fix(chat): use async save dialog for attachments

The Save-attachment handler called the blocking rfd::FileDialog::save_file() directly inside iced's update() loop. That blocking dialog spins its own GTK loop; invoked from within iced's already-running event loop (notably the Linux xdg-desktop-portal/GTK backend, but also observed wedged on Windows) the dialog becomes unresponsive — Save/Cancel clicks are never processed. Convert to rfd::AsyncFileDialog returning a Task, mirroring the existing file *picker* paths (PickAttachmentFile / PickAvatarFile / PickBackgroundFile) which already use the async variant. The chosen path's bytes are written when the future resolves; the status line is reported via a new AttachmentSaved message. No blocking call remains in the update loop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Update package version for 0.3.0
2026-06-21 03:43:12 -04:00 · 2026-06-21 02:03:07 -04:00 · 2026-06-21 02:02:37 -04:00 · 2026-06-21 01:45:43 -04:00 · 2026-06-21 01:41:57 -04:00 · 2026-06-21 01:05:24 -04:00
45 changed files with 5092 additions and 274 deletions
@@ -0,0 +1,21 @@
+# PeerSpeak Codebase Layout and Architecture Rules
+
+When working in the PeerSpeak repository, adhere to the following architectural boundaries and layout:
+
+## Code Layout
+- `src/main.rs`: The application entry point (initializes Tokio and the Iced GUI).
+- `src/app/`: The UI layer (Iced). Handles themes, views (Home, Room, Settings), and visual state. Must communicate with the core via message passing (`UiEvent`/`CoreCommand`), not direct function calls.
+- `src/core/`: The central orchestrator. 
+  - `mod.rs`: Manages the session lifecycle, ties together network and UI, and manages the async mixer tasks.
+  - `jitter.rs`: Houses the adaptive playout delay JitterBuffer and Packet Loss Concealment (PLC) logic.
+- `src/network/`: The "Dual-Plane" transport layer.
+  - `gossip.rs` (Control Plane): Built on `iroh-gossip`. Manages room rosters, verified membership, presence, and chat via cryptographically signed envelopes.
+  - `iroh_impl.rs` (Data Plane): Manages raw QUIC endpoints and peer connections. Forwards UDP voice datagrams directly to peers for minimum latency.
+- `src/audio/`: Hardware audio backends.
+  - Interfaces heavily with `cpal_impl.rs` (Windows/WASAPI) and `pipewire_impl.rs` (Linux). 
+  - **CRITICAL RULE**: The RT audio callbacks are strictly lock-free. They communicate with the async core exclusively via Single-Producer Single-Consumer (SPSC) ring buffers (`HeapRb`). Never allocate memory, log to stdout, or lock Mutexes on the RT threads.
+- `src/codec/`: Audio compression abstractions, standardizing on Opus at 48kHz mono (`opus_impl.rs`).
+
+## General Directives
+- **Security**: Audio admission is strictly derived from the verified gossip roster (S8). Never trust raw UDP sender IDs without validating against gossip.
+- **Latency**: Preserve the deterministic dialer vs acceptor logic in the QUIC layer to prevent connection loops.
@@ -6,3 +6,8 @@
 /packaging/peerspeak/
 /packaging/*.pkg.tar.*
 /packaging/*.log
+
+# Windows installer build artifacts (the staged exe + compiled setup.exe);
+# the .iss script and .ico are the tracked sources.
+/packaging/windows/peerspeak.exe
+/packaging/windows/output/
@@ -117,6 +117,18 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "alsa"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c88dbbce13b232b26250e1e2e6ac18b6a891a646b8148285036ebce260ac5c3"
+dependencies = [
+ "alsa-sys",
+ "bitflags 2.11.1",
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "alsa-sys"
 version = "0.3.1"
@@ -1041,6 +1053,20 @@ dependencies = [
 "coreaudio-sys",
 ]

+[[package]]
+name = "coreaudio-rs"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aae284fbaf7d27aa0e292f7677dfbe26503b0d555026f702940805a630eac17"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "objc2-audio-toolbox",
+ "objc2-core-audio",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "coreaudio-sys"
 version = "0.2.18"
@@ -1080,14 +1106,14 @@ version = "0.15.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "873dab07c8f743075e57f524c583985fbaf745602acbe916a01539364369a779"
 dependencies = [
- "alsa",
+ "alsa 0.9.1",
 "core-foundation-sys",
- "coreaudio-rs",
+ "coreaudio-rs 0.11.3",
 "dasp_sample",
 "jni 0.21.1",
 "js-sys",
 "libc",
- "mach2",
+ "mach2 0.4.3",
 "ndk 0.8.0",
 "ndk-context",
 "oboe",
@@ -1097,6 +1123,36 @@ dependencies = [
 "windows 0.54.0",
 ]

+[[package]]
+name = "cpal"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b1f9c7312f19fc2fa12fd7acaf38de54e8320ba10d1a02dcbe21038def51ccb"
+dependencies = [
+ "alsa 0.10.0",
+ "coreaudio-rs 0.13.0",
+ "dasp_sample",
+ "jni 0.21.1",
+ "js-sys",
+ "libc",
+ "mach2 0.5.0",
+ "ndk 0.9.0",
+ "ndk-context",
+ "num-derive",
+ "num-traits",
+ "objc2 0.6.4",
+ "objc2-audio-toolbox",
+ "objc2-avf-audio",
+ "objc2-core-audio",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows 0.62.2",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1564,6 +1620,15 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"

+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -1699,6 +1764,12 @@ dependencies = [
 "zune-inflate",
 ]

+[[package]]
+name = "extended"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af9673d8203fcb076b19dfd17e38b3d4ae9f44959416ea532ce72415a6020365"
+
 [[package]]
 name = "fastrand"
 version = "2.4.1"
@@ -2557,6 +2628,7 @@ dependencies = [
 "iced_core",
 "log",
 "rustc-hash 2.1.2",
+ "tokio",
 "wasm-bindgen-futures",
 "wasmtimer",
 ]
@@ -3565,6 +3637,15 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "mach2"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a1b95cd5421ec55b445b5ae102f5ea0e768de1f82bd3001e11f426c269c3aea"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "malloc_buf"
 version = "0.0.6"
@@ -4252,6 +4333,31 @@ dependencies = [
 "objc2-quartz-core 0.3.2",
 ]

+[[package]]
+name = "objc2-audio-toolbox"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6948501a91121d6399b79abaa33a8aa4ea7857fe019f341b8c23ad6e81b79b08"
+dependencies = [
+ "bitflags 2.11.1",
+ "libc",
+ "objc2 0.6.4",
+ "objc2-core-audio",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-avf-audio"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13a380031deed8e99db00065c45937da434ca987c034e13b87e4441f9e4090be"
+dependencies = [
+ "objc2 0.6.4",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "objc2-cloud-kit"
 version = "0.2.2"
@@ -4287,6 +4393,29 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

+[[package]]
+name = "objc2-core-audio"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1eebcea8b0dbff5f7c8504f3107c68fc061a3eb44932051c8cf8a68d969c3b2"
+dependencies = [
+ "dispatch2",
+ "objc2 0.6.4",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-core-audio-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
+dependencies = [
+ "bitflags 2.11.1",
+ "objc2 0.6.4",
+]
+
 [[package]]
 name = "objc2-core-data"
 version = "0.2.2"
@@ -4742,13 +4871,13 @@ checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"

 [[package]]
 name = "peerspeak"
-version = "0.2.0"
+version = "0.3.0"
 dependencies = [
 "anyhow",
 "async-trait",
 "base64",
 "bytes",
- "cpal",
+ "cpal 0.15.3",
 "dirs",
 "iced",
 "image",
@@ -4759,6 +4888,7 @@ dependencies = [
 "rand 0.10.1",
 "rfd",
 "ringbuf",
+ "rodio",
 "serde",
 "serde_json",
 "thiserror 2.0.18",
@@ -5198,6 +5328,16 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"

+[[package]]
+name = "rand_distr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d431c2703ccf129de4d45253c03f49ebb22b97d6ad79ee3ecfc7e3f4862c1d8"
+dependencies = [
+ "num-traits",
+ "rand 0.10.1",
+]
+
 [[package]]
 name = "rand_pcg"
 version = "0.10.2"
@@ -5487,12 +5627,34 @@ dependencies = [
 "portable-atomic-util",
 ]

+[[package]]
+name = "rodio"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a536bb79db59098ef71a4dd4246c02eb87b316deceb1b68e0cde7167ec01eb"
+dependencies = [
+ "cpal 0.17.1",
+ "dasp_sample",
+ "num-rational",
+ "rand 0.10.1",
+ "rand_distr",
+ "rtrb",
+ "symphonia",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "roxmltree"
 version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"

+[[package]]
+name = "rtrb"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ade083ccbb4bf536df69d1f6432cc23deb7acccff86b183f3923a6fd56a1153"
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -6156,6 +6318,153 @@ dependencies = [
 "zeno",
 ]

+[[package]]
+name = "symphonia"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5773a4c030a19d9bfaa090f49746ff35c75dfddfa700df7a5939d5e076a57039"
+dependencies = [
+ "lazy_static",
+ "symphonia-bundle-flac",
+ "symphonia-bundle-mp3",
+ "symphonia-codec-aac",
+ "symphonia-codec-pcm",
+ "symphonia-codec-vorbis",
+ "symphonia-core",
+ "symphonia-format-isomp4",
+ "symphonia-format-ogg",
+ "symphonia-format-riff",
+ "symphonia-metadata",
+]
+
+[[package]]
+name = "symphonia-bundle-flac"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91565e180aea25d9b80a910c546802526ffd0072d0b8974e3ebe59b686c9976"
+dependencies = [
+ "log",
+ "symphonia-core",
+ "symphonia-metadata",
+ "symphonia-utils-xiph",
+]
+
+[[package]]
+name = "symphonia-bundle-mp3"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4872dd6bb56bf5eac799e3e957aa1981086c3e613b27e0ac23b176054f7c57ed"
+dependencies = [
+ "lazy_static",
+ "log",
+ "symphonia-core",
+ "symphonia-metadata",
+]
+
+[[package]]
+name = "symphonia-codec-aac"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c263845aa86881416849c1729a54c7f55164f8b96111dba59de46849e73a790"
+dependencies = [
+ "lazy_static",
+ "log",
+ "symphonia-core",
+]
+
+[[package]]
+name = "symphonia-codec-pcm"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e89d716c01541ad3ebe7c91ce4c8d38a7cf266a3f7b2f090b108fb0cb031d95"
+dependencies = [
+ "log",
+ "symphonia-core",
+]
+
+[[package]]
+name = "symphonia-codec-vorbis"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f025837c309cd69ffef572750b4a2257b59552c5399a5e49707cc5b1b85d1c73"
+dependencies = [
+ "log",
+ "symphonia-core",
+ "symphonia-utils-xiph",
+]
+
+[[package]]
+name = "symphonia-core"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea00cc4f79b7f6bb7ff87eddc065a1066f3a43fe1875979056672c9ef948c2af"
+dependencies = [
+ "arrayvec",
+ "bitflags 1.3.2",
+ "bytemuck",
+ "lazy_static",
+ "log",
+]
+
+[[package]]
+name = "symphonia-format-isomp4"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "243739585d11f81daf8dac8d9f3d18cc7898f6c09a259675fc364b382c30e0a5"
+dependencies = [
+ "encoding_rs",
+ "log",
+ "symphonia-core",
+ "symphonia-metadata",
+ "symphonia-utils-xiph",
+]
+
+[[package]]
+name = "symphonia-format-ogg"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b4955c67c1ed3aa8ae8428d04ca8397fbef6a19b2b051e73b5da8b1435639cb"
+dependencies = [
+ "log",
+ "symphonia-core",
+ "symphonia-metadata",
+ "symphonia-utils-xiph",
+]
+
+[[package]]
+name = "symphonia-format-riff"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d7c3df0e7d94efb68401d81906eae73c02b40d5ec1a141962c592d0f11a96f"
+dependencies = [
+ "extended",
+ "log",
+ "symphonia-core",
+ "symphonia-metadata",
+]
+
+[[package]]
+name = "symphonia-metadata"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36306ff42b9ffe6e5afc99d49e121e0bd62fe79b9db7b9681d48e29fa19e6b16"
+dependencies = [
+ "encoding_rs",
+ "lazy_static",
+ "log",
+ "symphonia-core",
+]
+
+[[package]]
+name = "symphonia-utils-xiph"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27c85ab799a338446b68eec77abf42e1a6f1bb490656e121c6e27bfbab9f16"
+dependencies = [
+ "symphonia-core",
+ "symphonia-metadata",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.117"
@@ -1,6 +1,6 @@
 [package]
 name = "peerspeak"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2024"
 # Application crate, not a crates.io library — refuse `cargo publish` and let
 # cargo-deny's [licenses.private] skip the missing-license check.
@@ -28,7 +28,7 @@ async-trait = "0.1.89"
 base64 = "0.22.1"
 bytes = "1.11.1"
 dirs = "6.0.0"
-iced = { version = "0.14.0", features = ["canvas", "image"] }
+iced = { version = "0.14.0", features = ["canvas", "image", "tokio"] }
 # W4 custom avatars: decode/resize an arbitrary user image (png/jpeg only to keep
 # the codec surface small). The matching native file picker (`rfd`) is platform-
 # gated below — its backend differs per OS (xdg-portal on Linux, Win32 on Windows).
@@ -38,6 +38,7 @@ iroh-gossip = "0.99.0"
 opus = "0.3.1"
 rand = "0.10.1"
 ringbuf = "0.5.0"
+rodio = "0.22.2"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 thiserror = "2.0.18"
@@ -1,41 +1,66 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <svg width="256" height="256" viewBox="0 0 256 256" xmlns="http://www.w3.org/2000/svg">
-  <!-- PeerSpeak app icon: in-app mic glyph + P2P mesh nodes, Catppuccin Mocha. -->
+  <title>PeerSpeak</title>
+  <desc>Two luminous voices meet directly to form a flowing S.</desc>
  <defs>
-    <linearGradient id="tile" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0" stop-color="#1e1e2e"/>
-      <stop offset="1" stop-color="#181825"/>
+    <linearGradient id="tile" x1="32" y1="20" x2="225" y2="239" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#101d42"/>
+      <stop offset="0.5" stop-color="#071225"/>
+      <stop offset="1" stop-color="#160b31"/>
    </linearGradient>
+    <linearGradient id="voice" x1="45" y1="76" x2="214" y2="184" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#35efff"/>
+      <stop offset="0.42" stop-color="#2583ff"/>
+      <stop offset="0.68" stop-color="#8a42ff"/>
+      <stop offset="1" stop-color="#ff3cdd"/>
+    </linearGradient>
+    <linearGradient id="edge" x1="30" y1="31" x2="225" y2="231" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#2fe9ff" stop-opacity="0.7"/>
+      <stop offset="0.48" stop-color="#386dff" stop-opacity="0.18"/>
+      <stop offset="1" stop-color="#eb42ff" stop-opacity="0.65"/>
+    </linearGradient>
+    <radialGradient id="core">
+      <stop stop-color="#ffffff"/>
+      <stop offset="0.28" stop-color="#baf7ff"/>
+      <stop offset="0.62" stop-color="#7b67ff" stop-opacity="0.65"/>
+      <stop offset="1" stop-color="#7b67ff" stop-opacity="0"/>
+    </radialGradient>
+    <filter id="shadow" x="-35%" y="-35%" width="170%" height="170%">
+      <feGaussianBlur stdDeviation="6"/>
+    </filter>
+    <filter id="soft-shadow" x="-20%" y="-20%" width="140%" height="150%">
+      <feDropShadow dx="0" dy="7" stdDeviation="7" flood-color="#000611" flood-opacity="0.8"/>
+    </filter>
  </defs>

