreamVolume(AudioManager.STREAM_VOICE_CALL)}/" +
-        "${am.getStreamMaxVolume(AudioManager.STREAM_VOICE_CALL)} " +
-        "musicVol=${am.getStreamVolume(AudioManager.STREAM_MUSIC)}/" +
-        "${am.getStreamMaxVolume(AudioManager.STREAM_MUSIC)}")
-
-      // Crank both voice-call and music volumes so nothing silent slips
-      // through regardless of which stream actually ends up driving.
-      val maxVoice = am.getStreamMaxVolume(AudioManager.STREAM_VOICE_CALL)
-      am.setStreamVolume(AudioManager.STREAM_VOICE_CALL, maxVoice, 0)
-      val maxMusic = am.getStreamMaxVolume(AudioManager.STREAM_MUSIC)
-      am.setStreamVolume(AudioManager.STREAM_MUSIC, maxMusic, 0)
-
-      Log.i(TAG, "volumes set: voiceVol=$maxVoice musicVol=$maxMusic (mode left at ${am.mode})")
-    } catch (e: Throwable) {
-      Log.e(TAG, "configureAudioForCall failed: ${e.message}", e)
-    }
-  }
-}

desktop/src-tauri/gen/schemas/capabilities.json

@@ -1 +0,0 @@
-{"default":{"identifier":"default","description":"Default capability — grants core APIs (events, path, window, app, clipboard) to the main window on every platform we ship to.","local":true,"windows":["main"],"permissions":["core:default","core:event:default","core:event:allow-listen","core:event:allow-unlisten","core:event:allow-emit","core:event:allow-emit-to","core:path:default","core:window:default","core:app:default","core:webview:default","shell:default","notification:default","notification:allow-notify","notification:allow-request-permission","notification:allow-is-permission-granted"],"platforms":["linux","macOS","windows","android","iOS"]}}

desktop/src-tauri/src/android_audio.rs

@@ -1,359 +0,0 @@
-//! Runtime bridge to Android's `AudioManager` for in-call audio routing.
-//!
-//! We own a quinn+Oboe VoIP pipeline entirely from Rust, but routing the
-//! playout stream between earpiece / loudspeaker / Bluetooth headset has to
-//! happen at the JVM level because those toggles are AudioManager-only.
-//! This module uses the global JavaVM handle that `ndk_context` exposes
-//! (populated by Tauri's mobile runtime) + the `jni` crate to reach into
-//! the Android framework without needing a Tauri plugin.
-//!
-//! All callers must be inside an Android target (`#[cfg(target_os = "android")]`).
-
-#![cfg(target_os = "android")]
-
-use jni::objects::{JObject, JString, JValue};
-use jni::JavaVM;
-
-/// Grab the JavaVM + current Activity from the ndk_context that Tauri's
-/// mobile runtime sets up at process startup.
-fn jvm_and_activity() -> Result<(JavaVM, JObject<'static>), String> {
-    let ctx = ndk_context::android_context();
-    let vm_ptr = ctx.vm() as *mut jni::sys::JavaVM;
-    if vm_ptr.is_null() {
-        return Err("ndk_context: JavaVM pointer is null".into());
-    }
-    let vm = unsafe { JavaVM::from_raw(vm_ptr) }
-        .map_err(|e| format!("JavaVM::from_raw: {e}"))?;
-    let activity_ptr = ctx.context() as jni::sys::jobject;
-    if activity_ptr.is_null() {
-        return Err("ndk_context: activity pointer is null".into());
-    }
-    // SAFETY: ndk_context guarantees the pointer lives for the process
-    // lifetime; we wrap it as a JObject<'static> for convenience.
-    let activity: JObject<'static> = unsafe { JObject::from_raw(activity_ptr) };
-    Ok((vm, activity))
-}
-
-/// Get Android's `AudioManager` via `activity.getSystemService("audio")`.
-fn audio_manager<'local>(
-    env: &mut jni::AttachGuard<'local>,
-    activity: &JObject<'local>,
-) -> Result<JObject<'local>, String> {
-    let svc_name: JString<'local> = env
-        .new_string("audio")
-        .map_err(|e| format!("new_string(audio): {e}"))?;
-    let am = env
-        .call_method(
-            activity,
-            "getSystemService",
-            "(Ljava/lang/String;)Ljava/lang/Object;",
-            &[JValue::Object(&svc_name)],
-        )
-        .and_then(|v| v.l())
-        .map_err(|e| format!("getSystemService(audio): {e}"))?;
-    if am.is_null() {
-        return Err("getSystemService returned null".into());
-    }
-    Ok(am)
-}
-
-/// Set `AudioManager.MODE_IN_COMMUNICATION`. Call when a VoIP call starts.
-/// This tells the audio policy to route through the communication device
-/// path (earpiece/BT SCO) instead of the media path (speaker/BT A2DP).
-pub fn set_audio_mode_communication() -> Result<(), String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-    // MODE_IN_COMMUNICATION = 3
-    env.call_method(&am, "setMode", "(I)V", &[JValue::Int(3)])
-        .map_err(|e| format!("setMode(MODE_IN_COMMUNICATION): {e}"))?;
-    tracing::info!("AudioManager: mode set to MODE_IN_COMMUNICATION");
-    Ok(())
-}
-
-/// Restore `AudioManager.MODE_NORMAL`. Call when a VoIP call ends.
-pub fn set_audio_mode_normal() -> Result<(), String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-    // MODE_NORMAL = 0
-    env.call_method(&am, "setMode", "(I)V", &[JValue::Int(0)])
-        .map_err(|e| format!("setMode(MODE_NORMAL): {e}"))?;
-    tracing::info!("AudioManager: mode set to MODE_NORMAL");
-    Ok(())
-}
-
-/// Switch between loud speaker (`true`) and earpiece/handset (`false`).
-pub fn set_speakerphone(on: bool) -> Result<(), String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    env.call_method(
-        &am,
-        "setSpeakerphoneOn",
-        "(Z)V",
-        &[JValue::Bool(if on { 1 } else { 0 })],
-    )
-    .map_err(|e| format!("setSpeakerphoneOn({on}): {e}"))?;
-
-    tracing::info!(on, "AudioManager.setSpeakerphoneOn");
-    Ok(())
-}
-
-/// Query the current speakerphone state. Returns true if routing is on the
-/// loud speaker, false if on earpiece / BT headset / wired headset.
-pub fn is_speakerphone_on() -> Result<bool, String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    let on = env
-        .call_method(&am, "isSpeakerphoneOn", "()Z", &[])
-        .and_then(|v| v.z())
-        .map_err(|e| format!("isSpeakerphoneOn: {e}"))?;
-    Ok(on)
-}
-
-// ─── Bluetooth SCO routing ──────────────────────────────────────────────────
-
-/// Start Bluetooth SCO audio routing.
-///
-/// On API 31+ uses `setCommunicationDevice()` which is the modern way to
-/// route voice audio to a specific device. Falls back to the deprecated
-/// `startBluetoothSco()` path on older APIs.
-///
-/// The caller must restart Oboe streams after this call.
-pub fn start_bluetooth_sco() -> Result<(), String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    // Ensure speaker is off — mutually exclusive with BT.
-    env.call_method(
-        &am,
-        "setSpeakerphoneOn",
-        "(Z)V",
-        &[JValue::Bool(0)],
-    )
-    .map_err(|e| format!("setSpeakerphoneOn(false): {e}"))?;
-
-    // Try modern API first (API 31+): setCommunicationDevice(AudioDeviceInfo)
-    // Find a BT SCO or BLE device from getAvailableCommunicationDevices()