-  <!-- Rounded-square tile -->
-  <rect x="20" y="20" width="216" height="216" rx="48" fill="url(#tile)"
-        stroke="#313244" stroke-width="3"/>
+  <!-- A dark stage makes the cyan/violet conversation mark legible at taskbar size. -->
+  <rect x="8" y="8" width="240" height="240" rx="55" fill="url(#tile)"/>
+  <rect x="9.5" y="9.5" width="237" height="237" rx="53.5" fill="none" stroke="url(#edge)" stroke-width="3"/>

-  <!-- P2P mesh: edges (under nodes + mic) -->
-  <g stroke="#45475a" stroke-width="6" stroke-linecap="round" fill="none">
-    <line x1="74"  y1="74"  x2="128" y2="128"/>
-    <line x1="182" y1="74"  x2="128" y2="128"/>
-    <line x1="74"  y1="182" x2="128" y2="128"/>
-    <line x1="182" y1="182" x2="128" y2="128"/>
-    <line x1="74"  y1="74"  x2="182" y2="74"/>
-    <line x1="74"  y1="182" x2="182" y2="182"/>
-  </g>
+  <!-- Broad color glow, kept behind the silhouette. -->
+  <path d="M36 128 C50 128 48 101 60 101 C72 101 68 153 81 153 C94 153 90 112 104 112 C115 112 116 128 128 128 C140 128 141 144 152 144 C166 144 162 103 175 103 C188 103 184 155 196 155 C208 155 206 128 220 128"
+        fill="none" stroke="url(#voice)" stroke-width="25" stroke-linecap="round"
+        opacity="0.5" filter="url(#shadow)"/>

-  <!-- P2P mesh: peer nodes -->
-  <g fill="#b4befe">
-    <circle cx="74"  cy="74"  r="11"/>
-    <circle cx="182" cy="74"  r="11"/>
-    <circle cx="74"  cy="182" r="11"/>
-    <circle cx="182" cy="182" r="11"/>
-  </g>
+  <!-- The two waveform halves are equal peers and meet at one bright point. -->
+  <path d="M36 128 C50 128 48 101 60 101 C72 101 68 153 81 153 C94 153 90 112 104 112 C115 112 116 128 128 128"
+        fill="none" stroke="url(#voice)" stroke-width="17" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M128 128 C140 128 141 144 152 144 C166 144 162 103 175 103 C188 103 184 155 196 155 C208 155 206 128 220 128"
+        fill="none" stroke="url(#voice)" stroke-width="17" stroke-linecap="round" stroke-linejoin="round"/>

-  <!-- Microphone (hero) — same geometry as the in-app Mic icon, scaled 6.4x -->
-  <g fill="none" stroke="#89b4fa" stroke-width="13"
-     stroke-linecap="round" stroke-linejoin="round">
-    <rect x="108.8" y="68.8" width="38.4" height="70.4" rx="19.2"/>
-    <path d="M 169.6 123.2 A 41.6 41.6 0 0 0 86.4 123.2"/>
-    <line x1="128" y1="164.8" x2="128" y2="187.2"/>
-    <line x1="105.6" y1="187.2" x2="150.4" y2="187.2"/>
-  </g>
+  <!-- A single flowing connection turns the conversation into PeerSpeak's S-mark. -->
+  <path d="M160 66 C142 52 108 57 101 78 C94 98 113 111 128 119 C148 130 163 141 157 164 C151 188 117 199 94 184"
+        fill="none" stroke="#050b1b" stroke-opacity="0.72" stroke-width="33"
+        stroke-linecap="round" stroke-linejoin="round" filter="url(#soft-shadow)"/>
+  <path d="M160 66 C142 52 108 57 101 78 C94 98 113 111 128 119 C148 130 163 141 157 164 C151 188 117 199 94 184"
+        fill="none" stroke="url(#voice)" stroke-width="25"
+        stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M157 65 C139 56 113 62 108 79" fill="none" stroke="#bdf9ff"
+        stroke-opacity="0.68" stroke-width="4" stroke-linecap="round"/>
+  <path d="M153 166 C146 184 118 192 98 181" fill="none" stroke="#f4a8ff"
+        stroke-opacity="0.52" stroke-width="4" stroke-linecap="round"/>
+
+  <!-- The direct connection is the brightest and simplest detail. -->
+  <circle cx="128" cy="128" r="30" fill="url(#core)" opacity="0.78" filter="url(#shadow)"/>
+  <circle cx="128" cy="128" r="6.5" fill="#ffffff"/>
 </svg>
@@ -68,9 +68,9 @@ connections are expected and valid.
 | Echo cancellation | Linux-only PipeWire feature. The Windows UI shows it disabled as unavailable. |
 | Screen share | Requires a Windows `pixelpass.exe` on `PATH` or a configured override. |
 | Chimes | Now routed through Windows `SoundPlayer`; needs a real Windows host to audibly verify. |
-| Resampling/device format | Open. Devices must support 48 kHz, and output must support stereo; a 44.1 kHz-only/default device currently errors instead of playing. |
+| Resampling/device format | Cross-compiled. cpal/WASAPI now chooses native 48 kHz when available and otherwise resamples/remaps at the device boundary; needs real Windows hardware audio verification. |
 | Device persistence | Open. WASAPI friendly names may duplicate or change across driver/profile changes. |
-| Playback pacing | Open. The fixed playback target under WASAPI shared mode still needs real-hardware verification. |
+| Playback pacing | Cross-compiled. The fixed playback target under WASAPI shared mode still needs real-hardware verification with `audio_probe`. |

 Before calling Windows support done, verify a real Windows machine can create/join a room,
 capture mic audio, hear remote audio, select devices, restart with selections preserved, and
@@ -1,7 +1,7 @@
 # Maintainer: mollusk <jitty+lc1iz0dc@protonmail.com>
 pkgname=peerspeak-git
 _pkgname=peerspeak
-pkgver=0.1.0
+pkgver=0.3.0.r229.g7fb1c96
 pkgrel=1
 pkgdesc="Decentralized peer-to-peer voice chat (Rust/iroh/PipeWire/Opus/iced)"
 arch=('x86_64')
@@ -0,0 +1,112 @@
+# Maintainer: mollusk <jitty+lc1iz0dc@protonmail.com>
+#
+# Test-pack split package: ONE `makepkg -si` builds + installs BOTH peerspeak
+# (voice chat) and pixelpass (screen sharing) from the public gitbutter repos
+# over https. pixelpass lands on /usr/bin so peerspeak's screen-share button
+# finds it. Shared version string is derived from peerspeak's git.
+#
+# Clone this repo and build from here:
+#   git clone https://gitbutter.xyz/mollusk/peerspeak.git
+#   cd peerspeak/packaging/test-pack
+#   makepkg -si
+pkgbase=peerspeak-git
+pkgname=('peerspeak-git' 'pixelpass')
+pkgver=0.1.0
+pkgrel=1
+arch=('x86_64')
+url="https://gitbutter.xyz/mollusk/peerspeak"
+license=('custom' 'MIT' 'Apache-2.0' 'OFL-1.1')
+makedepends=('git' 'cargo' 'pkgconf')
+options=('!lto' '!debug')
+source=("peerspeak::git+https://gitbutter.xyz/mollusk/peerspeak.git"
+        "pixelpass::git+https://gitbutter.xyz/mollusk/pixelpass.git#branch=main")
+sha256sums=('SKIP'
+            'SKIP')
+
+pkgver() {
+  cd "$srcdir/peerspeak"
+  # Shared across both split packages. 0.1.0.r<commits>.g<short-sha>.
+  printf '%s.r%s.g%s' \
+    "$(awk -F'\"' '/^version =/{print $2; exit}' Cargo.toml)" \
+    "$(git rev-list --count HEAD)" \
+    "$(git rev-parse --short HEAD)"
+}
+
+prepare() {
+  # Vendor deps up front so build() can run --frozen (no surprise network).
+  export CARGO_HOME="$srcdir/cargo-home"
+  local host; host="$(rustc -vV | sed -n 's/host: //p')"
+  cd "$srcdir/peerspeak";  cargo fetch --locked --target "$host"
+  cd "$srcdir/pixelpass";  cargo fetch --locked --target "$host"
+}
+
+build() {
+  export CARGO_HOME="$srcdir/cargo-home"
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+
+  cd "$srcdir/peerspeak"
+  cargo build --frozen --release --bin peerspeak
+
+  cd "$srcdir/pixelpass"
+  # --features gui so the .desktop launcher (pixelpass --gui) works.
+  cargo build --frozen --release --features gui
+}
+
+check() {
+  export CARGO_HOME="$srcdir/cargo-home"
+  export RUSTUP_TOOLCHAIN=stable
+  # peerspeak library unit tests only — its integration suites bind real
+  # iroh/QUIC endpoints and fail in a sandboxed/offline build environment.
+  cd "$srcdir/peerspeak"
+  cargo test --frozen --release --lib
+}
+
+package_peerspeak-git() {
+  pkgdesc="Decentralized peer-to-peer voice chat (Rust/iroh/PipeWire/Opus/iced)"
+  depends=('pipewire' 'opus')
+  optdepends=('pixelpass: screen sharing inside a room'
+              'mpv: screen-share viewer (vlc is used as a fallback)')
+  provides=('peerspeak')
+  conflicts=('peerspeak')
+  license=('custom')
+
+  cd "$srcdir/peerspeak"
+  install -Dm755 "target/release/peerspeak" "$pkgdir/usr/bin/peerspeak"
+  install -Dm644 "packaging/peerspeak.desktop" \
+    "$pkgdir/usr/share/applications/peerspeak.desktop"
+
+  # Hicolor icon theme (scalable SVG + the rendered raster sizes).
+  install -Dm644 "assets/icons/peerspeak.svg" \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/peerspeak.svg"
+  local s
+  for s in 16 24 32 48 64 128 256 512; do
+    install -Dm644 "assets/icons/peerspeak-$s.png" \
+      "$pkgdir/usr/share/icons/hicolor/${s}x${s}/apps/peerspeak.png"
+  done
+}
+
+package_pixelpass() {
+  pkgdesc='P2P screen sharing over iroh — no port forwarding, no signup'
+  depends=('gstreamer' 'gst-plugins-base' 'gst-plugins-good' 'gst-plugins-bad'
+           'gst-libav' 'gst-plugin-va' 'libpulse' 'hicolor-icon-theme'
+           'libglvnd' 'libxkbcommon' 'wayland')
+  optdepends=('mpv: recommended stream viewer (the GUI launches mpv)'
+              'vlc: alternative stream viewer'
+              'gst-plugins-ugly: software x264 encoding for `pixelpass --no-hwencode`'
+              'gst-plugin-pipewire: screen capture on Wayland sessions'
+              'xorg-xwininfo: share a single window on X11 (`pixelpass --window`)')
+  license=('MIT' 'Apache-2.0' 'OFL-1.1')
+
+  cd "$srcdir/pixelpass"
+  install -Dm0755 "target/release/pixelpass" "$pkgdir/usr/bin/pixelpass"
+  install -Dm0644 assets/pixelpass.desktop \
+    "$pkgdir/usr/share/applications/pixelpass.desktop"
+  install -Dm0644 assets/pixelpass.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/pixelpass.svg"
+  install -Dm0644 README.md "$pkgdir/usr/share/doc/pixelpass/README.md"
+  install -Dm0644 LICENSE-MIT "$pkgdir/usr/share/licenses/pixelpass/LICENSE-MIT"
+  install -Dm0644 LICENSE-APACHE "$pkgdir/usr/share/licenses/pixelpass/LICENSE-APACHE"
+  install -Dm0644 assets/NotoSans-OFL.txt \
+    "$pkgdir/usr/share/licenses/pixelpass/NotoSans-OFL.txt"
+}
@@ -0,0 +1,52 @@
+# PeerSpeak + PixelPass — CachyOS/Arch test pack
+
+A single **split PKGBUILD** that builds the latest code from the public gitbutter
+repos and installs **both** programs at once:
+
+- `peerspeak` — decentralized P2P voice chat
+- `pixelpass` — P2P screen sharing (peerspeak launches it for the screen-share button)
+
+## Build & install (one command)
+
+```sh
+git clone https://gitbutter.xyz/mollusk/peerspeak.git
+cd peerspeak/packaging/test-pack
+makepkg -si
+```
+
+`makepkg -si` auto-installs every dependency via pacman before building —
+including the Rust toolchain itself (the `cargo` makedepend is provided by the
+`rust` package), `git`, `pkgconf`, pipewire + opus for peerspeak, and the
+gstreamer/VA-API stack for pixelpass. The only prerequisite is the `base-devel`
+group (which provides `makepkg`). If you already use `rustup`, that satisfies the
+`cargo` makedepend and the `rust` package won't be pulled in — no conflict.
+
+When it finishes you'll have `peerspeak` and `pixelpass` on your PATH at
+`/usr/bin`. To rebuild later with fresh upstream code, re-run `makepkg -si`; the
+git sources re-pull `main` and the version bumps automatically.
+
+> Skip the test step with `makepkg -si --nocheck` for a faster build.
+
+## Running the cross-internet test
+
+1. Launch `peerspeak` on both machines.
+2. One person **creates** a room and shares the room code/ticket with the other.
+3. The other **joins** with that code.
+4. iroh does NAT hole-punching automatically; if a direct path can't be made it
+   falls back to a public n0 relay — **no port forwarding required**.
+5. Allow the app through any local firewall if prompted (outbound UDP / QUIC;
+   nothing needs to be opened inbound for relay mode).
+
+### What we're smoke-testing
+- Two real humans, two networks, over the internet.
+- Mic capture + remote playback both directions, no crackle/dropouts.
+- Mute / deafen, push-to-talk.
+- Text chat in-room.
+- Avatars (presets + custom upload) show up on the other side.
+- Screen share: click the screen-share control → it launches `pixelpass`; the
+  viewer opens in `mpv` on the receiving side.
+- Notification chimes (join/leave/etc.).
+- Leave / rejoin cleanly.
+
+If anything misbehaves, grab the log path peerspeak prints on startup and the
+exact repro steps.
@@ -0,0 +1,108 @@
+# PeerSpeak — how to install and join a call (Windows)
+
+PeerSpeak is a little voice-chat app — like a private phone call over the
+internet, with no account, no signup, and no company in the middle. You install
+it once, then you and I connect directly to each other.
+
+---
+
+## 1. Install it
+
+1. Double-click **`peerspeak-0.3.0-setup.exe`** (the file I sent you).
+
+2. **Windows will probably show a blue "Windows protected your PC" warning.**
+   This is normal — it shows up for any app that isn't from a big company with a
+   paid certificate. It is **not** a virus warning.
+   - Click **More info**
+   - Then click **Run anyway**
+
+3. Windows will ask *"Do you want to allow this app to make changes?"* — click
+   **Yes**.
+
+4. The setup window opens. Just keep clicking **Next**. Two checkboxes you'll
+   see along the way:
+   - **"Allow PeerSpeak through Windows Firewall"** — leave this **checked**
+     (it lets the call connect without interruptions).
+   - **"Create a desktop shortcut"** — check it if you'd like an icon on your
+     desktop.
+
+5. Click **Install**, then **Finish**. PeerSpeak opens.
+
+That's it — it's installed. You can find it again any time from the **Start
+menu** (search "PeerSpeak").
+
+---
+
+## 2. Get on a call with me
+
+PeerSpeak connects two people using a **room ticket** — a long code that acts
+like a one-time phone number for a specific call.
+
+**The simple way (I host):**
+
+1. I'll create a room and send you a **ticket** (a long jumble of letters and
+   numbers).
+2. Copy the whole ticket I sent you.
+3. In PeerSpeak, paste it into the **"Join Room"** box near the bottom and press
+   **Join**.
+4. You're in — you should see both our names listed, and we can talk.
+
+**If you want to host instead:**
+
+1. Type a room name and click **Create New Room**.
+2. PeerSpeak gives you a **ticket** — click **Copy Ticket** and send it to me.
+3. I paste it on my end and join you.
+
+Either way works the same; it just depends on who makes the room.
+
+---
+
+## 3. While you're on a call
+
+- **Your microphone** is on by default. There's a **mute** button if you need
+  it.
+- The first time, Windows might ask for permission to use your **microphone** —
+  click **Yes / Allow**.
+- If you can't hear me or I can't hear you, open **Settings** (top right) and
+  check that the right **microphone** and **speakers/headphones** are selected.
+- To hang up, click **Leave Room**.
+
+---
+
+## 4. Chatting and sharing photos/files
+
+There's a **text chat** box at the bottom of the call window — type a message
+and press **Enter** to send it to everyone in the room.
+
+You can also **send a photo or a file**:
+
+1. Click the **attach button** (the small paperclip-style button) next to the
+   message box.
+2. Pick a photo or file from your computer.
+3. It sends to everyone in the room. **Photos show up right in the chat**;
+   other files appear as a small download chip with the file's name.
+
+To **save** a file someone sent you, click the **Save** (or **Download**)
+button next to it in the chat and choose where to put it.
+
+A couple of notes:
+- There's a size limit of about **25 MB** per file — bigger files are turned
+  away with a message.
+- Shared files only last for the **current call**. They aren't saved anywhere
+  automatically, so save anything you want to keep before you leave the room.
+
+---
+
+## Troubleshooting
+
+- **"I don't hear anything."** Open Settings and pick the correct microphone and
+  output device. Headphones are best — they prevent echo.
+- **"It won't connect."** Make sure you pasted the *entire* ticket (they're
+  long and easy to cut off). If it still won't connect, we may just need a fresh
+  ticket — they're meant to be used right away. Also make sure we're both on the
+  **same version** — if I've sent you an updated installer, install it (an old
+  version and a new one can't connect to each other).
+- **The blue warning again.** Same as install: **More info → Run anyway**. It's
+  the unsigned-app warning, not malware.
+
+Any trouble, just message me and we'll sort it out.
@@ -0,0 +1,84 @@
+# PeerSpeak — Windows installer
+
+This directory builds a Windows setup installer for PeerSpeak using
+[Inno Setup](https://jrsoftware.org/isinfo.php).
+
+PeerSpeak ships as a **single self-contained `peerspeak.exe`** — the GUI icon,
+notification chimes, and avatar presets are all embedded in the binary
+(`include_bytes!`), and the executable is statically linked against the GNU
+runtime, so there are no extra DLLs to bundle. The installer payload is just the
+`.exe` plus an `.ico` for the Start-menu / desktop shortcuts.
+
+## Version compatibility
+
+The installer version tracks the crate version in `Cargo.toml` (currently
+**0.3.0**) — keep `MyAppVersion` in `peerspeak.iss` in sync when it changes.
+
+Per `VERSIONING.md`, a **MINOR** bump in `0.x` is a **breaking wire change**:
+peers on different MINOR versions can't connect (they fail fast at the
+handshake rather than misbehaving). So when you ship a new Windows build after
+a MINOR bump, **everyone on the call must reinstall** — an old Windows build
+and a newer Linux/Windows peer won't talk. (0.3.0 was the chat file-sharing +
+per-peer noise-gate release; it cannot connect to a 0.2.x peer.)
+
+## Files
+
+| File | Tracked | Purpose |
+|------|---------|---------|
+| `peerspeak.iss` | yes | Inno Setup script |
+| `peerspeak.ico` | yes | multi-resolution app icon (from `assets/icons/*.png`) |
+| `README.md` | yes | this file |
+| `peerspeak.exe` | no (gitignored) | staged build artifact, copied from `target/x86_64-pc-windows-gnu/release/` |
+| `output/peerspeak-<ver>-setup.exe` | no (gitignored) | the compiled installer |
+
+## Build steps
+
+1. **Cross-compile the Windows binary** (from the repo root, inside the
+   `peerspeak-win` archlinux distrobox):
+
+   ```sh
+   RUSTC_BOOTSTRAP=1 ./win-cross-build.sh -Z build-std=std,panic_abort
+   ```
+
+   This needs the `rust-src` component and the `x86_64-pc-windows-gnu` target
+   installed in that toolchain. The result is a statically-linked,
+   GUI-subsystem `.exe` (no stray console window).
+
+2. **Stage the binary** next to the script:
+
+   ```sh
+   cp target/x86_64-pc-windows-gnu/release/peerspeak.exe packaging/windows/
+   ```
+
+3. **Regenerate the icon** if the source PNGs changed:
+
+   ```sh
+   magick assets/icons/peerspeak-16.png assets/icons/peerspeak-24.png \
+          assets/icons/peerspeak-32.png assets/icons/peerspeak-48.png \
+          assets/icons/peerspeak-64.png assets/icons/peerspeak-128.png \
+          assets/icons/peerspeak-256.png packaging/windows/peerspeak.ico
+   ```
+
+4. **Compile the installer** with Inno Setup. On Linux this runs under Wine:
+
+   ```sh
+   cd packaging/windows
+   wine ~/.wine/drive_c/InnoSetup6/ISCC.exe peerspeak.iss
+   ```
+
+   The installer lands at `output/peerspeak-<version>-setup.exe`.
+
+## What the installer does
+
+- Installs `peerspeak.exe` to `Program Files\PeerSpeak` (requires admin / one
+  UAC prompt).
+- Creates a Start-menu shortcut, with an optional desktop shortcut.
+- Optionally adds a Windows Firewall allow-rule for PeerSpeak (recommended —
+  iroh uses UDP hole-punching, so this avoids a mid-call firewall prompt). The
+  rule is removed on uninstall.
+- Provides a standard uninstaller.
+
+> **Note:** the installer and the binary are **not code-signed**, so Windows
+> SmartScreen will show an "unknown publisher" warning on first run. The user
+> clicks *More info → Run anyway*. Removing this warning requires a paid
+> code-signing certificate.
@@ -0,0 +1,63 @@
+; Inno Setup script for PeerSpeak (Windows installer).
+;
+; PeerSpeak is a single self-contained binary: the GUI icon, notification
+; chimes, and avatar presets are all embedded in the .exe (include_bytes!),
+; so the only payload here is peerspeak.exe plus an .ico for the shortcuts.
+;
+; Build (under Wine on Linux, or native Windows):
+;   wine "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" peerspeak.iss
+; Output lands in .\output\peerspeak-<version>-setup.exe
+;
+; The peerspeak.exe is cross-compiled with win-cross-build.sh
+; (x86_64-pc-windows-gnu, statically linked -- no extra DLLs needed).
+
+#define MyAppName "PeerSpeak"
+#define MyAppVersion "0.3.0"
+#define MyAppPublisher "mollusk"
+#define MyAppExeName "peerspeak.exe"
+
+[Setup]
+; A stable AppId keeps upgrades/uninstall tracking consistent across versions.
+AppId={{2754D6C1-C8A4-4B13-9824-2D303439739D}
+AppName={#MyAppName}
+AppVersion={#MyAppVersion}
+AppVerName={#MyAppName} {#MyAppVersion}
+AppPublisher={#MyAppPublisher}
+DefaultDirName={autopf}\{#MyAppName}
+DefaultGroupName={#MyAppName}
+DisableProgramGroupPage=yes
+UninstallDisplayIcon={app}\{#MyAppExeName}
+SetupIconFile=peerspeak.ico
+Compression=lzma2/max
+SolidCompression=yes
+WizardStyle=modern
+OutputDir=output
+OutputBaseFilename=peerspeak-{#MyAppVersion}-setup
+; Program Files install + firewall rule both need elevation.
+PrivilegesRequired=admin
+ArchitecturesAllowed=x64compatible
+ArchitecturesInstallIn64BitMode=x64compatible
+
+[Languages]
+Name: "english"; MessagesFile: "compiler:Default.isl"
+
+[Tasks]
+Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"; Flags: unchecked
+Name: "firewall"; Description: "Allow PeerSpeak through Windows Firewall (recommended for voice calls)"; GroupDescription: "Network:"
+
+[Files]
+Source: "peerspeak.exe"; DestDir: "{app}"; Flags: ignoreversion
+Source: "peerspeak.ico"; DestDir: "{app}"; Flags: ignoreversion
+
+[Icons]
+Name: "{group}\{#MyAppName}"; Filename: "{app}\{#MyAppExeName}"; IconFilename: "{app}\peerspeak.ico"
+Name: "{group}\{cm:UninstallProgram,{#MyAppName}}"; Filename: "{uninstallexe}"
+Name: "{autodesktop}\{#MyAppName}"; Filename: "{app}\{#MyAppExeName}"; IconFilename: "{app}\peerspeak.ico"; Tasks: desktopicon
+
+[Run]
+; iroh uses UDP hole-punching; pre-authorizing avoids a mid-call firewall prompt.
+Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall add rule name=""PeerSpeak"" dir=in action=allow program=""{app}\{#MyAppExeName}"" enable=yes profile=any"; Flags: runhidden; Tasks: firewall
+Filename: "{app}\{#MyAppExeName}"; Description: "{cm:LaunchProgram,{#MyAppName}}"; Flags: nowait postinstall skipifsilent
+
+[UninstallRun]
+Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall delete rule name=""PeerSpeak"""; Flags: runhidden; RunOnceId: "DelPeerSpeakFirewall"
@@ -0,0 +1,306 @@
+//! Independent playback engine for inline chat audio attachments.
+//!
+//! The rodio device sink stays on a dedicated OS thread and never enters iced
+//! state or the call-audio pipeline. The GUI sends small commands and reads a
+//! shared status snapshot at its redraw cadence.
+
+use crate::files::AttachmentId;
+use rodio::{Decoder, DeviceSinkBuilder, MixerDeviceSink, Player, Source, decoder::DecoderError};
+use std::io::Cursor;
+use std::sync::{Arc, Mutex, mpsc};
+use std::time::Duration;
+
+/// State published by the playback thread for the GUI.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ClipStatus {
+    pub playing_id: Option<AttachmentId>,
+    pub position: Duration,
+    pub total: Option<Duration>,
+    pub paused: bool,
+    /// Set when output initialization or decoding rejects the requested clip.
+    /// The app consumes this as a signal to fall back to the normal file chip.
+    pub failure: Option<ClipFailure>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ClipFailure {
+    pub id: AttachmentId,
+    pub error: String,
+    /// Decoder rejection means the filename hint should fall back to a file
+    /// chip. Output-device failures remain retryable as audio.
+    pub invalid_audio: bool,
+}
+
+pub type SharedClipStatus = Arc<Mutex<ClipStatus>>;
+
+#[derive(Debug)]
+enum ClipCommand {
+    Play(AttachmentId, Vec<u8>),
+    Pause,
+    Resume,
+    Seek(Duration),
+    Stop,
+}
+
+/// Cheap, `Send` command handle for the dedicated playback thread.
+pub struct ClipPlayer {
+    command_tx: mpsc::Sender<ClipCommand>,
+    status: SharedClipStatus,
+}
+
+impl ClipPlayer {
+    /// Start the playback worker. The system output device is opened lazily on
+    /// first Play, so merely launching PeerSpeak never claims another stream.
+    pub fn new() -> (Self, SharedClipStatus) {
+        let (command_tx, command_rx) = mpsc::channel();
+        let status = Arc::new(Mutex::new(ClipStatus::default()));
+        let worker_status = Arc::clone(&status);
+        std::thread::Builder::new()
+            .name("peerspeak-clip-player".to_string())
+            .spawn(move || playback_worker(command_rx, worker_status))
+            .expect("failed to spawn clip playback thread");
+        (
+            Self {
+                command_tx,
+                status: Arc::clone(&status),
+            },
+            status,
+        )
+    }
+
+    pub fn play(&self, id: AttachmentId, bytes: Vec<u8>) {
+        update_status(&self.status, |status| {
+            status.playing_id = Some(id);
+            status.position = Duration::ZERO;
+            status.total = None;
+            status.paused = false;
+            status.failure = None;
+        });
+        let _ = self.command_tx.send(ClipCommand::Play(id, bytes));
+    }
+
+    pub fn pause(&self) {
+        let _ = self.command_tx.send(ClipCommand::Pause);
+    }
+
+    pub fn resume(&self) {
+        let _ = self.command_tx.send(ClipCommand::Resume);
+    }
+
+    pub fn seek(&self, position: Duration) {
+        let _ = self.command_tx.send(ClipCommand::Seek(position));
+    }
+
+    pub fn stop(&self) {
+        let _ = self.command_tx.send(ClipCommand::Stop);
+    }
+}
+
+fn playback_worker(command_rx: mpsc::Receiver<ClipCommand>, status: SharedClipStatus) {
+    let mut output: Option<MixerDeviceSink> = None;
+    let mut player: Option<Player> = None;
+
+    loop {
+        match command_rx.recv_timeout(Duration::from_millis(100)) {
+            Ok(ClipCommand::Play(id, bytes)) => {
+                // In-memory readers do not expose file metadata to rodio. Pass
+                // the known attachment length explicitly so formats without a
+                // duration in their headers (notably MP3 and Vorbis) can derive
+                // a total duration and support reliable seeking.
+                let source = match decode_clip(bytes) {
+                    Ok(source) => source,
+                    Err(error) => {
+                        fail(
+                            &status,
+                            id,
+                            format!("unsupported or invalid audio: {error}"),
+                            true,
+                        );
+                        continue;
+                    }
+                };
+                let total = source.total_duration();
+
+                if output.is_none() {
+                    match DeviceSinkBuilder::open_default_sink() {
+                        Ok(sink) => {
+                            player = Some(Player::connect_new(sink.mixer()));
+                            output = Some(sink);
+                        }
+                        Err(error) => {
+                            fail(
+                                &status,
+                                id,
+                                format!("audio output unavailable: {error}"),
+                                false,
+                            );
+                            continue;
+                        }
+                    }
+                }
+
+                if let Some(player) = player.as_ref() {
+                    player.clear();
+                    player.append(source);
+                    player.play();
+                    update_status(&status, |s| {
+                        s.playing_id = Some(id);
+                        s.position = Duration::ZERO;
+                        s.total = total;
+                        s.paused = false;
+                        s.failure = None;
+                    });
+                }
+            }
+            Ok(ClipCommand::Pause) => {
+                if let Some(player) = player.as_ref() {
+                    player.pause();
+                    update_status(&status, |s| s.paused = true);
+                }
+            }
+            Ok(ClipCommand::Resume) => {
+                if let Some(player) = player.as_ref() {
+                    player.play();
+                    update_status(&status, |s| s.paused = false);
+                }
+            }
+            Ok(ClipCommand::Seek(position)) => {
+                if let Some(player) = player.as_ref()
+                    && player.try_seek(position).is_ok()
+                {
+                    update_status(&status, |s| s.position = position);
+                }
+            }
+            Ok(ClipCommand::Stop) => {
+                if let Some(player) = player.as_ref() {
+                    player.clear();
+                }
+                reset(&status);
+            }
+            Err(mpsc::RecvTimeoutError::Disconnected) => break,
+            Err(mpsc::RecvTimeoutError::Timeout) => {}
+        }
+
+        if let Some(player) = player.as_ref() {
+            let (active, failed) = status
+                .lock()
+                .map(|s| (s.playing_id.is_some(), s.failure.is_some()))
+                .unwrap_or_default();
+            if active && !failed && player.empty() {
+                reset(&status);
+            } else if active && !failed {
+                update_status(&status, |s| {
+                    s.position = player.get_pos();
+                    s.paused = player.is_paused();
+                });
+            }
+        }
+    }
+}
+
+fn decode_clip(bytes: Vec<u8>) -> Result<Decoder<Cursor<Vec<u8>>>, DecoderError> {
+    let byte_len = bytes.len() as u64;
+    Decoder::builder()
+        .with_data(Cursor::new(bytes))
+        .with_byte_len(byte_len)
+        .build()
+}
+
+fn fail(status: &SharedClipStatus, id: AttachmentId, error: String, invalid_audio: bool) {
+    crate::log_msg(&format!("Inline audio playback failed: {error}"));
+    update_status(status, |s| {
+        // Keep the id active until the GUI observes the failure on its next
+        // tick. This guarantees the active-only timer cannot disappear in the
+        // small window between sending Play and decoder/output failure.
+        s.playing_id = Some(id);
+        s.position = Duration::ZERO;
+        s.total = None;
+        s.paused = false;
+        s.failure = Some(ClipFailure {
+            id,
+            error,
+            invalid_audio,
+        });
+    });
+}
+
+fn reset(status: &SharedClipStatus) {
+    update_status(status, |s| *s = ClipStatus::default());
+}
+
+fn update_status(status: &SharedClipStatus, update: impl FnOnce(&mut ClipStatus)) {
+    if let Ok(mut status) = status.lock() {
+        update(&mut status);
+    }
+}
+
+pub fn status_snapshot(status: &SharedClipStatus) -> ClipStatus {
+    status.lock().map(|s| s.clone()).unwrap_or_default()
+}
+
+/// Format clip time as `mm:ss` (hours are folded into minutes).
+pub fn format_time(duration: Duration) -> String {
+    let seconds = duration.as_secs();
+    format!("{}:{:02}", seconds / 60, seconds % 60)
+}
+
+/// Playback progress in `0.0..=1.0`; unknown and zero durations report zero.
+pub fn progress(position: Duration, total: Option<Duration>) -> f32 {
+    let Some(total) = total.filter(|duration| !duration.is_zero()) else {
+        return 0.0;
+    };
+    (position.as_secs_f64() / total.as_secs_f64()).clamp(0.0, 1.0) as f32
+}
+
+/// Convert a slider fraction into a clamped position within a clip.
+pub fn seek_target(fraction: f32, total: Duration) -> Duration {
+    total.mul_f64(f64::from(fraction.clamp(0.0, 1.0)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use base64::Engine;
+
+    #[test]
+    fn in_memory_mp3_reports_duration() {
+        // One headerless constant-bitrate MP3 frame repeated to model files
+        // that do not carry an Xing/VBR duration header.
+        let frame = base64::engine::general_purpose::STANDARD
+            .decode("//sQxAAABIQVWVRggDCqCKiDNlAAAAGgS4BgAmTT2AQAABCxOD5d7gQOfqBAEHS4Ph/EAIRI7//0A0KBNpABgMRIDCSI04PcIFdF0PJKFgzlUf5eAoF8BRIPfh4FTvUDQl+dUi5pc0w=")
+            .expect("valid test fixture");
+        let bytes = frame.repeat(20);
+
+        let decoder = decode_clip(bytes).expect("CBR MP3 should decode");
+        assert!(decoder.total_duration().is_some());
+    }
+
+    #[test]
+    fn formats_clip_time() {
+        assert_eq!(format_time(Duration::ZERO), "0:00");
+        assert_eq!(format_time(Duration::from_secs(65)), "1:05");
+        assert_eq!(format_time(Duration::from_secs(3_661)), "61:01");
+    }
+
+    #[test]
+    fn progress_handles_unknown_zero_and_clamps() {
+        assert_eq!(progress(Duration::from_secs(1), None), 0.0);
+        assert_eq!(progress(Duration::from_secs(1), Some(Duration::ZERO)), 0.0);
+        assert_eq!(
+            progress(Duration::from_secs(5), Some(Duration::from_secs(10))),
+            0.5
+        );
+        assert_eq!(
+            progress(Duration::from_secs(20), Some(Duration::from_secs(10))),
+            1.0
+        );
+    }
+
+    #[test]
+    fn seek_target_clamps_fraction() {
+        let total = Duration::from_secs(100);
+        assert_eq!(seek_target(0.25, total), Duration::from_secs(25));
+        assert_eq!(seek_target(-1.0, total), Duration::ZERO);
+        assert_eq!(seek_target(2.0, total), total);
+    }
+}
@@ -56,11 +56,16 @@ pub trait AudioBackend: Send + Sync {
    fn stop(&self) -> Result<(), AudioError>;
 }