-    let used_modern = try_set_communication_device(&mut env, &am, true)?;
-
-    if !used_modern {
-        // Fallback: deprecated startBluetoothSco (API < 31)
-        tracing::info!("start_bluetooth_sco: falling back to deprecated startBluetoothSco");
-        env.call_method(&am, "startBluetoothSco", "()V", &[])
-            .map_err(|e| format!("startBluetoothSco: {e}"))?;
-    }
-
-    tracing::info!(used_modern, "AudioManager: Bluetooth SCO started");
-    Ok(())
-}
-
-/// Stop Bluetooth SCO audio routing, returning audio to the earpiece.
-///
-/// The caller must restart Oboe streams after this call.
-pub fn stop_bluetooth_sco() -> Result<(), String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    // Modern API: clearCommunicationDevice() (API 31+)
-    let cleared = try_set_communication_device(&mut env, &am, false)?;
-
-    if !cleared {
-        // Fallback: deprecated stopBluetoothSco
-        env.call_method(&am, "stopBluetoothSco", "()V", &[])
-            .map_err(|e| format!("stopBluetoothSco: {e}"))?;
-    }
-
-    tracing::info!(cleared, "AudioManager: Bluetooth SCO stopped");
-    Ok(())
-}
-
-/// Try to use the modern `setCommunicationDevice` / `clearCommunicationDevice`
-/// API (Android 12 / API 31+). Returns `true` if the modern API was used.
-fn try_set_communication_device(
-    env: &mut jni::AttachGuard<'_>,
-    am: &JObject<'_>,
-    enable: bool,
-) -> Result<bool, String> {
-    // Check SDK_INT >= 31 (Android 12)
-    let sdk_int = env
-        .get_static_field(
-            "android/os/Build$VERSION",
-            "SDK_INT",
-            "I",
-        )
-        .and_then(|v| v.i())
-        .unwrap_or(0);
-
-    if sdk_int < 31 {
-        return Ok(false);
-    }
-
-    if !enable {
-        // clearCommunicationDevice()
-        env.call_method(am, "clearCommunicationDevice", "()V", &[])
-            .map_err(|e| format!("clearCommunicationDevice: {e}"))?;
-        tracing::info!("clearCommunicationDevice: done");
-        return Ok(true);
-    }
-
-    // getAvailableCommunicationDevices() → List<AudioDeviceInfo>
-    let device_list = env
-        .call_method(
-            am,
-            "getAvailableCommunicationDevices",
-            "()Ljava/util/List;",
-            &[],
-        )
-        .and_then(|v| v.l())
-        .map_err(|e| format!("getAvailableCommunicationDevices: {e}"))?;
-
-    let size = env
-        .call_method(&device_list, "size", "()I", &[])
-        .and_then(|v| v.i())
-        .unwrap_or(0);
-
-    // Find first BT device: TYPE_BLUETOOTH_SCO (7), TYPE_BLUETOOTH_A2DP (8),
-    // TYPE_BLE_HEADSET (26), TYPE_BLE_SPEAKER (27)
-    for i in 0..size {
-        let device = env
-            .call_method(
-                &device_list,
-                "get",
-                "(I)Ljava/lang/Object;",
-                &[JValue::Int(i)],
-            )
-            .and_then(|v| v.l())
-            .map_err(|e| format!("list.get({i}): {e}"))?;
-
-        let device_type = env
-            .call_method(&device, "getType", "()I", &[])
-            .and_then(|v| v.i())
-            .unwrap_or(0);
-
-        // BT SCO = 7, A2DP = 8, BLE headset = 26, BLE speaker = 27
-        if matches!(device_type, 7 | 8 | 26 | 27) {
-            let ok = env
-                .call_method(
-                    am,
-                    "setCommunicationDevice",
-                    "(Landroid/media/AudioDeviceInfo;)Z",
-                    &[JValue::Object(&device)],
-                )
-                .and_then(|v| v.z())
-                .unwrap_or(false);
-
-            tracing::info!(
-                device_type,
-                ok,
-                "setCommunicationDevice: set BT device"
-            );
-            return Ok(ok);
-        }
-    }
-
-    tracing::warn!("setCommunicationDevice: no BT device in available list");
-    Ok(false)
-}
-
-/// Query whether Bluetooth audio is currently the active communication device.
-///
-/// On API 31+ checks `getCommunicationDevice()` type. Falls back to the
-/// deprecated `isBluetoothScoOn()` on older APIs.
-pub fn is_bluetooth_sco_on() -> Result<bool, String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    let sdk_int = env
-        .get_static_field("android/os/Build$VERSION", "SDK_INT", "I")
-        .and_then(|v| v.i())
-        .unwrap_or(0);
-
-    if sdk_int >= 31 {
-        // getCommunicationDevice() → AudioDeviceInfo (nullable)
-        let device = env
-            .call_method(am, "getCommunicationDevice", "()Landroid/media/AudioDeviceInfo;", &[])
-            .and_then(|v| v.l())
-            .unwrap_or(JObject::null());
-        if device.is_null() {
-            return Ok(false);
-        }
-        let device_type = env
-            .call_method(&device, "getType", "()I", &[])
-            .and_then(|v| v.i())
-            .unwrap_or(0);
-        // BT SCO = 7, A2DP = 8, BLE headset = 26, BLE speaker = 27
-        return Ok(matches!(device_type, 7 | 8 | 26 | 27));
-    }
-
-    // Fallback: deprecated API
-    env.call_method(&am, "isBluetoothScoOn", "()Z", &[])
-        .and_then(|v| v.z())
-        .map_err(|e| format!("isBluetoothScoOn: {e}"))
-}
-
-/// Check whether a Bluetooth audio device is currently connected.
-///
-/// Iterates `AudioManager.getDevices(GET_DEVICES_OUTPUTS)` and looks for
-/// any Bluetooth device type. Many headsets only register as A2DP until
-/// SCO is explicitly started, so we check for both SCO and A2DP types.
-pub fn is_bluetooth_available() -> Result<bool, String> {
-    let (vm, activity) = jvm_and_activity()?;
-    let mut env = vm
-        .attach_current_thread()
-        .map_err(|e| format!("attach_current_thread: {e}"))?;
-    let am = audio_manager(&mut env, &activity)?;
-
-    // AudioManager.GET_DEVICES_OUTPUTS = 2
-    let devices = env
-        .call_method(
-            &am,
-            "getDevices",
-            "(I)[Landroid/media/AudioDeviceInfo;",
-            &[JValue::Int(2)],
-        )
-        .and_then(|v| v.l())
-        .map_err(|e| format!("getDevices(OUTPUTS): {e}"))?;
-
-    let arr = jni::objects::JObjectArray::from(devices);
-    let len = env
-        .get_array_length(&arr)
-        .map_err(|e| format!("get_array_length: {e}"))?;
-
-    for i in 0..len {
-        let device = env
-            .get_object_array_element(&arr, i)
-            .map_err(|e| format!("get_object_array_element({i}): {e}"))?;
-        let device_type = env
-            .call_method(&device, "getType", "()I", &[])
-            .and_then(|v| v.i())
-            .unwrap_or(0);
-        // TYPE_BLUETOOTH_SCO = 7, TYPE_BLUETOOTH_A2DP = 8
-        if device_type == 7 || device_type == 8 {
-            tracing::info!(device_type, idx = i, "is_bluetooth_available: found BT device");
-            return Ok(true);
-        }
-    }
-    Ok(false)
-}