+pub mod clip_player;
 pub mod eq;
 pub mod gate;
 pub mod limiter;
 pub mod multitrack;
 pub mod pan;
+// Linear resamplers used by the Windows/cpal backend (W4). Platform-neutral and
+// pure, so it builds (and its tests run) everywhere even though only the cpal
+// backend wires it in.
+pub mod resample;
 #[cfg(target_os = "linux")]
 pub mod echo_cancel;
 #[cfg(target_os = "linux")]
@@ -0,0 +1,307 @@
+//! Dep-free linear-interpolation resamplers for the Windows/cpal backend (W4).
+//!
+//! The pipeline runs internally at 48 kHz (Opus + the 20 ms frame), but a WASAPI
+//! endpoint may run at a different rate (commonly 44.1 kHz) and/or a non-stereo
+//! channel layout. These convert at the device boundary so such a device plays and
+//! captures instead of hard-erroring (the W4 limitation in the Windows port).
+//!
+//! ## Where each is used
+//! - [`PushResampler`] (single channel) converts **capture** from the device rate
+//!   to 48 kHz on the capture drain thread — off the RT callback.
+//! - [`StereoPullResampler`] converts **playback** from the internal 48 kHz stereo
+//!   bus to the device rate inside the output RT callback, pulling internal frames
+//!   from the ring on demand. It allocates nothing in `next`, so it is RT-safe.
+//!
+//! ## Quality
+//! This is plain linear interpolation with no anti-aliasing filter: correct,
+//! allocation-free, and adequate for speech, but it adds some aliasing when
+//! downsampling. The seam is intentionally tiny so a higher-quality polyphase/FIR
+//! resampler (e.g. the `rubato` crate, pending a supply-chain decision) can later
+//! replace the internals without touching the cpal backend. The matching-rate /
+//! matching-layout path in the backend bypasses these entirely and stays bit-exact.
+
+/// Linear interpolation between `a` and `b` at fractional position `frac` in `[0, 1)`.
+#[inline]
+fn lerp(a: f32, b: f32, frac: f32) -> f32 {
+    a + (b - a) * frac
+}
+
+/// Stateful single-channel **push** resampler: feed input samples at `in_rate`,
+/// receive output samples at `out_rate` through an `emit` callback. It carries the
+/// fractional read position and the previous input sample across calls, so feeding
+/// the stream block-by-block joins seamlessly. Neither [`push`](Self::push) nor
+/// [`process`](Self::process) allocates.
+pub struct PushResampler {
+    /// Input samples consumed per output sample (`in_rate / out_rate`).
+    step: f64,
+    /// Position of the next output sample, in input-sample units, measured from the
+    /// index of `prev` (the most recent input). Always advanced to stay `< 1.0`
+    /// after each input is consumed.
+    next: f64,
+    /// The previous input sample (left edge of the current interpolation segment).
+    prev: f32,
+    /// Whether any input has been seen yet (anchors the first output at input[0]).
+    started: bool,
+}
+
+impl PushResampler {
+    /// Build a resampler from `in_rate` to `out_rate` (both in Hz). Rates are
+    /// clamped to `>= 1` so `step` is always finite and non-zero: a zero `step`
+    /// would make [`push`](Self::push)'s `while self.next < 1.0` loop forever. The
+    /// cpal backend's `resolve()` also rejects such rates up front, so this is
+    /// belt-and-suspenders against a future caller (review W7).
+    pub fn new(in_rate: u32, out_rate: u32) -> Self {
+        Self {
+            step: in_rate.max(1) as f64 / out_rate.max(1) as f64,
+            next: 0.0,
+            prev: 0.0,
+            started: false,
+        }
+    }
+
+    /// Feed one input sample; `emit` is called for each output sample produced
+    /// (zero or more, depending on the rate ratio).
+    pub fn push(&mut self, cur: f32, mut emit: impl FnMut(f32)) {
+        if !self.started {
+            // First sample: just establish the left edge. Linear interpolation
+            // needs the next input as the right edge, so the first output is
+            // produced on the next push. This gives exact alignment
+            // (`output[k] == input[k]` at equal rates) with one input-sample of
+            // latency — negligible (~20 µs at 48 kHz).
+            self.started = true;
+            self.prev = cur;
+            self.next = 0.0;
+            return;
+        }
+        // `prev` sits at position 0 of this segment and `cur` at position 1; emit
+        // every output whose position falls in [0, 1).
+        while self.next < 1.0 {
+            emit(lerp(self.prev, cur, self.next as f32));
+            self.next += self.step;
+        }
+        self.next -= 1.0;
+        self.prev = cur;
+    }
+
+    /// Convenience for tests / batch callers: push a whole slice.
+    pub fn process(&mut self, input: &[f32], mut emit: impl FnMut(f32)) {
+        for &s in input {
+            self.push(s, &mut emit);
+        }
+    }
+}
+
+/// Stateful stereo **pull** resampler: produce output frames at `out_rate` by
+/// pulling input frames at `in_rate` from a closure on demand. Call
+/// [`next`](Self::next) once per output frame; it pulls as many input frames as the
+/// ratio requires and returns the interpolated `(left, right)`, or `None` when the
+/// puller runs dry (an underrun). Allocates nothing, so it is safe in an RT output
+/// callback.
+pub struct StereoPullResampler {
+    /// Input frames consumed per output frame (`in_rate / out_rate`).
+    step: f64,
+    /// Position of the next output frame within `[prev, cur)`, in `[0, 1)`.
+    frac: f64,
+    /// Left edge of the current interpolation segment.
+    prev: (f32, f32),
+    /// Right edge of the current interpolation segment.
+    cur: (f32, f32),
+    /// Whether `prev`/`cur` have been primed from the puller yet.
+    primed: bool,
+}
+
+impl StereoPullResampler {
+    /// Build a resampler from `in_rate` to `out_rate` (both in Hz). Rates are
+    /// clamped to `>= 1` so `step` is finite and non-zero — otherwise
+    /// [`next`](Self::next)'s `while self.frac >= 1.0` could spin (review W7).
+    pub fn new(in_rate: u32, out_rate: u32) -> Self {
+        Self {
+            step: in_rate.max(1) as f64 / out_rate.max(1) as f64,
+            frac: 0.0,
+            prev: (0.0, 0.0),
+            cur: (0.0, 0.0),
+            primed: false,
+        }
+    }
+
+    /// Produce the next output frame, pulling input frames via `pull` as needed.
+    /// Returns `None` if `pull` returns `None` before the frame can be formed
+    /// (underrun); the caller should substitute silence for that frame.
+    pub fn next(&mut self, mut pull: impl FnMut() -> Option<(f32, f32)>) -> Option<(f32, f32)> {
+        if !self.primed {
+            // Prime both edges from two pulls so the first output frame aligns
+            // exactly with the first input frame (`out[0] == in[0]` at equal
+            // rates). Needs two frames available to start, which the prefilled
+            // playback ring always has.
+            self.prev = pull()?;
+            self.cur = pull()?;
+            self.primed = true;
+            self.frac = 0.0;
+        }
+        // Advance the segment until the read position lands inside [prev, cur).
+        while self.frac >= 1.0 {
+            self.prev = self.cur;
+            self.cur = pull()?;
+            self.frac -= 1.0;
+        }
+        let f = self.frac as f32;
+        let out = (lerp(self.prev.0, self.cur.0, f), lerp(self.prev.1, self.cur.1, f));
+        self.frac += self.step;
+        Some(out)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Equal rates align exactly: `output[k] == input[k]`. The final input lands on
+    /// the next push (one-sample streaming latency), so we get `n - 1` outputs.
+    #[test]
+    fn push_identity_when_rates_match() {
+        let mut r = PushResampler::new(48_000, 48_000);
+        let input = [0.0, 0.1, 0.2, 0.3, 0.4];
+        let mut out = Vec::new();
+        r.process(&input, |s| out.push(s));
+        assert_eq!(out.len(), input.len() - 1);
+        for (a, b) in out.iter().zip(input.iter()) {
+            assert!((a - b).abs() < 1e-6, "{a} vs {b}");
+        }
+    }
+
+    /// Upsampling 2x roughly doubles the output count and the midpoints interpolate.
+    #[test]
+    fn push_upsample_2x_interpolates_midpoints() {
+        let mut r = PushResampler::new(24_000, 48_000); // step = 0.5
+        let input = [0.0, 1.0, 2.0, 3.0];
+        let mut out = Vec::new();
+        r.process(&input, |s| out.push(s));
+        // (n - 1) segments at 2 outputs each = 6.
+        assert_eq!(out.len(), 6, "out {out:?}");
+        // A half-step between 1.0 and 2.0 must appear near 1.5.
+        assert!(
+            out.iter().any(|&s| (s - 1.5).abs() < 1e-3),
+            "expected a ~1.5 midpoint in {out:?}"
+        );
+    }
+
+    /// Downsampling drops the rate: fewer outputs than inputs, monotonic ramp preserved.
+    #[test]
+    fn push_downsample_reduces_count() {
+        let mut r = PushResampler::new(48_000, 44_100); // step ~1.088
+        let input: Vec<f32> = (0..441).map(|i| i as f32).collect();
+        let mut out = Vec::new();
+        r.process(&input, |s| out.push(s));
+        // 441 in @ 48k -> ~405 out @ 44.1k.
+        assert!(
+            (390..=410).contains(&out.len()),
+            "expected ~405 outputs, got {}",
+            out.len()
+        );
+        // Output stays within the input's value range and is non-decreasing.
+        for w in out.windows(2) {
+            assert!(w[1] >= w[0] - 1e-3, "ramp should not reverse: {w:?}");
+        }
+        assert!(*out.last().unwrap() <= 440.0 + 1e-3);
+    }
+
+    /// Pull resampler at equal rates returns each input frame in order, aligned.
+    /// Two-pull priming uses one frame of lookahead, so `n` inputs yield `n - 1`
+    /// outputs (the last frame emits once a successor arrives).
+    #[test]
+    fn pull_identity_when_rates_match() {
+        let mut r = StereoPullResampler::new(48_000, 48_000);
+        let frames = [(0.0, 9.0), (1.0, 8.0), (2.0, 7.0), (3.0, 6.0)];
+        let mut idx = 0;
+        let mut out = Vec::new();
+        while let Some(f) = r.next(|| {
+            let v = frames.get(idx).copied();
+            idx += 1;
+            v
+        }) {
+            out.push(f);
+        }
+        assert_eq!(out.len(), frames.len() - 1, "out {out:?}");
+        for (got, want) in out.iter().zip(frames.iter()) {
+            assert!((got.0 - want.0).abs() < 1e-6 && (got.1 - want.1).abs() < 1e-6);
+        }
+    }
+
+    /// Pull resampler reports underrun (`None`) once the source is exhausted.
+    #[test]
+    fn pull_returns_none_on_underrun() {
+        let mut r = StereoPullResampler::new(48_000, 44_100); // step ~1.088 -> pulls >1 per out
+        let frames = [(0.0, 0.0), (1.0, -1.0)];
+        let mut idx = 0;
+        let mut pull = || {
+            let v = frames.get(idx).copied();
+            idx += 1;
+            v
+        };
+        // First frame primes + emits; subsequent calls eventually exhaust the source.
+        let mut produced = 0;
+        let mut hit_none = false;
+        for _ in 0..10 {
+            if r.next(&mut pull).is_some() {
+                produced += 1;
+            } else {
+                hit_none = true;
+                break;
+            }
+        }
+        assert!(produced >= 1, "should produce at least the primed frame");
+        assert!(hit_none, "should report underrun once the puller is dry");
+    }
+
+    /// Downsampling via pull consumes more input frames than it emits output frames.
+    #[test]
+    fn pull_downsample_consumes_more_than_it_emits() {
+        let mut r = StereoPullResampler::new(48_000, 24_000); // step = 2.0
+        let input: Vec<(f32, f32)> = (0..100).map(|i| (i as f32, -(i as f32))).collect();
+        let mut idx = 0;
+        let mut emitted = 0;
+        for _ in 0..40 {
+            let f = r.next(|| {
+                let v = input.get(idx).copied();
+                idx += 1;
+                v
+            });
+            if f.is_some() {
+                emitted += 1;
+            } else {
+                break;
+            }
+        }
+        // At step 2.0 we consume ~2 input frames per output frame.
+        assert!(idx > emitted, "consumed {idx} input, emitted {emitted} output");
+    }
+
+    /// A zero rate must not produce a zero `step` (which would spin `push`'s inner
+    /// `while self.next < 1.0` forever). Clamping makes the call terminate (W7).
+    #[test]
+    fn push_zero_rate_does_not_spin() {
+        let mut r = PushResampler::new(0, 48_000);
+        let mut count = 0usize;
+        // Feed two samples; with a clamped non-zero step this returns promptly.
+        r.push(0.0, |_| count += 1);
+        r.push(1.0, |_| count += 1);
+        // Reaching here at all is the assertion (no hang); some output is produced.
+        assert!(count >= 1);
+    }
+
+    /// A zero output rate must not make the pull resampler's segment-advance loop
+    /// spin. Clamping keeps `step` finite so `next` terminates (W7).
+    #[test]
+    fn pull_zero_out_rate_does_not_spin() {
+        let mut r = StereoPullResampler::new(48_000, 0);
+        let frames = [(0.0, 0.0), (1.0, 1.0), (2.0, 2.0)];
+        let mut idx = 0;
+        let got = r.next(|| {
+            let v = frames.get(idx).copied();
+            idx += 1;
+            v
+        });
+        // Terminates and yields the primed frame instead of hanging.
+        assert!(got.is_some());
+    }
+}
@@ -0,0 +1,107 @@
+//! Custom UI background (W16): turn a user-picked image into a capped PNG to
+//! render behind the whole UI, plus the legibility scrim drawn over it.
+//!
+//! This is the pure, unit-testable seam — `process_background` decodes/downscales
+//! arbitrary input defensively (same caution as avatar uploads) and `scrim_color`
+//! computes the overlay tint. The file I/O, the `rfd` picker, and the iced
+//! `stack!` that layers image → scrim → UI all live at the app edge in
+//! `src/app/mod.rs`. The background is **local-only** — never sent to peers — so
+//! there's no gossip-frame budget here (hence a much larger size cap than avatars).
+
+use iced::Color;
+
+/// Longest side a custom background is downscaled to on ingest (aspect preserved,
+/// never upscaled). Big enough to look crisp filling the window, small enough to
+/// decode and cache cheaply. Local-only, so this is generous vs. the avatar cap.
+pub const BACKGROUND_MAX_PX: u32 = 1920;
+
+/// Default scrim strength. `0.0` = the image shows at full strength, `1.0` = it's
+/// fully hidden behind the theme's base colour. Half keeps a photo clearly visible
+/// while text and cards stay readable over it.
+pub const DEFAULT_DIM: f32 = 0.5;
+
+/// Decode an arbitrary user image (png/jpeg/…), downscale so its longest side is
+/// at most [`BACKGROUND_MAX_PX`] (aspect preserved; smaller images are left as-is,
+/// never upscaled), and re-encode as PNG bytes ready to write to disk. Decoding is
+/// bounded by the `image` crate's defaults so a malformed/huge file is rejected
+/// rather than exhausting memory. Errors come back as a message for the UI.
+pub fn process_background(raw: &[u8]) -> Result<Vec<u8>, String> {
+    let img = image::load_from_memory(raw).map_err(|e| format!("Couldn't read image: {e}"))?;
+    // Only ever shrink. `resize` preserves aspect, fitting within the box; a
+    // higher-quality filter than `thumbnail` since a background fills the window.
+    let scaled = if img.width() > BACKGROUND_MAX_PX || img.height() > BACKGROUND_MAX_PX {
+        img.resize(
+            BACKGROUND_MAX_PX,
+            BACKGROUND_MAX_PX,
+            image::imageops::FilterType::Lanczos3,
+        )
+    } else {
+        img
+    };
+    let mut png = std::io::Cursor::new(Vec::new());
+    scaled
+        .write_to(&mut png, image::ImageFormat::Png)
+        .map_err(|e| format!("Couldn't encode image: {e}"))?;
+    Ok(png.into_inner())
+}
+
+/// The legibility scrim drawn between the background image and the UI: the active
+/// theme's base colour at `dim` alpha (clamped to `0.0..=1.0`). A higher `dim`
+/// recedes the image so body text and panel chrome stay readable, and it re-tints
+/// per theme since `base` comes from the active palette.
+pub fn scrim_color(base: Color, dim: f32) -> Color {
+    Color { a: dim.clamp(0.0, 1.0), ..base }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A valid PNG of the given size, as raw bytes (test helper).
+    fn make_png(w: u32, h: u32) -> Vec<u8> {
+        let img = image::DynamicImage::new_rgb8(w, h);
+        let mut buf = std::io::Cursor::new(Vec::new());
+        img.write_to(&mut buf, image::ImageFormat::Png).unwrap();
+        buf.into_inner()
+    }
+
+    #[test]
+    fn process_background_downscales_oversized() {
+        // A 4000x2000 image is shrunk so the longest side is BACKGROUND_MAX_PX,
+        // aspect preserved, and the result re-decodes as a PNG within bounds.
+        let raw = make_png(4000, 2000);
+        let png = process_background(&raw).expect("should process");
+        let decoded = image::load_from_memory(&png).unwrap();
+        assert_eq!(decoded.width().max(decoded.height()), BACKGROUND_MAX_PX);
+        assert_eq!(decoded.width(), BACKGROUND_MAX_PX);
+        assert_eq!(decoded.height(), BACKGROUND_MAX_PX / 2); // 2:1 aspect kept
+    }
+
+    #[test]
+    fn process_background_leaves_small_images_unscaled() {
+        let raw = make_png(640, 480);
+        let png = process_background(&raw).expect("should process");
+        let decoded = image::load_from_memory(&png).unwrap();
+        assert_eq!((decoded.width(), decoded.height()), (640, 480));
+    }
+
+    #[test]
+    fn process_background_rejects_non_image() {
+        assert!(process_background(b"definitely not an image").is_err());
+    }
+
+    #[test]
+    fn scrim_color_sets_alpha_and_keeps_rgb() {
+        let base = Color::from_rgb(0.1, 0.2, 0.3);
+        let s = scrim_color(base, 0.5);
+        assert_eq!((s.r, s.g, s.b), (0.1, 0.2, 0.3));
+        assert!((s.a - 0.5).abs() < f32::EPSILON);
+    }
+
+    #[test]
+    fn scrim_color_clamps_dim() {
+        let base = Color::BLACK;
+        assert!((scrim_color(base, -1.0).a - 0.0).abs() < f32::EPSILON);
+        assert!((scrim_color(base, 2.0).a - 1.0).abs() < f32::EPSILON);
+    }
+}
@@ -1,11 +1,11 @@
 //! Audio playout diagnostic probe.
 //!
-//! Drives a phase-continuous sine tone through the *real* PipeWire playback path
-//! (`PipeWireBackend::start_playback`), using the *same* fill-paced production
-//! the production mixer uses (`core/mod.rs`): generate a frame only while the
+//! Drives a phase-continuous sine tone through the *real* playback path
+//! (PipeWire on Linux, cpal/WASAPI on Windows), using the *same* fill-paced
+//! production the production mixer uses (`core/mod.rs`): generate a frame only while the
 //! playback ring is below `PLAYBACK_TARGET_SAMPLES`, so production tracks the
-//! PipeWire hardware clock. No network, no microphone — this isolates the local
-//! output path so we can confirm the clock-paced playout is glitch-free.
+//! hardware clock. No network, no microphone — this isolates the local output
+//! path so we can confirm the clock-paced playout is glitch-free.
 //!
 //! Use your ears on the tone (any click/pop is a glitch) together with the
 //! `playout-health:` lines tailed to stdout:
@@ -18,17 +18,24 @@
 //! Run:  cargo run --bin audio_probe -- [freq_hz] [seconds] [target_node]
 //!   e.g. cargo run --release --bin audio_probe -- 440 30
 //!
-//! This probe exercises the PipeWire backend directly, so it is a Linux-only tool.
-//! On non-Linux targets `main` is a stub that explains the limitation.
+//! This probe exercises the platform playback backend directly: PipeWire on Linux
+//! and cpal/WASAPI on Windows. Other targets use a stub that explains the limitation.