desktop/src-tauri/src/history.rs

@@ -1,180 +0,0 @@
-//! Call history store.
-//!
-//! Keeps a rolling JSON file of the last N direct-call events so the UI can
-//! show "recent contacts" + "call history with callback buttons" on the
-//! direct-call screen. Storage lives in `<APP_DATA_DIR>/call_history.json`
-//! alongside the identity file. The file is read lazily on first access and
-//! cached in an RwLock behind a OnceLock.
-//!
-//! This is a v1 — no duration tracking yet, entries are logged at the
-//! moment the direction is decided (placed / received / missed).
-
-use std::path::PathBuf;
-use std::sync::{OnceLock, RwLock};
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use serde::{Deserialize, Serialize};
-
-/// Maximum number of history entries we keep. Older ones are pruned FIFO.
-const MAX_ENTRIES: usize = 200;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum CallDirection {
-    /// Local user placed the call.
-    Placed,
-    /// Remote user called and local user answered.
-    Received,
-    /// Remote user called but local user did not answer (rejected or
-    /// missed entirely — the UI treats these identically).
-    Missed,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CallHistoryEntry {
-    pub call_id: String,
-    pub peer_fp: String,
-    pub peer_alias: Option<String>,
-    pub direction: CallDirection,
-    /// Seconds since UNIX epoch, UTC.
-    pub timestamp_unix: u64,
-}
-
-// ─── In-process store (loaded from disk once) ─────────────────────────────
-
-static STORE: OnceLock<RwLock<Vec<CallHistoryEntry>>> = OnceLock::new();
-
-fn store() -> &'static RwLock<Vec<CallHistoryEntry>> {
-    STORE.get_or_init(|| RwLock::new(load_from_disk()))
-}
-
-fn history_path() -> PathBuf {
-    crate::APP_DATA_DIR
-        .get()
-        .cloned()
-        .unwrap_or_else(|| {
-            let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());
-            PathBuf::from(home).join(".wzp")
-        })
-        .join("call_history.json")
-}
-
-fn load_from_disk() -> Vec<CallHistoryEntry> {
-    let path = history_path();
-    let Ok(bytes) = std::fs::read(&path) else {
-        return Vec::new();
-    };
-    serde_json::from_slice::<Vec<CallHistoryEntry>>(&bytes)
-        .inspect_err(|e| tracing::warn!(path = %path.display(), error = %e, "call_history.json parse failed"))
-        .unwrap_or_default()
-}
-
-fn save_to_disk(entries: &[CallHistoryEntry]) {
-    let path = history_path();
-    if let Some(parent) = path.parent() {
-        let _ = std::fs::create_dir_all(parent);
-    }
-    let Ok(json) = serde_json::to_vec_pretty(entries) else { return };
-    // Atomic write via temp file + rename so a crash mid-write doesn't
-    // leave us with a half-file on disk.
-    let tmp = path.with_extension("json.tmp");
-    if std::fs::write(&tmp, &json).is_ok() {
-        let _ = std::fs::rename(&tmp, &path);
-    }
-}
-
-fn now_unix() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-}
-
-// ─── Public API ───────────────────────────────────────────────────────────
-
-/// Append a new entry to the store and persist to disk. Trims the store to
-/// `MAX_ENTRIES` after insertion.
-pub fn log(
-    call_id: String,
-    peer_fp: String,
-    peer_alias: Option<String>,
-    direction: CallDirection,
-) {
-    tracing::info!(
-        %call_id, %peer_fp, ?direction,
-        alias = ?peer_alias,
-        "history::log"
-    );
-    let entry = CallHistoryEntry {
-        call_id: call_id.clone(),
-        peer_fp,
-        peer_alias,
-        direction,
-        timestamp_unix: now_unix(),
-    };
-    let mut guard = store().write().unwrap();
-    // If an entry for this call_id already exists, update it in-place
-    // rather than appending a duplicate. Protects against the caller
-    // side adding a second Missed row when the callee's DirectCallOffer
-    // bounces back through federation / loopback, or when some future
-    // relay routing edge case double-emits a signal. The dedup keeps
-    // history tidy and matches what the user intuitively expects (one
-    // history row per call, not one per signal event).
-    if let Some(existing) = guard.iter_mut().rev().find(|e| e.call_id == call_id) {
-        tracing::info!(%call_id, from = ?existing.direction, to = ?direction, "history::log replacing existing entry");
-        existing.direction = direction;
-        existing.timestamp_unix = entry.timestamp_unix;
-        save_to_disk(&guard);
-        return;
-    }
-    guard.push(entry);
-    if guard.len() > MAX_ENTRIES {
-        let drop_n = guard.len() - MAX_ENTRIES;
-        guard.drain(0..drop_n);
-    }
-    save_to_disk(&guard);
-}
-
-/// Return a copy of all entries in reverse-chronological order
-/// (most recent first).
-pub fn all() -> Vec<CallHistoryEntry> {
-    let guard = store().read().unwrap();
-    guard.iter().rev().cloned().collect()
-}
-
-/// Unique peer contacts sorted by most recent interaction. Each contact
-/// is represented by the newest history entry for that fingerprint.
-pub fn contacts() -> Vec<CallHistoryEntry> {
-    let guard = store().read().unwrap();
-    let mut seen: std::collections::HashSet<String> = std::collections::HashSet::new();
-    let mut out = Vec::new();
-    // iterate newest → oldest
-    for entry in guard.iter().rev() {
-        if seen.insert(entry.peer_fp.clone()) {
-            out.push(entry.clone());
-        }
-    }
-    out
-}
-
-/// Clear the entire history and persist the empty file.
-pub fn clear() {
-    let mut guard = store().write().unwrap();
-    guard.clear();
-    save_to_disk(&guard);
-}
-
-/// Find a Missed-candidate entry that matches `call_id` and hasn't been
-/// answered yet. Used by the signal loop to turn "pending incoming" into
-/// "Received" when the user accepts.
-pub fn mark_received_if_pending(call_id: &str) -> bool {
-    let mut guard = store().write().unwrap();
-    for entry in guard.iter_mut().rev() {
-        if entry.call_id == call_id && entry.direction == CallDirection::Missed {
-            entry.direction = CallDirection::Received;
-            save_to_disk(&guard);
-            return true;
-        }
-    }
-    false
-}

desktop/src-tauri/src/main.rs

@@ -1,10 +0,0 @@
-// Desktop binary entry point. All logic lives in `lib.rs` so the same
-// code can be built as a cdylib for Android/iOS via `cargo tauri android build`.
-#![cfg_attr(
-    all(not(debug_assertions), target_os = "windows"),
-    windows_subsystem = "windows"
-)]
-
-fn main() {
-    wzp_desktop_lib::run();
-}

desktop/src-tauri/src/wzp_native.rs

@@ -1,148 +0,0 @@
-//! Runtime binding to the standalone `wzp-native` cdylib.
-//!
-//! See `docs/incident-tauri-android-init-tcb.md` and the top of
-//! `crates/wzp-native/src/lib.rs` for the full story on why this split
-//! exists. Short version: Tauri's desktop cdylib cannot have any C++
-//! compiled into it (via cc::Build) without landing in rust-lang/rust#104707's
-//! staticlib symbol leak, which makes bionic's private `pthread_create`
-//! symbols bind locally and SIGSEGV in `__init_tcb+4` at launch. So all
-//! the Oboe + audio code lives in a standalone `wzp-native` .so built
-//! with `cargo-ndk`, and we dlopen it here at runtime.
-//!
-//! The Library handle lives in a `'static` `OnceLock` for the lifetime of
-//! the process; all function pointers cached below borrow from it safely.
-
-#![cfg(target_os = "android")]
-
-use std::sync::OnceLock;
-
-// ─── Library handle (kept alive forever) ─────────────────────────────────
-
-static LIB: OnceLock<libloading::Library> = OnceLock::new();
-
-// Cached function pointers, resolved once at init(). Each is a raw
-// `extern "C"` fn pointer with effectively `'static` lifetime because
-// LIB is a OnceLock that never drops.
-static VERSION: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
-static HELLO: OnceLock<unsafe extern "C" fn(*mut u8, usize) -> usize> = OnceLock::new();
-static AUDIO_START: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
-static AUDIO_START_BT: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
-static AUDIO_STOP: OnceLock<unsafe extern "C" fn()> = OnceLock::new();
-static AUDIO_READ_CAPTURE: OnceLock<unsafe extern "C" fn(*mut i16, usize) -> usize> = OnceLock::new();
-static AUDIO_WRITE_PLAYOUT: OnceLock<unsafe extern "C" fn(*const i16, usize) -> usize> = OnceLock::new();
-static AUDIO_IS_RUNNING: OnceLock<unsafe extern "C" fn() -> i32> = OnceLock::new();
-static AUDIO_CAPTURE_LATENCY: OnceLock<unsafe extern "C" fn() -> f32> = OnceLock::new();
-static AUDIO_PLAYOUT_LATENCY: OnceLock<unsafe extern "C" fn() -> f32> = OnceLock::new();
-
-/// Load `libwzp_native.so` and resolve every exported function we use.
-/// Call this once at app startup (from the Tauri `setup()` callback).
-/// Subsequent calls are no-ops.
-pub fn init() -> Result<(), String> {
-    if LIB.get().is_some() {
-        return Ok(());
-    }
-
-    // Open the sibling cdylib. The Android dynamic linker searches
-    // /data/app/<pkg>/lib/arm64/ which gradle populates from jniLibs.
-    let lib = unsafe { libloading::Library::new("libwzp_native.so") }
-        .map_err(|e| format!("dlopen libwzp_native.so: {e}"))?;
-
-    // Stash the Library into the OnceLock first so all Symbol lookups
-    // below borrow from the 'static reference rather than a local.
-    LIB.set(lib).map_err(|_| "wzp_native::LIB already set")?;
-    let lib_ref: &'static libloading::Library = LIB.get().unwrap();
-
-    unsafe {
-        macro_rules! resolve {
-            ($cell:expr, $ty:ty, $name:expr) => {{
-                let sym: libloading::Symbol<$ty> = lib_ref.get($name)
-                    .map_err(|e| format!("dlsym {}: {e}", core::str::from_utf8($name).unwrap_or("?")))?;
-                // Dereference the Symbol to extract the raw fn pointer;
-                // it stays valid because lib_ref is 'static.
-                $cell.set(*sym).map_err(|_| format!("{} already set", core::str::from_utf8($name).unwrap_or("?")))?;
-            }};
-        }
-
-        resolve!(VERSION, unsafe extern "C" fn() -> i32, b"wzp_native_version");
-        resolve!(HELLO, unsafe extern "C" fn(*mut u8, usize) -> usize, b"wzp_native_hello");
-        resolve!(AUDIO_START, unsafe extern "C" fn() -> i32, b"wzp_native_audio_start");
-        resolve!(AUDIO_START_BT, unsafe extern "C" fn() -> i32, b"wzp_native_audio_start_bt");
-        resolve!(AUDIO_STOP, unsafe extern "C" fn(), b"wzp_native_audio_stop");
-        resolve!(AUDIO_READ_CAPTURE, unsafe extern "C" fn(*mut i16, usize) -> usize, b"wzp_native_audio_read_capture");
-        resolve!(AUDIO_WRITE_PLAYOUT, unsafe extern "C" fn(*const i16, usize) -> usize, b"wzp_native_audio_write_playout");
-        resolve!(AUDIO_IS_RUNNING, unsafe extern "C" fn() -> i32, b"wzp_native_audio_is_running");
-        resolve!(AUDIO_CAPTURE_LATENCY, unsafe extern "C" fn() -> f32, b"wzp_native_audio_capture_latency_ms");
-        resolve!(AUDIO_PLAYOUT_LATENCY, unsafe extern "C" fn() -> f32, b"wzp_native_audio_playout_latency_ms");
-    }
-
-    Ok(())
-}
-
-/// Is `init()` done and all symbols cached?
-pub fn is_loaded() -> bool {
-    AUDIO_START.get().is_some()
-}
-
-// ─── Smoke-test accessors ────────────────────────────────────────────────
-
-pub fn version() -> i32 {
-    VERSION.get().map(|f| unsafe { f() }).unwrap_or(-1)
-}
-
-pub fn hello() -> String {
-    let Some(f) = HELLO.get() else { return String::new(); };
-    let mut buf = [0u8; 64];
-    let n = unsafe { f(buf.as_mut_ptr(), buf.len()) };
-    String::from_utf8_lossy(&buf[..n]).into_owned()
-}
-
-// ─── Audio accessors ─────────────────────────────────────────────────────
-
-/// Start the Oboe capture + playout streams. Returns `Err(code)` on
-/// failure. Idempotent on the wzp-native side.
-pub fn audio_start() -> Result<(), i32> {
-    let f = AUDIO_START.get().ok_or(-100_i32)?;
-    let ret = unsafe { f() };
-    if ret == 0 { Ok(()) } else { Err(ret) }
-}
-
-/// Start Oboe in Bluetooth SCO mode — capture skips sample rate and
-/// input preset so the system routes to the BT SCO device natively.
-pub fn audio_start_bt() -> Result<(), i32> {
-    let f = AUDIO_START_BT.get().ok_or(-100_i32)?;
-    let ret = unsafe { f() };
-    if ret == 0 { Ok(()) } else { Err(ret) }
-}
-
-/// Stop both streams. Safe to call even if not running.
-pub fn audio_stop() {
-    if let Some(f) = AUDIO_STOP.get() {
-        unsafe { f() };
-    }
-}
-
-/// Read captured i16 PCM into `out`. Returns bytes actually copied.
-pub fn audio_read_capture(out: &mut [i16]) -> usize {
-    let Some(f) = AUDIO_READ_CAPTURE.get() else { return 0; };
-    unsafe { f(out.as_mut_ptr(), out.len()) }
-}
-
-/// Write i16 PCM into the playout ring. Returns samples enqueued.
-pub fn audio_write_playout(input: &[i16]) -> usize {
-    let Some(f) = AUDIO_WRITE_PLAYOUT.get() else { return 0; };
-    unsafe { f(input.as_ptr(), input.len()) }
-}
-
-pub fn audio_is_running() -> bool {
-    AUDIO_IS_RUNNING.get().map(|f| unsafe { f() } != 0).unwrap_or(false)
-}
-
-#[allow(dead_code)]
-pub fn audio_capture_latency_ms() -> f32 {
-    AUDIO_CAPTURE_LATENCY.get().map(|f| unsafe { f() }).unwrap_or(0.0)
-}
-
-#[allow(dead_code)]
-pub fn audio_playout_latency_ms() -> f32 {
-    AUDIO_PLAYOUT_LATENCY.get().map(|f| unsafe { f() }).unwrap_or(0.0)
-}

desktop/src-tauri/tauri.conf.json

@@ -1,36 +0,0 @@
-{
-  "productName": "WarzonePhone",
-  "version": "0.1.0",
-  "identifier": "com.wzp.desktop",
-  "build": {
-    "frontendDist": "../dist",
-    "devUrl": "http://localhost:1420",
-    "beforeDevCommand": "npm run dev",
-    "beforeBuildCommand": "npm run build"
-  },
-  "app": {
-    "windows": [
-      {
-        "title": "WarzonePhone",
-        "width": 400,
-        "height": 640,
-        "resizable": true,
-        "minWidth": 360,
-        "minHeight": 500
-      }
-    ],
-    "security": {
-      "csp": null
-    }
-  },
-  "bundle": {
-    "active": true,
-    "targets": "all",
-    "icon": [
-      "icons/icon.png"
-    ],
-    "android": {
-      "minSdkVersion": 26
-    }
-  }
-}