 #[cfg(target_os = "linux")]
 fn main() {
    unix_probe::run();
 }

-#[cfg(not(target_os = "linux"))]
+#[cfg(windows)]
 fn main() {
-    eprintln!("audio_probe is only supported on Linux builds (it drives the PipeWire backend directly).");
+    win_probe::run();
+}
+
+#[cfg(not(any(target_os = "linux", windows)))]
+fn main() {
+    eprintln!(
+        "audio_probe is only supported on Linux and Windows builds (it drives the platform playback backend directly)."
+    );
 }

 #[cfg(target_os = "linux")]
@@ -88,7 +95,114 @@ mod unix_probe {
            for _ in 0..FRAME_SAMPLES {
                let t = n as f32 / SAMPLE_RATE;
                // 0.25 amplitude: clearly audible but not harsh.
-                let sample = (0.25 * i16::MAX as f32 * (2.0 * std::f32::consts::PI * freq * t).sin()) as i16;
+                let sample =
+                    (0.25 * i16::MAX as f32 * (2.0 * std::f32::consts::PI * freq * t).sin()) as i16;
+                // Stereo playback bus: duplicate the probe tone to L/R.
+                frame.push(sample);
+                frame.push(sample);
+                n += 1;
+            }
+            if tx.send(frame).is_err() {
+                eprintln!("playback channel closed early");
+                break;
+            }
+        }
+
+        // Let the ring drain, then stop.
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        let _ = backend.stop();
+        println!("\naudio_probe: done.");
+    }
+
+    /// Open the app log, seek to the end, and echo new lines (the `playout-health:`
+    /// reports) to stdout once they appear.
+    fn spawn_log_tailer() {
+        let path = peerspeak::log_file_path();
+        std::thread::spawn(move || {
+            // Wait for the file to exist (first log_msg creates it).
+            let file = loop {
+                if let Ok(f) = std::fs::File::open(&path) {
+                    break f;
+                }
+                std::thread::sleep(Duration::from_millis(100));
+            };
+            let mut reader = BufReader::new(file);
+            let _ = reader.seek(SeekFrom::End(0));
+            loop {
+                let mut line = String::new();
+                match reader.read_line(&mut line) {
+                    Ok(0) => std::thread::sleep(Duration::from_millis(150)),
+                    Ok(_) => {
+                        if line.contains("playout-health:") {
+                            print!("{line}");
+                        }
+                    }
+                    Err(_) => std::thread::sleep(Duration::from_millis(150)),
+                }
+            }
+        });
+    }
+}
+
+#[cfg(windows)]
+mod win_probe {
+    use std::io::{BufRead, BufReader, Seek, SeekFrom};
+    use std::sync::Arc;
+    use std::sync::atomic::AtomicUsize;
+    use std::sync::mpsc;
+    use std::time::Duration;
+
+    use peerspeak::audio::AudioBackend;
+    use peerspeak::audio::cpal_impl::CpalBackend;
+    use peerspeak::core::jitter::FRAME_SAMPLES; // 960 mono frames = 20ms @ 48kHz
+
+    const SAMPLE_RATE: f32 = 48_000.0;
+
+    #[tokio::main]
+    pub async fn run() {
+        let mut args = std::env::args().skip(1);
+        let freq: f32 = args.next().and_then(|s| s.parse().ok()).unwrap_or(440.0);
+        let secs: u64 = args.next().and_then(|s| s.parse().ok()).unwrap_or(30);
+        let target_node: Option<String> = args.next();
+
+        // The playout-health logger is quiet in normal operation (it only logs
+        // glitches); ask it for the full once-per-second heartbeat so the probe can
+        // show the steady-state numbers.
+        // SAFETY: set before any playback thread starts, so no concurrent env read.
+        unsafe { std::env::set_var("PEERSPEAK_AUDIO_VERBOSE", "1") };
+
+        println!("audio_probe: {freq} Hz tone for {secs}s through the real playback path.");
+        println!("Listen for clicks/pops; watch the playout-health lines below.\n");
+
+        // Tail the app log (where playout-health lines land) to stdout in the
+        // background so it's all in one terminal.
+        spawn_log_tailer();
+
+        let backend = CpalBackend::new();
+        let (tx, rx) = mpsc::channel::<Vec<i16>>();
+        let ring_fill = Arc::new(AtomicUsize::new(0));
+        if let Err(e) = backend.start_playback(rx, target_node, ring_fill.clone()) {
+            eprintln!("failed to start playback: {e}");
+            return;
+        }
+
+        // Phase-continuous sine, generated one 20ms frame at a time, fill-paced
+        // exactly like the production mixer: only produce while the ring is below
+        // target, so production tracks the cpal/WASAPI hardware clock.
+        use std::sync::atomic::Ordering;
+        let deadline = tokio::time::Instant::now() + Duration::from_secs(secs);
+        let mut n: u64 = 0; // running sample index keeps phase continuous across frames
+        while tokio::time::Instant::now() < deadline {
+            if ring_fill.load(Ordering::Relaxed) >= peerspeak::audio::PLAYBACK_TARGET_SAMPLES {
+                tokio::time::sleep(Duration::from_millis(2)).await;
+                continue;
+            }
+            let mut frame = Vec::with_capacity(FRAME_SAMPLES * peerspeak::audio::PLAYBACK_CHANNELS);
+            for _ in 0..FRAME_SAMPLES {
+                let t = n as f32 / SAMPLE_RATE;
+                // 0.25 amplitude: clearly audible but not harsh.
+                let sample =
+                    (0.25 * i16::MAX as f32 * (2.0 * std::f32::consts::PI * freq * t).sin()) as i16;
                // Stereo playback bus: duplicate the probe tone to L/R.
                frame.push(sample);
                frame.push(sample);
@@ -106,6 +106,10 @@ fn default_true() -> bool {
    true
 }