desktop/src/identicon.ts

@@ -1,110 +0,0 @@
-/**
- * Deterministic identicon generator — creates a unique symmetric pattern
- * from a hex fingerprint string, similar to MetaMask's Jazzicon / Ethereum blockies.
- *
- * Returns an SVG data URL that can be used as an <img> src.
- */
-
-function hashBytes(hex: string): number[] {
-  const clean = hex.replace(/[^0-9a-fA-F]/g, "");
-  const bytes: number[] = [];
-  for (let i = 0; i < clean.length; i += 2) {
-    bytes.push(parseInt(clean.substring(i, i + 2), 16));
-  }
-  // Pad to at least 16 bytes
-  while (bytes.length < 16) bytes.push(0);
-  return bytes;
-}
-
-function hslToRgb(h: number, s: number, l: number): [number, number, number] {
-  s /= 100;
-  l /= 100;
-  const k = (n: number) => (n + h / 30) % 12;
-  const a = s * Math.min(l, 1 - l);
-  const f = (n: number) =>
-    l - a * Math.max(-1, Math.min(k(n) - 3, Math.min(9 - k(n), 1)));
-  return [
-    Math.round(f(0) * 255),
-    Math.round(f(8) * 255),
-    Math.round(f(4) * 255),
-  ];
-}
-
-export function generateIdenticon(
-  fingerprint: string,
-  size: number = 36
-): string {
-  const bytes = hashBytes(fingerprint);
-
-  // Derive colors from first bytes
-  const hue1 = (bytes[0] * 360) / 256;
-  const hue2 = ((bytes[1] * 360) / 256 + 120) % 360;
-  const [r1, g1, b1] = hslToRgb(hue1, 65, 35); // dark bg
-  const [r2, g2, b2] = hslToRgb(hue2, 70, 55); // bright fg
-
-  const bg = `rgb(${r1},${g1},${b1})`;
-  const fg = `rgb(${r2},${g2},${b2})`;
-
-  // 5x5 grid, left-right symmetric (only need 3 columns)
-  const grid: boolean[][] = [];
-  for (let y = 0; y < 5; y++) {
-    const row: boolean[] = [];
-    for (let x = 0; x < 3; x++) {
-      const byteIdx = 2 + y * 3 + x;
-      row.push(bytes[byteIdx % bytes.length] > 128);
-    }
-    // Mirror: col 3 = col 1, col 4 = col 0
-    grid.push([row[0], row[1], row[2], row[1], row[0]]);
-  }
-
-  // Render SVG
-  const cellSize = size / 5;
-  const r = size * 0.12; // border radius
-  let rects = "";
-  for (let y = 0; y < 5; y++) {
-    for (let x = 0; x < 5; x++) {
-      if (grid[y][x]) {
-        rects += `<rect x="${x * cellSize}" y="${y * cellSize}" width="${cellSize}" height="${cellSize}" fill="${fg}"/>`;
-      }
-    }
-  }
-
-  const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" viewBox="0 0 ${size} ${size}">
-    <rect width="${size}" height="${size}" rx="${r}" fill="${bg}"/>
-    ${rects}
-  </svg>`;
-
-  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
-}
-
-/**
- * Create an <img> element with the identicon.
- * Click copies the fingerprint to clipboard.
- */
-export function createIdenticonEl(
-  fingerprint: string,
-  size: number = 36,
-  clickToCopy: boolean = true
-): HTMLImageElement {
-  const img = document.createElement("img");
-  img.src = generateIdenticon(fingerprint, size);
-  img.width = size;
-  img.height = size;
-  img.style.borderRadius = `${size * 0.12}px`;
-  img.style.cursor = clickToCopy ? "pointer" : "default";
-  img.title = fingerprint;
-
-  if (clickToCopy && fingerprint) {
-    img.addEventListener("click", (e) => {
-      e.stopPropagation();
-      navigator.clipboard.writeText(fingerprint).then(() => {
-        img.style.outline = "2px solid #4ade80";
-        setTimeout(() => {
-          img.style.outline = "";
-        }, 600);
-      });
-    });
-  }
-
-  return img;
-}

desktop/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true,
-    "allowImportingTsExtensions": true,
-    "noEmit": true
-  },
-  "include": ["src"]
-}

desktop/vite.config.ts

@@ -1,15 +0,0 @@
-import { defineConfig } from "vite";
-
-export default defineConfig({
-  clearScreen: false,
-  server: {
-    port: 1420,
-    strictPort: true,
-  },
-  envPrefix: ["VITE_", "TAURI_"],
-  build: {
-    target: "esnext",
-    minify: !process.env.TAURI_DEBUG ? "esbuild" : false,
-    sourcemap: !!process.env.TAURI_DEBUG,
-  },
-});

docs/ARCHITECTURE.md

@@ -103,13 +103,11 @@ sequenceDiagram
     participant RNN as RNNoise<br/>(2 x 480)
     participant VAD as SilenceDetector
     participant Codec as Opus / Codec2
-    participant DT as DredTuner<br/>(wzp-proto)
     participant FEC as RaptorQ FEC
     participant INT as Interleaver<br/>(depth=3)
     participant HDR as MediaHeader<br/>(12B or Mini 4B)
     participant Enc as ChaCha20-Poly1305
     participant QUIC as QUIC Datagram
-    participant QPS as QuinnPathSnapshot
 
     Mic->>Ring: f32 x 512 (macOS callback)
     Ring->>Ring: Accumulate to 960 samples
@@ -120,19 +118,10 @@ sequenceDiagram
     else Silence (>100ms)
         VAD->>Codec: ComfortNoise (every 200ms)
     end
-
-    Note over QPS,DT: Every 25 frames (~500ms)
-    QPS->>DT: loss_pct, rtt_ms, jitter_ms
-    DT->>Codec: set_dred_duration() + set_expected_loss()
-
-    alt Opus tier (any bitrate)
-        Codec->>HDR: Compressed bytes + DRED side-channel (no RaptorQ)
-    else Codec2 tier
-        Codec->>FEC: Compressed bytes (pad to 256B symbol)
-        FEC->>FEC: Accumulate block (5-10 symbols)
-        FEC->>INT: Source + repair symbols
-        INT->>HDR: Interleaved packets
-    end
+    Codec->>FEC: Compressed bytes (pad to 256B symbol)
+    FEC->>FEC: Accumulate block (5-10 symbols)
+    FEC->>INT: Source + repair symbols
+    INT->>HDR: Interleaved packets
     HDR->>Enc: Header as AAD
     Enc->>QUIC: Encrypted payload + 16B tag
 ```
@@ -145,9 +134,6 @@ sequenceDiagram
 - Silence detection uses VAD + 100ms hangover before switching to ComfortNoise
 - FEC symbols are padded to **256 bytes** with a 2-byte LE length prefix
 - MiniHeaders (4 bytes) replace full headers (12 bytes) for 49 of every 50 frames
-- DRED tuner polls quinn path stats every 25 frames (~500ms) and adjusts DRED lookback duration continuously
-- Opus tiers bypass RaptorQ entirely -- DRED handles loss recovery at the codec layer
-- Opus6k DRED window: 1040ms (maximum libopus allows)
 
 ## Audio Decode Pipeline
 
@@ -168,30 +154,13 @@ sequenceDiagram
     Dec->>AR: Decrypt (header = AAD)
     AR->>AR: Check seq window (reject replay)
     AR->>HDR: Verified packet
-
-    alt Opus packet
-        HDR->>JIT: Direct to jitter buffer (no FEC/interleave)
-    else Codec2 packet
-        HDR->>DEINT: MediaHeader + payload
-        DEINT->>FEC: Reordered symbols by block
-        FEC->>FEC: Attempt decode (need K of K+R)
-        FEC->>JIT: Recovered audio frames
-    end
-
+    HDR->>DEINT: MediaHeader + payload
+    DEINT->>FEC: Reordered symbols by block
+    FEC->>FEC: Attempt decode (need K of K+R)
+    FEC->>JIT: Recovered audio frames
     JIT->>JIT: BTreeMap ordered by seq
     JIT->>JIT: Wait until depth >= target
-
-    alt Packet present
-        JIT->>Codec: Pop lowest seq frame
-    else Packet missing (Opus)
-        JIT->>Codec: DRED reconstruction (neural)
-        alt DRED fails or unavailable
-            Codec->>Codec: Classical PLC fallback
-        end
-    else Packet missing (Codec2)
-        Codec->>Codec: Classical PLC
-    end
-
+    JIT->>Codec: Pop lowest seq frame
     Codec->>Ring: PCM i16 x 960
     Ring->>SPK: Audio callback pulls samples
 ```
@@ -203,8 +172,6 @@ sequenceDiagram
 - Jitter buffer target: **10 packets (200ms)** for client, **50 packets (1s)** for relay
 - Desktop client uses **direct playout** (no jitter buffer) with lock-free ring
 - Codec2 frames at 8 kHz are resampled to 48 kHz transparently
-- DRED reconstruction: on packet loss, decoder tries neural DRED reconstruction before falling back to classical PLC
-- Jitter-spike detection pre-emptively boosts DRED to ceiling when jitter variance spikes >30%
 
 ## Relay SFU Forwarding
 
@@ -244,7 +211,6 @@ graph TB
 3. If one send fails, the relay continues to the next participant (best-effort)
 4. The relay never decodes or re-encodes audio (preserves E2E encryption)
 5. With trunking enabled, packets to the same receiver are batched into TrunkFrames (flushed every 5ms)
-6. Relay tracks per-participant quality from QualityReport trailers and broadcasts `QualityDirective` when the room-wide tier degrades (coordinated codec switching)
 
 ## Federation Topology
 
@@ -382,7 +348,7 @@ Used for 49 of every 50 frames (~1s cycle). Saves 8 bytes per packet (67% header
   [session_id: 2][len: u16][payload: len]  x count
 ```
 
-Packs multiple session packets into one QUIC datagram. Maximum 10 entries or PMTUD-discovered MTU (starts at 1200, grows to ~1452 on Ethernet), flushed every 5ms.
+Packs multiple session packets into one QUIC datagram. Maximum 10 entries or 1200 bytes, flushed every 5ms.
 
 ### QualityReport (4 bytes, optional trailer)
 
@@ -395,40 +361,6 @@ Byte 3: bitrate_cap_kbps (0-255 kbps)
 
 Appended to a media packet when the Q flag is set in the MediaHeader.
 
-## Path MTU Discovery
-
-Quinn's PLPMTUD is enabled with:
-- `initial_mtu`: 1200 bytes (QUIC minimum, always safe)
-- `upper_bound`: 1452 bytes (Ethernet minus IP/UDP/QUIC headers)
-- `interval`: 300s (re-probe every 5 minutes)
-- `black_hole_cooldown`: 30s (faster retry on lossy links)
-
-The discovered MTU is exposed via `QuinnPathSnapshot::current_mtu` and used by:
-- `TrunkedForwarder`: refreshes `max_bytes` on every send to fill larger datagrams
-- Future video framer: larger MTU = fewer application-layer fragments per frame
-
-## Continuous DRED Tuning
-
-Instead of locking DRED duration to 3 discrete quality tiers, the `DredTuner` (in `wzp-proto::dred_tuner`) maps live path quality to a continuous DRED duration:
-
-| Input | Source | Update Rate |
-|-------|--------|-------------|
-| Loss % | `QuinnPathSnapshot::loss_pct` (from quinn ACK frames) | Every 25 packets (~500ms) |
-| RTT ms | `QuinnPathSnapshot::rtt_ms` (quinn congestion controller) | Every 25 packets |
-| Jitter ms | `PathMonitor::jitter_ms` (EWMA of RTT variance) | Every 25 packets |
-
-### Mapping Logic
-
-- **Baseline**: codec-tier default (Studio=100ms, Good=200ms, Degraded=500ms)
-- **Ceiling**: codec-tier max (Studio=300ms, Good=500ms, Degraded=1040ms)
-- **Continuous**: linear interpolation between baseline and ceiling based on loss (0%->baseline, 40%->ceiling)
-- **RTT phantom loss**: high RTT (>200ms) adds phantom loss contribution to keep DRED generous
-- **Jitter spike**: >30% EWMA spike pre-emptively boosts to ceiling for ~5s cooldown
-
-### Output
-
-`DredTuning { dred_frames: u8, expected_loss_pct: u8 }` -> fed to `CallEncoder::apply_dred_tuning()` -> `OpusEncoder::set_dred_duration()` + `set_expected_loss()`
-
 ## Signal Message Handshake Flow
 
 ```mermaid
@@ -1008,67 +940,3 @@ The patch introduces an `MSVC_CL` variable that is true only for real `cl.exe` (
 This does not affect macOS or Linux builds — on those platforms `MSVC=0` everywhere so the patched logic behaves identically to upstream.
 
 Upstream tracking: xiph/opus#256, xiph/opus PR #257 (both stale).
-
-## Network Awareness (Android)
-
-The adaptive quality controller (`AdaptiveQualityController` in `wzp-proto`) supports proactive network-aware adaptation via `signal_network_change(NetworkContext)`. On Android, this is fed by `NetworkMonitor.kt` which wraps `ConnectivityManager.NetworkCallback`.
-
-```
-ConnectivityManager
-       │ onCapabilitiesChanged / onLost
-       ▼
-NetworkMonitor.kt  ──classify──►  type: Int (WiFi=0, LTE=1, 5G=2, 3G=3)
-       │ onNetworkChanged(type, bw)
-       ▼
-CallViewModel  ──►  WzpEngine.onNetworkChanged()
-                        │ JNI
-                        ▼
-                    jni_bridge.rs
-                        │
-                        ▼
-                    EngineState.pending_network_type  (AtomicU8, lock-free)
-                        │ polled every ~20ms
-                        ▼
-                    recv task: quality_ctrl.signal_network_change(ctx)
-                        │
-                        ├─ WiFi → Cellular: preemptive 1-tier downgrade
-                        ├─ Any change: 10s FEC boost (+0.2 ratio)
-                        └─ Cellular: faster downgrade thresholds (2 vs 3)
-```
-
-Cellular generation is approximated from `getLinkDownstreamBandwidthKbps()` to avoid requiring `READ_PHONE_STATE` permission.
-
-## Audio Routing (Android)
-
-Both Android app variants support 3-way audio routing: **Earpiece → Speaker → Bluetooth SCO**.
-
-### Audio Mode Lifecycle
-
-`MODE_IN_COMMUNICATION` is set by the Rust call engine (via JNI `AudioManager.setMode()`) right before Oboe streams open — NOT at app launch. Restored to `MODE_NORMAL` when the call ends. This prevents hijacking system audio routing (music, BT A2DP) before a call is active.
-
-### Native Kotlin App
-
-`AudioRouteManager.kt` handles device detection (via `AudioDeviceCallback`), SCO lifecycle, and auto-fallback on BT disconnect. `CallViewModel.cycleAudioRoute()` cycles through available routes.
-
-### Tauri Desktop App
-
-`android_audio.rs` provides JNI bridges to `AudioManager` for speakerphone and Bluetooth SCO control. After each route change, Oboe streams are stopped and restarted via `spawn_blocking`.
-
-```
-User tap ──► cycleAudioRoute()
-                │
-                ├─ Earpiece: setSpeakerphoneOn(false) + clearCommunicationDevice()
-                ├─ Speaker:  setSpeakerphoneOn(true)
-                └─ BT SCO:   setCommunicationDevice(bt_device)  [API 31+]
-                │              fallback: startBluetoothSco()     [API < 31]
-                ▼
-            Oboe stop + start_bt() for BT / start() for others
-```
-
-### BT SCO and Oboe
-
-BT SCO only supports 8/16kHz. When `bt_active=1`, Oboe capture skips `setSampleRate(48000)` and `setInputPreset(VoiceCommunication)`, letting the system choose the native BT rate. Oboe's `SampleRateConversionQuality::Best` bridges to our 48kHz ring buffers. Playout uses `Usage::Media` in BT mode to avoid conflicts with the communication device routing.
-
-### Hangup Signal Fix
-
-`SignalMessage::Hangup` now carries an optional `call_id` field. The relay uses it to end only the specific call instead of broadcasting to all active calls for the user — preventing a race where a hangup for call 1 kills a newly-placed call 2.

docs/BRANCH-android-rewrite.md

@@ -0,0 +1,139 @@
+# Branch: `android-rewrite`
+
+Pivot away from the legacy Kotlin + JNI Android client to a pure-Rust **Tauri 2.x Mobile** app that shares the same frontend and backend code as the desktop client.
+
+## Why this branch exists
+
+The Kotlin + JNI stack was a crash factory. Every failure mode we hit was at the Kotlin ↔ Rust boundary, and each fix uncovered the next layer of the onion:
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| App crashed on launch before `onCreate` returned | `__init_tcb` / `pthread_create` bionic private symbols leaking out of `libwzp_android.so` because the Rust crate used `crate-type = ["cdylib", "staticlib"]`. rust-lang/rust#104707 documents that staticlib alongside cdylib leaks non-exported symbols from the staticlib into the cdylib, and Bionic's private internal pthread symbols got bound LOCALLY inside our `.so` instead of resolved against `libc.so` at `dlopen` time | Dropped `staticlib` from the crate-type list. `crate-type = ["cdylib", "rlib"]` only. |
+| Stack overflow on `place_call` | `Dispatchers.IO` threads have a ~512 KB stack, too small for the Rust signal-connect path that does TLS handshake + quinn setup inside one closure | Launched JNI calls from a dedicated `java.lang.Thread` with an explicit 8 MB stack |
+| `ring` / `libcrypto` TLS reuse crash on second call | tokio runtime got dropped between calls, but `ring` keeps a TLS-stored SSL context that is invalidated when the runtime thread is reused by a new runtime — `ring` sees stale context and segfaults | Single long-lived tokio runtime for the entire signal client lifetime; split `start()` into an inline `connect+register` path and a `run()` path on a separate thread to avoid the `thread::spawn` closure's stack overflow |
+| Null dereference on register with fresh install | Identity seed file empty when it existed-but-was-blank, Rust side deref'd the zero-length slice | Generate seed if empty on register |
+
+Every fix kept the app limping along but the fundamental design problem remained: **state management was split across a Kotlin ViewModel and a Rust engine, with a hand-rolled JNI bridge in between that had to be perfect to not crash**. The working desktop Tauri client (with the same Rust backend) had none of these problems because it spoke to the Rust code via in-process `invoke()` from a WebView, not JNI.
+
+So: rewrite the Android app as a **Tauri 2.x Mobile app**, reusing the entire desktop codebase verbatim (`main.ts`, `style.css`, `index.html`, `main.rs`, `engine.rs` — everything). Tauri Mobile added Android support in v2, it's production-ready, and it eliminates the JNI boundary entirely.
+
+The incident postmortem lives at [`docs/incident-tauri-android-init-tcb.md`](incident-tauri-android-init-tcb.md).
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────┐
+│                Tauri 2.x Mobile                  │
+│                                                  │
+│  Android WebView  ──────────  HTML/JS/CSS       │  ← Shared with desktop
+│         │                      (main.ts)         │
+│         │                                        │
+│    invoke() ─────────────── Rust Commands       │  ← Shared with desktop
+│                             (main.rs)            │
+│                               │                  │
+│              ┌───────────────┼────────────┐     │
+│              │               │            │     │
+│         SignalMgr        CallEngine   Identity  │  ← Shared crates
+│        (signal_hub)     (wzp-client) (wzp-crypto)│
+│              │               │                  │
+│              │               │                  │
+│              ▼               ▼                  │
+│        QUIC to relay    Oboe audio (Android)    │
+│                         via wzp-native cdylib   │
+└─────────────────────────────────────────────────┘
+```
+
+**What is reused from desktop verbatim** (zero rewrite):
+
+- `desktop/src/main.ts` — entire frontend
+- `desktop/src/style.css` — all styling
+- `desktop/src/identicon.ts` — identicon rendering
+- `desktop/index.html` — HTML structure
+- `desktop/src-tauri/src/main.rs` — all Tauri commands (`connect`, `disconnect`, `register_signal`, `place_call`, …)
+- `desktop/src-tauri/src/engine.rs` — `CallEngine` wrapper
+
+**What is Android-specific**:
+
+- `desktop/src-tauri/src/android_audio.rs` — JVM-side audio routing (`AudioManager.setSpeakerphoneOn` for earpiece/speaker toggle). Runs from Tauri's existing JNI context — no hand-rolled bridge, Tauri owns the JVM hookup.
+- `desktop/src-tauri/src/wzp_native.rs` — runtime `dlopen` of `libwzp_native.so`, a standalone cdylib crate (`crates/wzp-native`) that owns all C++ (Oboe bridge). Kept in its own crate so its C/C++ static archives never get statically linked into `wzp-desktop`'s `.so`, which would re-trigger the `__init_tcb` / pthread leak.
+- `crates/wzp-native/` — the standalone C++/Oboe bridge cdylib. Loaded via `libloading` at runtime from `wzp_native.rs`. Provides capture + playout streams using Oboe's `Usage::VoiceCommunication` + `MODE_IN_COMMUNICATION` combo.
+- Android-specific target dependencies in `desktop/src-tauri/Cargo.toml` (`jni`, `ndk-context`, `libloading`) — no CPAL, no VPIO.
+
+## Key architectural decisions
+
+### 1. `wzp-native` as a standalone cdylib loaded via `libloading`
+
+The alternative — linking `wzp-native` as a regular Rust dep with C++ static archives — would cause the same `__init_tcb` crash that killed the Kotlin version. By making `wzp-native` its own cdylib and `dlopen`-ing it at runtime, Bionic's `libc.so` resolves every symbol at load time the way it's supposed to, and no private TCB symbols leak.
+
+### 2. `crate-type = ["cdylib", "rlib"]` only (no `staticlib`)
+
+Same reason. The `rlib` output is needed so the `wzp-desktop` binary target can link against the library; `cdylib` is needed for Android's `System.loadLibrary`; `staticlib` would reintroduce the symbol-leak bug.
+
+### 3. Oboe audio config
+
+`Usage::VoiceCommunication` + Java-side `MODE_IN_COMMUNICATION`. **Never** call `setAudioApi(AAudio)` explicitly — on some devices (Nothing Phone in particular) it causes Oboe to open the wrong stream type and audio goes silent. Let Oboe pick the audio API automatically. This is documented in the auto-memory `project_tauri_android_audio.md`.
+
+### 4. Speaker/earpiece toggle uses `tokio::task::spawn_blocking`
+
+Oboe's `stop()` + `start()` cycle is synchronous and can block for 50–200 ms. Calling it on the tokio executor stalls every other async task (including the QUIC datagram loop), dropping audio packets. Wrapping the toggle in `spawn_blocking` isolates it to a dedicated thread pool. Fixed in commit `76a4c53`.
+
+## Build pipeline
+
+Docker on SepehrHomeserverdk, same pattern as the Android legacy pipeline and the Windows pipeline:
+
+```
+./scripts/build-tauri-android.sh         # Full: pull + build + ntfy + rustypaste
+./scripts/build-tauri-android.sh --pull  # Explicit git pull (default)
+./scripts/build-tauri-android.sh --clean # Blow away the Rust target cache
+```
+
+**Image**: `wzp-android-builder` (shared with the legacy Kotlin pipeline). The Dockerfile was extended to install Node.js 20 LTS, Android API level 36, build-tools 35.0.0, tauri-cli 2.x, and all four Android Rust targets on top of the legacy NDK 26.1 + cargo-ndk + Gradle setup. Both pipelines coexist in the same image.
+
+**Output**: `wzp-release.apk` uploaded to rustypaste, URL delivered via `ntfy.sh/wzp`.
+
+## Known quirks (Tauri Mobile specific)
+
+1. **tauri-cli `android init` writes absolute paths** into `gradle.properties` for the NDK path. Those paths are local to wherever `android init` was run, so they break any cross-machine build unless overridden with `ANDROID_NDK_HOME` at build time. The build script exports `ANDROID_NDK_HOME` explicitly to work around this.
+
+2. **API 36 vs API 34 coexistence**: the legacy Kotlin pipeline targets API 34, Tauri Mobile 2.x wants compileSdk 36. The shared Docker image installs both SDK levels so neither pipeline needs to reinstall.
+
+3. **Identity seed lives in Android-specific app data dir**: `/data/data/com.wzp.phone/files/.wzp/identity` instead of `$HOME/.wzp/identity`. The shared `load_or_create_seed()` function in `desktop/src-tauri/src/lib.rs` uses Tauri's `app_data_dir()` which resolves correctly on both Android and desktop — no per-platform code needed.
+
+4. **Direct calls on macOS previously hit an identity mismatch bug** — the `CallEngine` was using `$HOME/.wzp/identity` directly while `register_signal` used Tauri's `app_data_dir()`. Fixed by routing both through `load_or_create_seed()` (commit `2fd9465`). This was important for cross-platform consistency.
+
+## Current state (snapshot)
+
+What works:
+
+- Tauri Mobile scaffold builds and runs on Android
+- Signal hub connect + register works
+- Room mode (SFU group calls) works with Oboe audio
+- Direct 1:1 calls work with full parity to desktop
+- Speaker/earpiece toggle works without stalling the audio pipeline
+- Call history, recent contacts, deregister UI all present (inherited from desktop)
+
+What remains (task list refs in parens):
+
+- Background service for keeping signal alive when app is backgrounded (#19)
+- Proper permission requests (microphone, notifications) on first launch (#19)
+- Incoming call notification while backgrounded (#19)
+- App icon + splash screen (#19)
+
+## Testing
+
+- **Build**: `./scripts/build-tauri-android.sh` — verify the APK lands on rustypaste and installs on device.
+- **Smoke test**: Install → open app → Register → Place call → Receive call. No crashes, audio flows both ways.
+- **Speaker toggle**: During a call, toggle speaker/earpiece several times in rapid succession. Audio should never stop, and the toggle should respond within ~200 ms.
+- **Stress test**: Call for 10+ minutes continuous. No memory growth, no packet loss beyond what's attributable to the network.
+
+## Files of interest
+
+| Path | Purpose |
+|---|---|
+| `desktop/src-tauri/src/lib.rs` | Shared Tauri commands (desktop + Android) |
+| `desktop/src-tauri/src/android_audio.rs` | JVM-side speaker/earpiece routing |
+| `desktop/src-tauri/src/wzp_native.rs` | Runtime dlopen of libwzp_native.so |
+| `crates/wzp-native/` | Standalone C++/Oboe cdylib, loaded at runtime |
+| `scripts/build-tauri-android.sh` | Remote Docker build pipeline |
+| `scripts/Dockerfile.android-builder` | Shared Android Docker image (legacy + Tauri) |
+| `docs/incident-tauri-android-init-tcb.md` | Postmortem of the Kotlin+JNI crash cascade |