+fn default_background_dim() -> f32 {
+    crate::background::DEFAULT_DIM
+}
+
 fn default_volume() -> f32 {
    1.0
 }
@@ -185,6 +189,16 @@ pub struct AppConfig {
    /// Our chosen avatar (W4): monogram fallback or a bundled preset.
    #[serde(default)]
    pub avatar: crate::avatar::Avatar,
+    /// Custom UI background image (W16): path to the downscaled PNG we wrote into
+    /// the config dir (see `background_path`). `None` = use the theme background.
+    /// Local-only; never sent to peers.
+    #[serde(default)]
+    pub background: Option<String>,
+    /// Scrim strength drawn over the custom background for legibility (0.0 = image
+    /// at full strength, 1.0 = fully hidden behind the theme base). See
+    /// `crate::background::scrim_color`.
+    #[serde(default = "default_background_dim")]
+    pub background_dim: f32,
    /// What a call recording captures (mixed / per-peer stems / both).
    #[serde(default)]
    pub recording_mode: RecordingMode,
@@ -241,6 +255,15 @@ pub struct AppConfig {
    /// keyed by peer node id string. Local preference only.
    #[serde(default)]
    pub peer_pan: HashMap<String, f32>,
+    /// Per-peer listener-side volume/gain (`1.0` = unity), keyed by peer node id
+    /// string. Local preference only; never sent to peers. Absent entry = unity.
+    #[serde(default)]
+    pub peer_volume: HashMap<String, f32>,
+    /// Per-peer listener-side noise-gate threshold (normalized RMS, `0.0` = off),
+    /// keyed by peer node id string. Local preference only; never sent to peers.
+    /// Absent entry = gate disabled (pass-through).
+    #[serde(default)]
+    pub peer_gate: HashMap<String, f32>,
    /// Focused app-local keyboard shortcuts.
    #[serde(default)]
    pub hotkeys: crate::hotkeys::HotkeyMap,
@@ -280,6 +303,8 @@ impl Default for AppConfig {
            room_layout: RoomLayout::default(),
            theme: AppTheme::default(),
            avatar: crate::avatar::Avatar::default(),
+            background: None,
+            background_dim: default_background_dim(),
            recording_mode: RecordingMode::default(),
            custom_sound_self_join: None,
            custom_sound_peer_join: None,
@@ -301,6 +326,8 @@ impl Default for AppConfig {
            recents: Vec::new(),
            peer_eq: HashMap::new(),
            peer_pan: HashMap::new(),
+            peer_volume: HashMap::new(),
+            peer_gate: HashMap::new(),
            hotkeys: crate::hotkeys::HotkeyMap::default(),
            window_width: default_window_width(),
            window_height: default_window_height(),
@@ -348,6 +375,17 @@ impl AppConfig {
        })
    }

+    /// Path the processed custom-background PNG (W16) is written to, alongside
+    /// `config.json` in the app config dir. We store our own downscaled copy here
+    /// (rather than base64 in the config) so the JSON stays small.
+    pub fn background_path() -> Option<PathBuf> {
+        dirs::config_dir().map(|mut p| {
+            p.push("peerspeak");
+            p.push("background.png");
+            p
+        })
+    }
+
    pub fn load() -> Self {
        if let Some(path) = Self::config_path()
            && let Ok(contents) = fs::read_to_string(&path)
@@ -430,6 +468,8 @@ mod tests {
        // shortcut settings.
        assert!(deserialized.peer_eq.is_empty());
        assert!(deserialized.peer_pan.is_empty());
+        assert!(deserialized.peer_volume.is_empty());
+        assert!(deserialized.peer_gate.is_empty());
        assert_eq!(
            crate::hotkeys::format_binding(
                deserialized
@@ -26,6 +26,10 @@ pub enum CoreCommand {
    SetPeerEq(EndpointId, crate::audio::eq::EqSettings),
    /// Listener-side per-peer pan. Local only; never leaves this app instance.
    SetPeerPan(EndpointId, f32),
+    /// Listener-side per-peer noise gate threshold (normalized RMS, `0.0` = off).
+    /// Applies the same smooth gate as the mic path to a peer's incoming audio,
+    /// to suppress their background noise on our end. Local only.
+    SetPeerGate(EndpointId, f32),
    /// Locally mute/unmute a peer: when muted, their audio is decoded (so levels
    /// still show) but not mixed into our output.
    SetPeerMuted(EndpointId, bool),
@@ -49,6 +53,14 @@ pub enum CoreCommand {
    SetRecordingMode(RecordingMode),
    /// Broadcast a room text-chat message. No-op when not in a call.
    SendChat(String),
+    /// Send a chat message carrying a file attachment. The app has already read +
+    /// capped the file and built the descriptor; core makes the bytes available
+    /// on the file plane and broadcasts the descriptor.
+    SendChatFile { text: String, attachment: crate::files::ChatAttachment, data: Vec<u8> },
+    /// Fetch a received attachment's bytes from its sender over the file plane
+    /// (used for on-demand file/chip downloads; images are auto-fetched on
+    /// receipt). Replies with `AttachmentReady`/`AttachmentFailed`.
+    FetchAttachment { from: EndpointId, attachment: crate::files::ChatAttachment },
    /// Set the pixelpass binary location (config override, empty = use `$PATH`).
    /// Sent at startup so screen-share can resolve the binary.
    SetPixelpassPath(Option<String>),
@@ -85,6 +97,9 @@ pub enum UiEvent {
    RoomLeft,
    PeerJoined { id: EndpointId, state: PeerState },
    PeerLeft { id: EndpointId },
+    /// The fixed reconnect grace expired and bounded background gossip recovery
+    /// has started. This is non-terminal and must not play the failure chime.
+    PeerRecoveryStarted { id: EndpointId },
    PeerConnectionFailed { id: EndpointId },
    PeerUpdated { id: EndpointId, state: PeerState },
    /// Audio link to a peer is being (re)established — show a connecting state.
@@ -102,7 +117,13 @@ pub enum UiEvent {
    /// A room text-chat message arrived from a peer (never our own — local
    /// messages are echoed by the UI on send). `from` is the sender's node id
    /// string, used to key their avatar (W4).
-    ChatMessage { from: String, name: String, text: String },
+    ChatMessage { from: String, name: String, text: String, attachment: Option<crate::files::ChatAttachment> },
+    /// An attachment's bytes are now available (auto-fetched for images, or
+    /// fetched on demand for files). Keyed by attachment id so the UI can match
+    /// it to the chat entry.
+    AttachmentReady { id: crate::files::AttachmentId, data: Vec<u8> },
+    /// An attachment fetch failed (sender gone, too large, decode error, etc.).
+    AttachmentFailed { id: crate::files::AttachmentId, error: String },
    /// Our own screen share started; the UI flips the Share button to "Stop".
    ScreenShareStarted,
    /// Our own screen share stopped (or failed to start).
@@ -1,5 +1,6 @@
 pub mod messages;
 pub mod jitter;
+mod recovery;

 use crate::audio::{AudioBackend, PlatformAudioBackend};
 use crate::audio::eq::{Eq, EqSettings};
@@ -7,10 +8,11 @@ use crate::codec::{AudioEncoder, opus_impl::OpusEncoder};
 use crate::core::jitter::{JitterBuffer, FRAME_SAMPLES};
 use crate::network::{
    NetworkTransport, RoomState, PeerState, RoomEvent, ConnEvent, PeerSpeakTicket,
-    iroh_impl::{IrohTransport, AudioRouter},
+    iroh_impl::{IrohTransport, AudioRouter, FileRouter},
    gossip::IrohGossipState,
 };
 use crate::core::messages::{CoreCommand, UiEvent};
+use crate::core::recovery::RecoveryCoordinator;

 use crate::config::{NetworkMode, RecordingMode};
 use crate::presence::PresenceMode;
@@ -102,6 +104,39 @@ type GraceTimers = Arc<std::sync::Mutex<HashMap<EndpointId, tokio::task::JoinHan
 /// Scrubbed whenever a peer is evicted or leaves so a later rejoin starts clean.
 type SeenConnected = Arc<std::sync::Mutex<HashSet<EndpointId>>>;

+type KnownPeers =
+    Arc<std::sync::Mutex<HashMap<String, HashMap<EndpointId, EndpointAddr>>>>;
+
+#[derive(Clone)]
+struct RecoveryContext {
+    coordinator: RecoveryCoordinator,
+    room_state: Arc<IrohGossipState>,
+    known_peers: KnownPeers,
+    ticket: String,
+}
+
+impl RecoveryContext {
+    fn retained_addr(&self, peer_id: &EndpointId) -> Option<EndpointAddr> {
+        self.known_peers
+            .lock()
+            .unwrap()
+            .get(&self.ticket)
+            .and_then(|peers| peers.get(peer_id))
+            .cloned()
+    }
+
+    fn cancel(&self, peer_id: EndpointId) {
+        self.coordinator.cancel(peer_id);
+    }
+
+    fn forget(&self, peer_id: EndpointId) {
+        if let Some(peers) = self.known_peers.lock().unwrap().get_mut(&self.ticket) {
+            peers.remove(&peer_id);
+        }
+        self.coordinator.cancel(peer_id);
+    }
+}
+
 /// Cancel and forget a peer's pending grace timer, if any. No-op if none is armed.
 fn cancel_grace_timer(timers: &GraceTimers, peer_id: &EndpointId) {
    if let Some(handle) = timers.lock().unwrap().remove(peer_id) {
@@ -116,12 +151,17 @@ fn cancel_grace_timer(timers: &GraceTimers, peer_id: &EndpointId) {
 /// link repeatedly resetting the clock and dodging eviction forever. On firing it
 /// also scrubs the peer from `seen_connected` so a later rejoin isn't treated as a
 /// reconnect on its initial dial.
+struct GraceExpiry<'a> {
+    transport: &'a Arc<IrohTransport>,
+    jitter: &'a Arc<Mutex<HashMap<EndpointId, JitterBuffer>>>,
+    ui_tx: &'a mpsc::Sender<UiEvent>,
+    recovery: Option<&'a RecoveryContext>,
+}
+
 fn arm_grace_timer(
    timers: &GraceTimers,
    seen_connected: &SeenConnected,
-    transport: &Arc<IrohTransport>,
-    jitter: &Arc<Mutex<HashMap<EndpointId, JitterBuffer>>>,
-    ui_tx: &mpsc::Sender<UiEvent>,
+    expiry: GraceExpiry<'_>,
    grace: Duration,
    peer_id: EndpointId,
 ) {
@@ -129,15 +169,29 @@ fn arm_grace_timer(
    if timers_guard.contains_key(&peer_id) {
        return;
    }
-    let transport_evict = transport.clone();
-    let jitter_evict = jitter.clone();
-    let ui_evict = ui_tx.clone();
+    let transport_evict = expiry.transport.clone();
+    let jitter_evict = expiry.jitter.clone();
+    let ui_evict = expiry.ui_tx.clone();
    let timers_evict = timers.clone();
    let seen_evict = seen_connected.clone();
+    let recovery_evict = expiry.recovery.cloned();
    let handle = tokio::spawn(async move {
        tokio::time::sleep(grace).await;
-        crate::log_msg(&format!("Reconnect grace expired; evicting peer {:?}", peer_id));
+        crate::log_msg(&format!("Reconnect grace expired for peer {:?}", peer_id));
+
+        if let Some(recovery) = &recovery_evict
+            && !recovery.coordinator.begin(peer_id)
+        {
+            return;
+        }
+
        transport_evict.remove_audio_sender(peer_id);
+        if let Some(recovery) = &recovery_evict {
+            // Revoke roster authority before the first await in teardown. A
+            // verified Announce racing after this point is then a PeerJoined and
+            // cancels recovery instead of being erased after it was accepted.
+            recovery.room_state.mark_peer_disconnected(peer_id);
+        }
        transport_evict.disconnect_peer(peer_id).await;
        jitter_evict.lock().await.remove(&peer_id);
        // Scrub our internal state *before* announcing the eviction, so anything
@@ -146,7 +200,38 @@ fn arm_grace_timer(
        // reconnect.
        timers_evict.lock().unwrap().remove(&peer_id);
        seen_evict.lock().unwrap().remove(&peer_id);
-        let _ = ui_evict.send(UiEvent::PeerConnectionFailed { id: peer_id }).await;
+
+        let Some(recovery) = recovery_evict else {
+            let _ = ui_evict.send(UiEvent::PeerConnectionFailed { id: peer_id }).await;
+            return;
+        };
+        if !recovery.coordinator.is_active(&peer_id) {
+            return;
+        }
+
+        let Some(addr) = recovery.retained_addr(&peer_id) else {
+            crate::log_msg(&format!(
+                "Cannot recover peer {:?}: no retained authenticated address",
+                peer_id
+            ));
+            recovery.cancel(peer_id);
+            let _ = ui_evict.send(UiEvent::PeerConnectionFailed { id: peer_id }).await;
+            return;
+        };
+
+        match recovery.coordinator.activate(peer_id, addr) {
+            Ok(true) => {
+                let _ = ui_evict.send(UiEvent::PeerRecoveryStarted { id: peer_id }).await;
+            }
+            Ok(false) => {}
+            Err(()) => {
+                crate::log_msg(&format!(
+                    "Cannot recover peer {:?}: recovery coordinator unavailable",
+                    peer_id
+                ));
+                let _ = ui_evict.send(UiEvent::PeerConnectionFailed { id: peer_id }).await;
+            }
+        }
    });
    timers_guard.insert(peer_id, handle);
 }
@@ -309,6 +394,7 @@ pub struct ConnEventHandler {
    seen_connected: SeenConnected,
    transport: Arc<IrohTransport>,
    jitter: Arc<Mutex<HashMap<EndpointId, JitterBuffer>>>,
+    recovery: Option<RecoveryContext>,
    grace: Duration,
 }

@@ -326,6 +412,7 @@ impl ConnEventHandler {
            seen_connected,
            transport,
            jitter,
+            recovery: None,
            grace: RECONNECT_GRACE,
        }
    }
@@ -336,6 +423,11 @@ impl ConnEventHandler {
        self
    }