docs/BRANCH-desktop-audio-rewrite.md

@@ -1,164 +0,0 @@
-# Branch: `feat/desktop-audio-rewrite`
-
-Home of the Tauri desktop client for macOS, Windows, and Linux. Named "audio-rewrite" because the original driver was replacing a CPAL-only audio pipeline with platform-native backends that support OS-level echo cancellation (VoiceProcessingIO on macOS, WASAPI Communications on Windows), but the branch has grown into the full desktop story — Windows cross-compilation, vendored dependencies, history UI, direct calling, the whole thing.
-
-## Purpose
-
-The desktop client shares 100% of its frontend (`desktop/src/`) and Tauri command layer (`desktop/src-tauri/src/lib.rs`, `engine.rs`, `history.rs`) with the Android build on `android-rewrite`. Differences are limited to:
-
-- **Audio backends**, which are platform-gated via Cargo target-dep sections in `desktop/src-tauri/Cargo.toml` and feature flags in `crates/wzp-client/Cargo.toml`.
-- **Identity storage paths**, which resolve via Tauri's `app_data_dir()` (`~/Library/Application Support/…` on macOS, `%APPDATA%\…` on Windows, `~/.local/share/…` on Linux).
-- **Build toolchains**: native `cargo build` on macOS/Linux, `cargo xwin` cross-compile from Linux for Windows via Docker on SepehrHomeserverdk.
-
-## Audio backend matrix
-
-| Target | Capture | Playback | AEC |
-|---|---|---|---|
-| macOS | CPAL (WASAPI/CoreAudio via cpal crate) OR VoiceProcessingIO (native Core Audio) | CPAL | VoiceProcessingIO native AEC (when `vpio` feature enabled) |
-| Windows (default) | CPAL → WASAPI shared mode | CPAL → WASAPI shared mode | None |
-| Windows (AEC build) | Direct WASAPI with `IAudioClient2::SetClientProperties(AudioCategory_Communications)` | CPAL → WASAPI shared mode | **OS-level**: Windows routes the capture stream through the driver's communications APO chain (AEC + NS + AGC) |
-| Linux | CPAL → ALSA/PulseAudio | CPAL → ALSA/PulseAudio | None |
-
-The macOS VPIO path is gated behind the `vpio` feature in `wzp-client` and the `coreaudio-rs` dep is itself `cfg(target_os = "macos")`, so enabling the feature on Windows or Linux is a no-op.
-
-The Windows AEC path is gated behind the `windows-aec` feature, also target-gated (the `windows` crate dep is only pulled in on Windows), and re-exports `WasapiAudioCapture as AudioCapture` when enabled so downstream code doesn't need to know which backend is active. The current Windows build at `target/windows-exe/wzp-desktop.exe` has `windows-aec` on; a baseline noAEC build is preserved at `target/windows-exe/wzp-desktop-noAEC.exe` for A/B comparison on real hardware.
-
-See [`BRANCH-android-rewrite.md`](BRANCH-android-rewrite.md) for Oboe audio on Android, which is its own story.
-
-## Recent major work
-
-### 1. Desktop direct calling feature (commit `2fd9465` and neighbors)
-
-Brought direct 1:1 calls to macOS with full parity to the Android client:
-
-- **Identity path fix**: the desktop `CallEngine::start` was loading seed from `$HOME/.wzp/identity` while `register_signal` used Tauri's `app_data_dir()`, producing two different fingerprints per run. Both now route through `load_or_create_seed()` which uses `app_data_dir()` everywhere.
-- **Call history with dedup**: `history.rs` stores a `Vec<CallHistoryEntry>` with a `CallDirection` enum (`Placed | Received | Missed`). The `log` function dedupes by `call_id` so an outgoing call isn't logged twice as "missed" (when the signal loop's `DirectCallOffer` handler fires) and then again as "placed" (when `place_call` returns). Instead the entry is updated in place.
-- **Recent contacts row**: a horizontal chip UI in the direct-call panel showing the last N peers with friendly aliases, clickable to re-dial.
-- **Deregister button**: lets a user drop their signal registration without quitting the app, useful when switching identities.
-- **Random alias derivation**: a new client sees a human-friendly alias like "silent-forest-41" derived deterministically from its seed, so it's identifiable in the UI before manual naming.
-- **Default room "general"** instead of "android", since the desktop client is not Android.
-
-### 2. macOS VoiceProcessingIO integration
-
-`crates/wzp-client/src/audio_vpio.rs` — a native Core Audio implementation using `AUGraph` + `AudioComponentInstance` with the VPIO audio unit. Gives you hardware-accelerated AEC (same AEC Apple ships in FaceTime / iMessage audio / voice memos) at the cost of tight coupling to Apple frameworks. Lock-free ring pattern matches the CPAL path so the upper layers don't notice the difference.
-
-Enabled by `features = ["audio", "vpio"]` in the macOS target section of `desktop/src-tauri/Cargo.toml`.
-
-### 3. Windows cross-compilation via cargo-xwin
-
-Cross-compiling Rust + Tauri to `x86_64-pc-windows-msvc` from Linux using `cargo-xwin`, which downloads the Microsoft CRT + Windows SDK on demand and drives `clang-cl` as the compiler. No Windows machine is needed for the build itself — only for runtime testing.
-
-**Build infrastructure**:
-
-- `scripts/Dockerfile.windows-builder` — Debian bookworm + Rust + cargo-xwin + Node 20 + cmake + ninja + llvm + clang + lld + nasm. Pre-warms the xwin MSVC CRT cache at image build time (saves ~4 minutes per cold build).
-- `scripts/build-windows-docker.sh` — fire-and-forget remote build via Docker on SepehrHomeserverdk. Same pattern as `build-tauri-android.sh`. Uploads the `.exe` to rustypaste and fires an `ntfy.sh/wzp` notification on start and on completion.
-- `scripts/build-windows-cloud.sh` — alternative pipeline using a temporary Hetzner Cloud VPS. Slower (full VM spin-up), more expensive, but useful when Docker image rebuilds would be disruptive.
-
-**Two critical blockers resolved** on the way to a working `.exe`:
-
-1. **libopus SSE4.1 / SSSE3 intrinsic compile failure**. `audiopus_sys` vendors libopus 1.3.1, whose `CMakeLists.txt` gates the per-file `-msse4.1` `COMPILE_FLAGS` behind `if(NOT MSVC)`. Under `clang-cl`, CMake sets `MSVC=1` (because `CMAKE_C_COMPILER_FRONTEND_VARIANT=MSVC` triggers `Platform/Windows-MSVC.cmake` which unconditionally sets the variable), so the per-file flag is never set and the SSE4.1 source files compile without the target feature — then fail with 20+ "always_inline function '_mm_cvtepi16_epi32' requires target feature 'sse4.1'" errors.
-
-   Fixed by **vendoring audiopus_sys into `vendor/audiopus_sys/`** and patching its bundled libopus to introduce an `MSVC_CL` variable that is true only for real `cl.exe` (distinguished via `CMAKE_C_COMPILER_ID STREQUAL "MSVC"`). The eight `if(NOT MSVC)` SIMD guards are flipped to `if(NOT MSVC_CL)` and the global `/arch` block at line 445 becomes `if(MSVC_CL)`, so clang-cl gets the GCC-style per-file flags while real cl.exe keeps the `/arch:AVX` / `/arch:SSE2` globals.
-
-   Wired in via `[patch.crates-io] audiopus_sys = { path = "vendor/audiopus_sys" }` at the workspace root.
-
-   Upstream tracking: [xiph/opus#256](https://github.com/xiph/opus/issues/256), [xiph/opus PR #257](https://github.com/xiph/opus/pull/257) (both stale).
-
-2. **tauri-build needs `icons/icon.ico` for the Windows PE resource**. The desktop only had `icon.png`. Generated a multi-size ICO (16/24/32/48/64/128/256) from the existing placeholder via Pillow and committed it. Placeholder quality — real branded icons can replace it later.
-
-### 4. Windows `AudioCategory_Communications` capture path (task #24)
-
-`crates/wzp-client/src/audio_wasapi.rs` — direct WASAPI capture via `IMMDeviceEnumerator → IAudioClient2 → SetClientProperties` with `AudioCategory_Communications`. This tells Windows "this is a VoIP call" and Windows routes the capture stream through the driver's registered communications APO chain, which on most Win10/11 consumer hardware includes AEC, NS, and AGC.
-
-**Caveat**: quality is driver-dependent. On a machine with a good communications APO (Intel Smart Sound, Dolby, modern Realtek on Win11 24H2+, anything with Voice Clarity enabled) it's excellent. On generic class-compliant drivers with no communications APO registered, it's a no-op. For a guaranteed AEC regardless of driver, see task #26 which tracks implementing the classic Voice Capture DSP (`CLSID_CWMAudioAEC`) as a fallback.
-
-Gated behind the `windows-aec` feature in `wzp-client`. Enabled by default in the Windows target section of `desktop/src-tauri/Cargo.toml`.
-
-## Build pipelines
-
-### Native macOS / Linux
-
-```bash
-cd desktop
-npm install
-npm run build
-cd src-tauri
-cargo build --release --bin wzp-desktop
-```
-
-### Windows x86_64 via Docker on SepehrHomeserverdk
-
-```bash
-./scripts/build-windows-docker.sh                 # Full: pull + build + download
-./scripts/build-windows-docker.sh --no-pull       # Skip git fetch
-./scripts/build-windows-docker.sh --rust          # Force-clean Rust target
-./scripts/build-windows-docker.sh --image-build   # (Re)build the Docker image (fire-and-forget)
-```
-
-Output lands at `target/windows-exe/wzp-desktop.exe`. Both `wzp-desktop.exe` and `wzp-desktop-noAEC.exe` can coexist in that directory; the script writes `wzp-desktop.exe` so renaming the prior build to `-noAEC.exe` (or any other name) before rebuilding preserves it.
-
-### Windows x86_64 via Hetzner Cloud (alternative)
-
-```bash
-./scripts/build-windows-cloud.sh                  # Full: create VM → build → download → destroy
-./scripts/build-windows-cloud.sh --prepare        # Create VM and install deps only
-./scripts/build-windows-cloud.sh --build          # Build on existing VM
-./scripts/build-windows-cloud.sh --destroy        # Delete the VM
-WZP_KEEP_VM=1 ./scripts/build-windows-cloud.sh    # Keep VM alive after build for debug
-```
-
-Remember to destroy the VM at end of day with `--destroy`.
-
-### Linux x86_64 (relay + CLI + bench)
-
-```bash
-./scripts/build-linux-docker.sh                   # Fire-and-forget remote Docker build
-./scripts/build-linux-docker.sh --install         # Wait for completion and download
-```
-
-Uses the same `wzp-android-builder` Docker image as Android (not a separate image), since the deps (Rust + cmake + ring prereqs) are the same.
-
-## Testing
-
-### Direct calling parity
-
-1. Build on two machines (macOS + Windows, or two macOS, or any combination).
-2. Both machines register on the same relay.
-3. Copy one machine's fingerprint into the other's direct-call panel.
-4. Place the call. Confirm ringing UI on the callee and "calling…" UI on the caller.
-5. Answer. Confirm audio flows both ways.
-6. Hang up from either side. Confirm call-history entries are labeled correctly (`Outgoing` on caller, `Incoming` on callee, never `Missed` on a successful call).
-
-### Windows AEC A/B
-
-1. Install `wzp-desktop-noAEC.exe` and `wzp-desktop.exe` on the same Windows box.
-2. Join a call from each (separately) while a second machine plays known audio through the first machine's speakers.
-3. On the remote (listening) side: the `noAEC` call should have clear audible echo; the AEC call should have minimal or no echo after a 1–2 s convergence period.
-4. If both builds sound identical (with echo) → the `AudioCategory_Communications` switch isn't triggering the driver's APO chain. Investigate via task #26 (Voice Capture DSP fallback).
-
-## Known quirks
-
-1. **libopus vendor path is workspace-relative**. `[patch.crates-io] audiopus_sys = { path = "vendor/audiopus_sys" }` works from any crate in the workspace because Cargo resolves it against the root `Cargo.toml`'s directory. If the workspace is moved or vendored into another workspace, update the path.
-
-2. **`cargo xwin` overwrites `override.cmake` on every invocation**. Any attempt to patch `~/.cache/cargo-xwin/cmake/clang-cl/override.cmake` at Docker image build time is inert because `src/compiler/clang_cl.rs` line ~444 writes the bundled file fresh on every run. All real fixes must land in the source tree (via the vendored audiopus_sys, as done here), not in the cargo-xwin cache.
-
-3. **WebView2 runtime is a prerequisite on Windows 10**. Windows 11 ships with it. If the `.exe` launches and immediately exits with no error on a Win10 machine, that's the missing runtime — install it from [Microsoft's Evergreen bootstrapper](https://developer.microsoft.com/en-us/microsoft-edge/webview2/).
-
-4. **Rust 2024 edition `unsafe_op_in_unsafe_fn` lint**. The WASAPI backend in `audio_wasapi.rs` emits ~18 of these warnings because Rust 2024 requires explicit `unsafe { ... }` blocks inside `unsafe fn` bodies. The warnings don't block the build and don't affect runtime behavior; cleaning them up is tracked informally as tech debt.
-
-## Files of interest
-
-| Path | Purpose |
-|---|---|
-| `desktop/src/` | Shared frontend (TypeScript + HTML + CSS) |
-| `desktop/src-tauri/src/lib.rs` | Tauri commands shared with Android |
-| `desktop/src-tauri/src/engine.rs` | `CallEngine` wrapper |
-| `desktop/src-tauri/src/history.rs` | Persistent call history store with dedup |
-| `crates/wzp-client/src/audio_io.rs` | CPAL capture + playback (baseline) |
-| `crates/wzp-client/src/audio_vpio.rs` | macOS VoiceProcessingIO capture (AEC) |
-| `crates/wzp-client/src/audio_wasapi.rs` | Windows WASAPI communications capture (AEC) |
-| `vendor/audiopus_sys/opus/CMakeLists.txt` | Patched libopus for clang-cl SIMD |
-| `scripts/Dockerfile.windows-builder` | Windows cross-compile Docker image |
-| `scripts/build-windows-docker.sh` | Remote Docker build pipeline |
-| `scripts/build-windows-cloud.sh` | Hetzner VPS alternative pipeline |
-| `scripts/build-linux-docker.sh` | Linux x86_64 relay/CLI build pipeline |

docs/DESIGN.md

@@ -583,79 +583,9 @@ Signal messages are sent over reliable QUIC streams as length-prefixed JSON:
 | wzp-client | 30 + 2 integration | Encoder/decoder, quality adapter, silence, drift, sweep |
 | wzp-web | 2 | Metrics |
 
-## Audio Routing (Android)
-
-WarzonePhone supports three audio output routes on Android: **Earpiece**, **Speaker**, and **Bluetooth SCO**. The user cycles through available routes with a single button.
-
-### Audio mode lifecycle
-
-`MODE_IN_COMMUNICATION` is set **when the call engine starts** (right before Oboe `audio_start()`), not at app launch. This is critical — setting it early hijacks system audio routing (e.g. music drops from BT A2DP to earpiece). `MODE_NORMAL` is restored when the call engine stops.
-
-```
-App launch  → MODE_NORMAL (other apps' audio unaffected)
-Call start  → set_audio_mode_communication() → MODE_IN_COMMUNICATION
-Call end    → audio_stop() → set_audio_mode_normal() → MODE_NORMAL
-```
-
-### Route lifecycle
-
-1. Call starts → Earpiece (default).
-2. User taps route button → cycles to next available route.
-3. Route change requires Oboe stream restart (~60-400ms) because AAudio silently tears down streams on some OEMs when the routing target changes mid-stream.
-4. Bluetooth disconnect mid-call → `AudioDeviceCallback.onAudioDevicesRemoved` fires → auto-fallback to Earpiece or Speaker.
-
-### Bluetooth SCO
-
-SCO (Synchronous Connection Oriented) is the correct Bluetooth profile for VoIP — it provides bidirectional mono audio at 8/16 kHz with ~30ms latency. A2DP (stereo, high-quality) is unidirectional and adds 100-200ms of buffering, making it unsuitable for real-time voice.
-
-On API 31+ (Android 12), we use the modern `setCommunicationDevice(AudioDeviceInfo)` API to route audio to the BT SCO device. The deprecated `startBluetoothSco()` + `setBluetoothScoOn()` path is used as fallback on older APIs. `setBluetoothScoOn()` is silently rejected on Android 12+ for non-system apps.
-
-BT SCO devices only support 8/16kHz sample rates, but our pipeline runs at 48kHz. When BT is active, Oboe opens in **BT mode** (`bt_active=1`): capture skips `setSampleRate(48000)` and `setInputPreset(VoiceCommunication)`, letting the system open at the device's native rate. Oboe's `SampleRateConversionQuality::Best` resamples to/from 48kHz for our ring buffers.
-
-### Two app variants
-
-Both the native Kotlin app (`AudioRouteManager.kt`) and the Tauri app (`android_audio.rs` JNI bridge) support BT SCO routing. The native app uses `AudioDeviceCallback` for automatic device detection; the Tauri app uses `getAvailableCommunicationDevices()` (API 31+) or `getDevices()` on demand.
-
-## Network Change Response
-
-The `AdaptiveQualityController` in `wzp-proto` reacts to network transport changes signaled via `signal_network_change(NetworkContext)`:
-
-| Transition | Response |
-|-----------|----------|
-| WiFi → Cellular | Preemptive 1-tier quality downgrade + 10s FEC boost |
-| Cellular → WiFi | FEC boost only (quality recovers via normal adaptive logic) |
-| Any change | Reset hysteresis counters to avoid stale state |
-
-On Android, `NetworkMonitor.kt` wraps `ConnectivityManager.NetworkCallback` and classifies the transport type using bandwidth heuristics (no `READ_PHONE_STATE` needed). The classification is delivered to the Rust engine via JNI → `AtomicU8` → recv task polling — the same lock-free cross-task signaling pattern used for adaptive profile switches.
-
-### Cellular generation heuristics
-
-| Downstream bandwidth | Classification |
-|---------------------|---------------|
-| >= 100 Mbps | 5G NR |
-| >= 10 Mbps | LTE |
-| < 10 Mbps | 3G or worse |
-
-These thresholds are conservative. Carriers over-report bandwidth, but for VoIP quality decisions the exact generation matters less than the rough category.
-
 ## Build Requirements
 
 - **Rust** 1.85+ (2024 edition)
 - **Linux**: cmake, pkg-config, libasound2-dev (for audio feature)
 - **macOS**: Xcode command line tools (CoreAudio included)
-- **Android**: NDK 26.1 (r26b), cmake 3.25-3.28 (system package)
-
-### Android APK Builds
-
-```bash
-# arm64 only (default, 25MB release APK)
-./scripts/build-tauri-android.sh --init --release --arch arm64
-
-# armv7 only (smaller devices)
-./scripts/build-tauri-android.sh --init --release --arch armv7
-
-# both architectures as separate APKs
-./scripts/build-tauri-android.sh --init --release --arch all
-```
-
-Release APKs are signed with `android/keystore/wzp-release.jks` via `apksigner`. Per-arch builds produce separate APKs (~25MB each vs ~50MB universal) for easier sharing with testers.
+- **Android**: NDK r27c, cmake 3.28+ (from pip)

docs/PRD-bluetooth-audio.md

@@ -1,105 +0,0 @@
-# PRD: Bluetooth Audio Routing
-
-> Phase: Implemented  
-> Status: Ready for testing  
-> Platforms: Android (native Kotlin app + Tauri desktop app)
-
-## Problem
-
-WarzonePhone had `AudioRouteManager.kt` with complete Bluetooth SCO support, but it was disconnected from both UIs. Users with Bluetooth headsets had no way to route call audio to them.
-
-## Solution
-
-Wire Bluetooth SCO routing end-to-end through both app variants, replacing the binary speaker toggle with a 3-way audio route cycle: **Earpiece → Speaker → Bluetooth**.
-
-## Architecture
-
-```
-┌─────────────────────────────────────────────────────┐
-│ Native Kotlin App (com.wzp)                         │
-│                                                     │
-│  InCallScreen ──► CallViewModel ──► AudioRouteManager
-│  (Compose UI)     cycleAudioRoute()  setSpeaker()   │
-│  "Ear/Spk/BT"    audioRoute Flow     setBluetoothSco()
-│                                      isBluetoothAvailable()
-└─────────────────────────────────────────────────────┘
-
-┌─────────────────────────────────────────────────────┐
-│ Tauri Desktop App (com.wzp.desktop)                 │
-│                                                     │
-│  main.ts ──► Tauri Commands ──► android_audio.rs    │
-│  cycleAudioRoute()  set_bluetooth_sco()  JNI calls  │
-│  "Ear/Spk/BT"      is_bluetooth_available()         │
-│                     get_audio_route()                │
-│                                                     │
-│  After each route change: Oboe stop + start         │
-│  (spawn_blocking to avoid stalling tokio)           │
-└─────────────────────────────────────────────────────┘
-```
-
-## Components Modified
-
-### Native Kotlin App
-
-| File | Change |
-|------|--------|
-| `CallViewModel.kt` | Added `audioRoute: StateFlow<AudioRoute>`, `cycleAudioRoute()`, wired `onRouteChanged` callback |
-| `InCallScreen.kt` | `ControlRow` now takes `audioRoute: AudioRoute` + `onCycleRoute`, displays Ear/Spk/BT with distinct colors |
-
-### Tauri App
-
-| File | Change |
-|------|--------|
-| `android_audio.rs` | `setCommunicationDevice()` (API 31+) with `startBluetoothSco()` fallback; `set_audio_mode_communication/normal()` for call lifecycle |
-| `lib.rs` | `set_bluetooth_sco`, `is_bluetooth_available`, `get_audio_route` Tauri commands; SCO polling + 500ms route delay |
-| `wzp_native.rs` | Added `audio_start_bt()` for BT-mode Oboe (skips 48kHz + VoiceCommunication preset) |
-| `oboe_bridge.cpp` | `bt_active` flag: capture skips sample rate + input preset; playout uses `Usage::Media`; both use `Shared` mode + `SampleRateConversionQuality::Best` |
-| `engine.rs` | `set_audio_mode_communication()` before `audio_start()`; `set_audio_mode_normal()` after `audio_stop()` |
-| `MainActivity.kt` | Removed `MODE_IN_COMMUNICATION` from app launch — deferred to call start |
-| `main.ts` | Replaced `speakerphoneOn` toggle with `currentAudioRoute` cycling logic |
-| `style.css` | Added `.bt-on` CSS class (blue-400 highlight) |
-
-## Audio Route Lifecycle
-
-1. **App launch** → `MODE_NORMAL` (other apps' audio unaffected — BT A2DP music keeps playing)
-2. **Call starts** → `MODE_IN_COMMUNICATION` set via JNI, Oboe opens with earpiece routing
-3. **User taps route button** → cycles to next available route
-4. **Route changes** → `setCommunicationDevice()` (API 31+) + Oboe restart in BT mode or normal mode
-5. **BT device disconnects mid-call** → `AudioDeviceCallback.onAudioDevicesRemoved` fires → auto-fallback to Earpiece/Speaker
-6. **Call ends** → route reset, `MODE_NORMAL` restored
-
-## Route Cycling Logic
-
-```
-Available routes = [Earpiece, Speaker] + [Bluetooth] if SCO device connected
-
-Tap cycle:
-  Earpiece → Speaker → Bluetooth (if available) → Earpiece → ...
-
-If BT not available:
-  Earpiece → Speaker → Earpiece → ...
-```
-
-## Permissions
-
-- `BLUETOOTH_CONNECT` (Android 12+) — already in `AndroidManifest.xml`
-- `MODIFY_AUDIO_SETTINGS` — already in manifest
-
-## Known Limitations
-
-- **SCO only** — no A2DP (stereo music profile). SCO is correct for VoIP (bidirectional mono).
-- **API 31+ required for modern path** — `setCommunicationDevice()` is the primary BT routing API. Fallback to deprecated `startBluetoothSco()` on API < 31 (untested).
-- **BT SCO capture at 8/16kHz** — Oboe resamples to 48kHz via `SampleRateConversionQuality::Best`. Quality is inherently limited by the SCO codec (CVSD at 8kHz or mSBC at 16kHz).
-- **No auto-switch on BT connect** — when a BT device connects mid-call, user must tap the route button.
-- **500ms route switch delay** — after `setCommunicationDevice()` returns, the audio policy needs time to apply the bt-sco route. We wait 500ms before restarting Oboe.
-
-## Testing
-
-1. Pair a Bluetooth SCO headset with Android device
-2. Start call → verify Earpiece is default
-3. Tap route → Speaker (audio moves to loudspeaker, button shows "Spk")
-4. Tap route → BT (audio moves to headset, button shows "BT", blue highlight)
-5. Tap route → Earpiece (audio back to earpiece, button shows "Ear")
-6. Disconnect BT mid-call → verify auto-fallback
-7. Verify both app variants work identically
-8. Verify no audio glitches during route transitions

docs/PRD-coordinated-codec.md

@@ -196,19 +196,3 @@ Implementation strategy: build for P2P first (simpler, 2 parties), then wrap the
 | 4 | Upgrade proposal + negotiation protocol | 2 days |
 | 5 | P2P quality adaptation (direct observation) | 1 day |
 | 6 | Per-participant asymmetric encoding (Option 2) | 1 day |
-
-## Implementation Status (2026-04-12)
-
-Phases 1-2 are now implemented:
-
-### What was built
-
-- **`QualityDirective` signal** (`crates/wzp-proto/src/packet.rs`): New `SignalMessage` variant with `recommended_profile` and optional `reason`
-- **`ParticipantQuality`** (`crates/wzp-relay/src/room.rs`): Per-participant quality tracking using `AdaptiveQualityController`, created on join, removed on leave
-- **Weakest-link broadcast**: `observe_quality()` method computes room-wide worst tier, broadcasts `QualityDirective` to all participants when tier changes
-- **Desktop engine handling** (`desktop/src-tauri/src/engine.rs`): `AdaptiveQualityController` in recv task, `pending_profile` AtomicU8 bridge to send task, auto-mode profile switching
-
-### Phases 3-4 remaining
-
-- Phase 3: Client-side handling of `QualityDirective` (reacting to relay-pushed profile)
-- Phase 4: Upgrade proposal/negotiation protocol for quality recovery