+    fn with_recovery(mut self, recovery: RecoveryContext) -> Self {
+        self.recovery = Some(recovery);
+        self
+    }
+
    pub async fn handle(&self, event: ConnEvent) {
        match event {
            ConnEvent::Connecting(id) => {
@@ -349,9 +441,12 @@ impl ConnEventHandler {
                    arm_grace_timer(
                        &self.grace_timers,
                        &self.seen_connected,
-                        &self.transport,
-                        &self.jitter,
-                        &self.ui_tx,
+                        GraceExpiry {
+                            transport: &self.transport,
+                            jitter: &self.jitter,
+                            ui_tx: &self.ui_tx,
+                            recovery: self.recovery.as_ref(),
+                        },
                        self.grace,
                        id,
                    );
@@ -359,6 +454,15 @@ impl ConnEventHandler {
                let _ = self.ui_tx.send(UiEvent::PeerConnecting { id }).await;
            }
            ConnEvent::Connected(id) => {
+                // A transport event cannot readmit a grace-expired peer. Ignore a
+                // stale/racing link until authenticated gossip emits PeerJoined.
+                if self
+                    .recovery
+                    .as_ref()
+                    .is_some_and(|recovery| recovery.coordinator.is_active(&id))
+                {
+                    return;
+                }
                // The audio link came back — the peer recovered within the grace
                // window, so cancel its eviction.
                cancel_grace_timer(&self.grace_timers, &id);
@@ -371,6 +475,9 @@ impl ConnEventHandler {
                // until the grace timer or the slow gossip Leave.
                cancel_grace_timer(&self.grace_timers, &id);
                self.seen_connected.lock().unwrap().remove(&id);
+                if let Some(recovery) = &self.recovery {
+                    recovery.forget(id);
+                }
                self.transport.remove_audio_sender(id);
                self.transport.disconnect_peer(id).await;
                self.jitter.lock().await.remove(&id);
@@ -387,6 +494,7 @@ struct ActiveSession {
    mixer_task: tokio::task::JoinHandle<()>,
    event_task: tokio::task::JoinHandle<()>,
    conn_event_task: tokio::task::JoinHandle<()>,
+    recovery_task: tokio::task::JoinHandle<()>,
    grace_timers: GraceTimers,
    transport: Arc<IrohTransport>,
    /// Loaded PipeWire echo-cancel module (if enabled); unloads on drop.
@@ -421,6 +529,7 @@ impl ActiveSession {
        for (_, handle) in self.grace_timers.lock().unwrap().drain() {
            handle.abort();
        }
+        self.recovery_task.abort();
        crate::log_msg("Aborted tasks");

        let audio_backend_clone = audio_backend.clone();
@@ -469,6 +578,9 @@ struct NetStack {
    /// The persistent inbound-audio handler on `router`; per-join we bind the
    /// active session's transport into it, and clear it on leave.
    audio_router: AudioRouter,
+    /// The persistent chat-file-transfer handler on `router`; bound/cleared in
+    /// lock-step with `audio_router` (same session lifecycle).
+    file_router: FileRouter,
    /// In-memory address book (ticket + gossip fed), shared with every session.
    memory_lookup: iroh::address_lookup::memory::MemoryLookup,
 }
@@ -580,6 +692,7 @@ async fn build_net_stack(
        .spawn(endpoint.clone());

    let audio_router = AudioRouter::new();
+    let file_router = FileRouter::new();
    // The friends presence listener (W7 B2) rides this same persistent router as a
    // third ALPN — it MUST be a handler here, not a standalone accept loop, since
    // the router owns endpoint.accept(). Policy (who we answer / what room we
@@ -587,6 +700,7 @@ async fn build_net_stack(
    let router = Router::builder(endpoint.clone())
        .accept(iroh_gossip::net::GOSSIP_ALPN, gossip.clone())
        .accept(crate::protocol::AUDIO_ALPN, audio_router.clone())
+        .accept(crate::protocol::FILES_ALPN, file_router.clone())
        .accept(
            crate::presence_net::FRIENDS_ALPN,
            crate::presence_net::FriendsProtocol::new(friends_handler),
@@ -598,10 +712,49 @@ async fn build_net_stack(
        gossip,
        router,
        audio_router,
+        file_router,
        memory_lookup,
    })
 }

+/// Fetch a chat attachment's bytes from `from` over the file plane in a detached
+/// task, then report the result to the UI via [`UiEvent::AttachmentReady`] /
+/// [`UiEvent::AttachmentFailed`] keyed by the attachment id. For images
+/// (`is_image`) the bytes are defensively re-validated (decodable + within pixel
+/// limits) before being handed to the renderer; an "Image" that doesn't decode is
+/// reported as a failure rather than rendered.
+fn spawn_attachment_fetch(
+    transport: Arc<IrohTransport>,
+    ui_tx: mpsc::Sender<UiEvent>,
+    from: EndpointId,
+    att: crate::files::ChatAttachment,
+    is_image: bool,
+) {
+    tokio::spawn(async move {
+        match transport.fetch_attachment(from, &att).await {
+            Ok(data) => {
+                if is_image && crate::files::validate_image_bytes(&data).is_none() {
+                    let _ = ui_tx
+                        .send(UiEvent::AttachmentFailed {
+                            id: att.id,
+                            error: "received image failed to decode".to_string(),
+                        })
+                        .await;
+                    return;
+                }
+                let _ = ui_tx
+                    .send(UiEvent::AttachmentReady { id: att.id, data })
+                    .await;
+            }
+            Err(e) => {
+                let _ = ui_tx
+                    .send(UiEvent::AttachmentFailed { id: att.id, error: e.to_string() })
+                    .await;
+            }
+        }
+    });
+}
+
 /// Finalize and clear the active recording, if any, emitting `RecordingStopped`.
 /// No-op when not recording. Called on stop, room leave, and room switch so a
 /// recording is always closed cleanly (its WAV size fields patched).
@@ -730,8 +883,7 @@ async fn run_core_loop(
    // first room's peers — the old single-set version cleared them on any ticket
    // change, so an A→B→A bounce stranded the rejoiner with an empty bootstrap.
    // Inner map keyed by peer id so updates refresh the address.
-    let known_peers: Arc<std::sync::Mutex<HashMap<String, HashMap<EndpointId, EndpointAddr>>>> =
-        Arc::new(std::sync::Mutex::new(HashMap::new()));
+    let known_peers: KnownPeers = Arc::new(std::sync::Mutex::new(HashMap::new()));

    let audio_backend = Arc::new(PlatformAudioBackend::new());

@@ -761,6 +913,8 @@ async fn run_core_loop(
    let peer_volumes = Arc::new(Mutex::new(HashMap::<EndpointId, f32>::new()));
    let peer_eq = Arc::new(Mutex::new(HashMap::<EndpointId, EqSettings>::new()));
    let peer_pan = Arc::new(Mutex::new(HashMap::<EndpointId, f32>::new()));
+    // Listener-side per-peer noise-gate thresholds (normalized RMS, 0.0 = off).
+    let peer_gate = Arc::new(Mutex::new(HashMap::<EndpointId, f32>::new()));
    // Peers locally muted by us: decoded for level metering but not mixed.
    let locally_muted = Arc::new(Mutex::new(HashSet::<EndpointId>::new()));
    let mut current_name = "Anonymous".to_string();
@@ -961,6 +1115,7 @@ async fn run_core_loop(
                if let Some(session) = active_session.take() {
                    session.shutdown(audio_backend.clone()).await;
                    net.audio_router.clear();
+                    net.file_router.clear();
                }
                *current_room.lock().unwrap() = None;

@@ -983,6 +1138,7 @@ async fn run_core_loop(
                    crate::log_msg("Shutting down existing active session");
                    session.shutdown(audio_backend.clone()).await;
                    net.audio_router.clear();
+                    net.file_router.clear();
                }

                // If a network-mode / identity change was deferred while a call was
@@ -1039,6 +1195,7 @@ async fn run_core_loop(
                // NetStack; the session just subscribes its topic below.
                let transport = Arc::new(IrohTransport::new(endpoint.clone()));
                net.audio_router.bind(&transport);
+                net.file_router.bind(&transport);

                let room_state = Arc::new(IrohGossipState::new(
                    endpoint.clone(),
@@ -1083,6 +1240,7 @@ async fn run_core_loop(
                    crate::log_msg(&format!("Error room_state.join failed: {:?}", e));
                    let _ = ui_tx.send(UiEvent::Error(format!("Failed to join room: {}", e))).await;
                    net.audio_router.clear();
+                    net.file_router.clear();
                    continue;
                }
                crate::log_msg("Joined room successfully via room_state");
@@ -1135,6 +1293,7 @@ async fn run_core_loop(
                    let _ = ui_tx.send(UiEvent::Error(format!("Failed to start capture: {}", e))).await;
                    let _ = room_state.leave().await;
                    net.audio_router.clear();
+                    net.file_router.clear();
                    continue;
                }

@@ -1147,6 +1306,7 @@ async fn run_core_loop(
                    let _ = audio_backend.stop();
                    let _ = room_state.leave().await;
                    net.audio_router.clear();
+                    net.file_router.clear();
                    continue;
                }

@@ -1289,6 +1449,7 @@ async fn run_core_loop(
                let peer_volumes_mixer = peer_volumes.clone();
                let peer_eq_mixer = peer_eq.clone();
                let peer_pan_mixer = peer_pan.clone();
+                let peer_gate_mixer = peer_gate.clone();
                let locally_muted_mixer = locally_muted.clone();
                let output_gain_mixer = output_gain.clone();
                let ui_tx_mixer = ui_tx.clone();
@@ -1305,6 +1466,11 @@ async fn run_core_loop(
                    // Per-peer EQ filter state. Settings are live-cloned each
                    // cycle; state is rebuilt only when a peer's EQ changes.
                    let mut peer_eqs: HashMap<EndpointId, Eq> = HashMap::new();
+                    // Per-peer noise-gate envelope state. The threshold is passed
+                    // per frame (live slider), so the gate is never rebuilt — only
+                    // created once per peer and dropped when the peer leaves.
+                    let mut peer_noise_gates: HashMap<EndpointId, crate::audio::gate::NoiseGate> =
+                        HashMap::new();
                    // When the ring is at/above target we have nothing to do; nap
                    // briefly and re-check. Short enough (relative to the ~60ms
                    // target and ~21ms device quantum) that we always refill well
@@ -1330,6 +1496,7 @@ async fn run_core_loop(
                        let current_volumes = peer_volumes_mixer.lock().await.clone();
                        let current_eq = peer_eq_mixer.lock().await.clone();
                        let current_pans = peer_pan_mixer.lock().await.clone();
+                        let current_gates = peer_gate_mixer.lock().await.clone();
                        let muted_peers = locally_muted_mixer.lock().await.clone();
                        let mut peer_frames: Vec<(Vec<i16>, f32)> = Vec::new();
                        let mut peers_seen = HashSet::new();
@@ -1355,6 +1522,26 @@ async fn run_core_loop(
                                    stems.push((peer_id, frame.clone()));
                                }

+                                // Listener-side per-peer noise gate, applied to the
+                                // raw decoded frame (after the clean stem tap, before
+                                // volume/EQ) so the threshold tracks the peer's true
+                                // signal level regardless of our volume setting. The
+                                // gate's "should transmit" return is irrelevant here —
+                                // we only attenuate. Threshold 0 = off; the gate is
+                                // created lazily and dropped when disabled.
+                                let gate_threshold =
+                                    current_gates.get(&peer_id).copied().unwrap_or(0.0);
+                                if gate_threshold > 0.0 {
+                                    peer_noise_gates
+                                        .entry(peer_id)
+                                        .or_insert_with(|| {
+                                            crate::audio::gate::NoiseGate::new(48_000)
+                                        })
+                                        .process(&mut frame, gate_threshold);
+                                } else {
+                                    peer_noise_gates.remove(&peer_id);
+                                }
+
                                let vol = current_volumes.get(&peer_id).copied().unwrap_or(1.0);
                                apply_volume(&mut frame, vol);

@@ -1399,6 +1586,8 @@ async fn run_core_loop(
                            }
                        }
                        peer_eqs.retain(|id, _| peers_seen.contains(id) || current_eq.contains_key(id));
+                        peer_noise_gates
+                            .retain(|id, _| peers_seen.contains(id) || current_gates.contains_key(id));

                        // Lossless i32 sum, then the limiter applies the master
                        // output gain (in f32, so a boost past the ceiling is
@@ -1474,6 +1663,15 @@ async fn run_core_loop(
                // The ticket of the room this event loop serves, so peer add/remove
                // updates the right per-ticket bucket in `known_peers` (A8 archive).
                let ticket_events = ticket_str.clone();
+                let (recovery_coordinator, recovery_task) =
+                    RecoveryCoordinator::spawn(room_state.clone());
+                let recovery_context = RecoveryContext {
+                    coordinator: recovery_coordinator,
+                    room_state: room_state.clone(),
+                    known_peers: known_peers.clone(),
+                    ticket: ticket_str.clone(),
+                };
+                let recovery_events = recovery_context.clone();
                // Friends store + ui sender, so a connected peer who is a friend has
                // their saved address auto-healed (W7) — populates `last_addr` so the
                // presence scheduler can reach them later.
@@ -1486,6 +1684,7 @@ async fn run_core_loop(
                                // A (re)join means the peer is back — cancel any
                                // pending reconnect grace timer before re-adding it.
                                cancel_grace_timer(&grace_timers_events, &peer_id);
+                                recovery_events.cancel(peer_id);
                                transport_events.admit_audio_sender(peer_id);
                                // Establish the audio connection as soon as the peer
                                // is known (the transport dedupes the full-mesh race).
@@ -1529,15 +1728,9 @@ async fn run_core_loop(
                                // Graceful leave — evict immediately.
                                cancel_grace_timer(&grace_timers_events, &peer_id);
                                seen_connected_events.lock().unwrap().remove(&peer_id);
-                                // Graceful leave: drop them as a rejoin dial target
-                                // for this room (a transient PeerConnectionLost
-                                // deliberately does NOT, so we can still re-dial a
-                                // peer who's still up).
-                                if let Some(peers) =
-                                    known_peers_events.lock().unwrap().get_mut(&ticket_events)
-                                {
-                                    peers.remove(&peer_id);
-                                }
+                                // A signed Leave cancels background recovery and
+                                // drops the retained target. Transient loss keeps it.
+                                recovery_events.forget(peer_id);
                                transport_events.remove_audio_sender(peer_id);
                                transport_events.disconnect_peer(peer_id).await;
                                jitter_events.lock().await.remove(&peer_id);
@@ -1551,6 +1744,7 @@ async fn run_core_loop(
                                // it. Idempotent: an ordinary mute/unmute update just
                                // re-records the same address.
                                cancel_grace_timer(&grace_timers_events, &peer_id);
+                                recovery_events.cancel(peer_id);
                                transport_events.admit_audio_sender(peer_id);
                                transport_events.connect_peer(state.addr.clone()).await;
                                // Auto-heal a friend's saved address (W7) on the
@@ -1578,11 +1772,27 @@ async fn run_core_loop(
                                    .insert(peer_id, state.addr.clone());
                                let _ = ui_tx_events.send(UiEvent::PeerUpdated { id: peer_id, state }).await;
                            }
-                            RoomEvent::ChatMessage { from, name, text, .. } => {
+                            RoomEvent::ChatMessage { from, name, text, ts: _, attachment } => {
+                                // Auto-fetch image attachments so they render inline
+                                // without a click; non-image files wait for an explicit
+                                // FetchAttachment (the "Save" chip). The descriptor was
+                                // already filename-sanitized + size-capped on ingest.
+                                if let Some(att) = attachment.clone()
+                                    && att.kind == crate::files::AttachmentKind::Image
+                                {
+                                    spawn_attachment_fetch(
+                                        transport_events.clone(),
+                                        ui_tx_events.clone(),
+                                        from,
+                                        att,
+                                        true,
+                                    );
+                                }
                                let _ = ui_tx_events.send(UiEvent::ChatMessage {
                                    from: from.to_string(),
                                    name,
                                    text,
+                                    attachment,
                                }).await;
                            }
                            RoomEvent::PeerConnectionLost(peer_id) => {
@@ -1598,9 +1808,12 @@ async fn run_core_loop(
                                arm_grace_timer(
                                    &grace_timers_events,
                                    &seen_connected_events,
-                                    &transport_events,
-                                    &jitter_events,
-                                    &ui_tx_events,
+                                    GraceExpiry {
+                                        transport: &transport_events,
+                                        jitter: &jitter_events,
+                                        ui_tx: &ui_tx_events,
+                                        recovery: Some(&recovery_events),
+                                    },
                                    RECONNECT_GRACE,
                                    peer_id,
                                );
@@ -1624,7 +1837,8 @@ async fn run_core_loop(
                    seen_connected.clone(),
                    transport.clone(),
                    jitter.clone(),
-                );
+                )
+                .with_recovery(recovery_context);
                let conn_event_task = tokio::spawn(async move {
                    while let Some(event) = conn_events.recv().await {
                        conn_handler.handle(event).await;
@@ -1638,6 +1852,7 @@ async fn run_core_loop(
                    mixer_task,
                    event_task,
                    conn_event_task,
+                    recovery_task,
                    grace_timers,
                    transport: transport.clone(),
                    #[cfg(target_os = "linux")]
@@ -1680,6 +1895,7 @@ async fn run_core_loop(
                    session.shutdown(audio_backend.clone()).await;
                    // Stop routing inbound audio links — the endpoint/router stay up.
                    net.audio_router.clear();
+                    net.file_router.clear();
                    // No longer in a gathering — friends who ping see us as just online.
                    *current_room.lock().unwrap() = None;
                    let _ = ui_tx.send(UiEvent::RoomLeft).await;
@@ -1766,6 +1982,16 @@ async fn run_core_loop(
                }
            }

+            CoreCommand::SetPeerGate(peer_id, threshold) => {
+                let threshold = threshold.clamp(0.0, 1.0);
+                let mut guard = peer_gate.lock().await;
+                if threshold <= 0.0 {
+                    guard.remove(&peer_id);
+                } else {
+                    guard.insert(peer_id, threshold);
+                }
+            }
+
            CoreCommand::SetPeerMuted(peer_id, muted) => {
                let mut guard = locally_muted.lock().await;
                if muted {
@@ -1816,17 +2042,26 @@ async fn run_core_loop(
            }

            CoreCommand::SetNetworkMode(mode) => {
-                network_mode = mode;
-                // Rebuild the persistent stack to the new posture immediately if
-                // idle; if a call is active, defer to the next Leave/Join so the
-                // live call isn't disrupted (preserves "applies on next join").
-                if active_session.is_none() {
-                    let lookup = net.memory_lookup.clone();
-                    net.shutdown().await;
-                    let publish = presence_mode.lock().unwrap().publishes_to_discovery();
-                    net = build_net_stack(secret_key.clone(), network_mode, lookup, friends_handler.clone(), publish).await?;
-                } else {
-                    net_rebuild_pending = true;
+                // Skip when the posture is unchanged. The GUI re-sends the saved
+                // network mode as part of its startup config-sync, and that mode
+                // usually already matches the freshly-built stack — rebuilding the
+                // iroh endpoint for an identical posture just churns the network
+                // and adds a needless ~1s teardown+rebuild bounce at every launch
+                // (seen on both Linux and Windows/Wine). A real change still
+                // rebuilds exactly as before.
+                if mode != network_mode {
+                    network_mode = mode;
+                    // Rebuild the persistent stack to the new posture immediately if
+                    // idle; if a call is active, defer to the next Leave/Join so the
+                    // live call isn't disrupted (preserves "applies on next join").
+                    if active_session.is_none() {
+                        let lookup = net.memory_lookup.clone();
+                        net.shutdown().await;
+                        let publish = presence_mode.lock().unwrap().publishes_to_discovery();
+                        net = build_net_stack(secret_key.clone(), network_mode, lookup, friends_handler.clone(), publish).await?;
+                    } else {
+                        net_rebuild_pending = true;
+                    }
                }
            }

@@ -2040,12 +2275,38 @@ async fn run_core_loop(

            CoreCommand::SendChat(text) => {
                if let Some(session) = &active_session
-                    && let Err(e) = session.room_state.send_chat(text).await
+                    && let Err(e) = session.room_state.send_chat(text, None).await
                {
                    crate::log_msg(&format!("Failed to send chat: {e}"));
                }
            }

+            CoreCommand::SendChatFile { text, attachment, data } => {
+                if let Some(session) = &active_session {
+                    // Make the bytes fetchable by room members, then broadcast the
+                    // descriptor alongside the (possibly empty) caption text.
+                    session
+                        .transport
+                        .serve_attachment(attachment.id, Arc::new(data));
+                    if let Err(e) = session.room_state.send_chat(text, Some(attachment)).await {
+                        crate::log_msg(&format!("Failed to send chat file: {e}"));
+                    }
+                }
+            }
+
+            CoreCommand::FetchAttachment { from, attachment } => {
+                if let Some(session) = &active_session {
+                    let is_image = attachment.kind == crate::files::AttachmentKind::Image;
+                    spawn_attachment_fetch(
+                        session.transport.clone(),
+                        ui_tx.clone(),
+                        from,
+                        attachment,
+                        is_image,
+                    );
+                }
+            }
+
            CoreCommand::SetPixelpassPath(path) => {
                pixelpass_override = path.filter(|p| !p.trim().is_empty());
            }
@@ -0,0 +1,264 @@
+use crate::network::{RoomState, gossip::IrohGossipState};
+use iroh::{EndpointAddr, EndpointId};
+use std::collections::{HashMap, HashSet};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use tokio::sync::mpsc;
+use tokio::task::JoinHandle;
+use tokio::time::Instant;
+
+const RECOVERY_COMMAND_CAPACITY: usize = 64;
+const RECOVERY_DELAYS: [Duration; 7] = [
+    Duration::from_secs(1),
+    Duration::from_secs(2),
+    Duration::from_secs(4),
+    Duration::from_secs(8),
+    Duration::from_secs(15),
+    Duration::from_secs(30),
+    Duration::from_secs(60),
+];
+
+fn recovery_delay(attempt: usize) -> Duration {
+    RECOVERY_DELAYS[attempt.min(RECOVERY_DELAYS.len() - 1)]
+}
+
+enum RecoveryCommand {
+    Start {
+        peer_id: EndpointId,
+        addr: EndpointAddr,
+    },
+    Cancel(EndpointId),
+}
+
+struct RecoveryEntry {
+    addr: EndpointAddr,
+    attempt: usize,
+    next_attempt: Instant,
+}
+
+#[async_trait::async_trait]
+trait RecoveryRoom: Send + Sync {
+    async fn rebootstrap_peers(&self, peers: Vec<EndpointAddr>) -> Result<(), String>;
+}
+
+#[async_trait::async_trait]
+impl RecoveryRoom for IrohGossipState {
+    async fn rebootstrap_peers(&self, peers: Vec<EndpointAddr>) -> Result<(), String> {
+        RoomState::rebootstrap_peers(self, peers)
+            .await
+            .map_err(|error| error.to_string())
+    }
+}
+
+/// Cloneable command side of the single per-session recovery coordinator.
+/// `active` is shared with transport/event handlers so cancellation is visible
+/// immediately even while the coordinator is awaiting an in-flight gossip call.
+#[derive(Clone)]
+pub(super) struct RecoveryCoordinator {
+    tx: mpsc::Sender<RecoveryCommand>,
+    active: Arc<Mutex<HashSet<EndpointId>>>,
+}
+
+impl RecoveryCoordinator {
+    pub(super) fn spawn(room_state: Arc<IrohGossipState>) -> (Self, JoinHandle<()>) {
+        Self::spawn_inner(room_state)
+    }
+
+    fn spawn_inner(room_state: Arc<dyn RecoveryRoom>) -> (Self, JoinHandle<()>) {
+        let (tx, rx) = mpsc::channel(RECOVERY_COMMAND_CAPACITY);
+        let active = Arc::new(Mutex::new(HashSet::new()));
+        let handle = Self {
+            tx,
+            active: active.clone(),
+        };
+        let task = tokio::spawn(run_coordinator(room_state, active, rx));
+        (handle, task)
+    }
+
+    /// Reserve one recovery slot before grace-expiry teardown begins. Returns
+    /// false when the peer is already recovering, preventing duplicate work.
+    pub(super) fn begin(&self, peer_id: EndpointId) -> bool {
+        self.active.lock().unwrap().insert(peer_id)
+    }
+
+    /// Activate the reserved slot with its retained authenticated address.
+    /// Uses a bounded non-blocking send while holding the active-set lock so a
+    /// concurrent cancellation is ordered before or after this command.
+    pub(super) fn activate(&self, peer_id: EndpointId, addr: EndpointAddr) -> Result<bool, ()> {
+        let mut active = self.active.lock().unwrap();
+        if !active.contains(&peer_id) {
+            return Ok(false);
+        }
+        if self
+            .tx
+            .try_send(RecoveryCommand::Start { peer_id, addr })
+            .is_err()
+        {
+            active.remove(&peer_id);
+            return Err(());
+        }
+        Ok(true)
+    }
+
+    pub(super) fn cancel(&self, peer_id: EndpointId) {
+        self.active.lock().unwrap().remove(&peer_id);
+        // Cancellation is governed by the shared active set, so it remains
+        // immediate even if the bounded command queue is temporarily full.
+        let _ = self.tx.try_send(RecoveryCommand::Cancel(peer_id));
+    }
+
+    pub(super) fn is_active(&self, peer_id: &EndpointId) -> bool {
+        self.active.lock().unwrap().contains(peer_id)
+    }
+}
+
+async fn run_coordinator(
+    room_state: Arc<dyn RecoveryRoom>,
+    active: Arc<Mutex<HashSet<EndpointId>>>,
+    mut rx: mpsc::Receiver<RecoveryCommand>,
+) {
+    let mut entries: HashMap<EndpointId, RecoveryEntry> = HashMap::new();
+
+    loop {
+        // The shared active set is the authoritative cancellation gate. Prune
+        // here as well as on Cancel commands so a saturated command queue cannot
+        // leave an inactive, past-due entry spinning the timer loop.
+        let active_snapshot = active.lock().unwrap().clone();
+        entries.retain(|peer_id, _| active_snapshot.contains(peer_id));
+        let next_deadline = entries.values().map(|entry| entry.next_attempt).min();
+        let command = match next_deadline {
+            Some(deadline) => {
+                tokio::select! {
+                    command = rx.recv() => command,
+                    _ = tokio::time::sleep_until(deadline) => {
+                        let now = Instant::now();
+                        let active_snapshot = active.lock().unwrap().clone();
+                        let due: Vec<(EndpointId, EndpointAddr)> = entries
+                            .iter()
+                            .filter(|(id, entry)| {
+                                entry.next_attempt <= now && active_snapshot.contains(*id)
+                            })
+                            .map(|(id, entry)| (*id, entry.addr.clone()))
+                            .collect();
+
+                        if !due.is_empty() {
+                            let addrs = due.iter().map(|(_, addr)| addr.clone()).collect();
+                            if let Err(error) = room_state.rebootstrap_peers(addrs).await {
+                                crate::log_msg(&format!(
+                                    "Background peer recovery attempt failed: {error}"
+                                ));
+                            }
+
+                            let scheduled_at = Instant::now();
+                            for (peer_id, _) in due {
+                                if !active.lock().unwrap().contains(&peer_id) {
+                                    entries.remove(&peer_id);
+                                    continue;
+                                }
+                                if let Some(entry) = entries.get_mut(&peer_id) {
+                                    entry.next_attempt = scheduled_at + recovery_delay(entry.attempt);
+                                    entry.attempt = entry.attempt.saturating_add(1);
+                                }
+                            }
+                        }
+                        continue;
+                    }
+                }
+            }
+            None => rx.recv().await,
+        };
+
+        match command {
+            Some(RecoveryCommand::Start { peer_id, addr }) => {
+                if active.lock().unwrap().contains(&peer_id) {
+                    entries.entry(peer_id).or_insert(RecoveryEntry {
+                        addr,
+                        attempt: 0,
+                        next_attempt: Instant::now(),
+                    });
+                }
+            }
+            Some(RecoveryCommand::Cancel(peer_id)) => {
+                entries.remove(&peer_id);
+            }
+            None => break,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use iroh::SecretKey;
+
+    struct RecordingRoom {
+        attempts: mpsc::UnboundedSender<Vec<EndpointAddr>>,
+    }
+
+    #[async_trait::async_trait]
+    impl RecoveryRoom for RecordingRoom {
+        async fn rebootstrap_peers(&self, peers: Vec<EndpointAddr>) -> Result<(), String> {
+            self.attempts.send(peers).map_err(|error| error.to_string())
+        }
+    }
+
+    #[test]
+    fn retry_backoff_reaches_and_stays_at_sixty_seconds() {
+        let actual: Vec<u64> = (0..10)
+            .map(|attempt| recovery_delay(attempt).as_secs())
+            .collect();
+        assert_eq!(actual, vec![1, 2, 4, 8, 15, 30, 60, 60, 60, 60]);
+    }
+
+    #[test]
+    fn recovery_slots_are_deduplicated_and_cancel_immediately() {
+        let (tx, mut rx) = mpsc::channel(4);
+        let coordinator = RecoveryCoordinator {
+            tx,
+            active: Arc::new(Mutex::new(HashSet::new())),
+        };
+        let peer_id = SecretKey::generate().public();
+
+        assert!(coordinator.begin(peer_id));
+        assert!(
+            !coordinator.begin(peer_id),
+            "a peer gets only one recovery slot"
+        );
+        assert_eq!(
+            coordinator.activate(peer_id, EndpointAddr::from(peer_id)),
+            Ok(true)
+        );
+        assert!(matches!(
+            rx.try_recv(),
+            Ok(RecoveryCommand::Start { peer_id: id, .. }) if id == peer_id
+        ));
+
+        coordinator.cancel(peer_id);
+        assert!(!coordinator.is_active(&peer_id));
+        assert!(matches!(
+            rx.try_recv(),
+            Ok(RecoveryCommand::Cancel(id)) if id == peer_id
+        ));
+    }
+
+    #[tokio::test]
+    async fn coordinator_attempts_rebootstrap_immediately() {
+        let (attempts_tx, mut attempts_rx) = mpsc::unbounded_channel();
+        let (coordinator, task) = RecoveryCoordinator::spawn_inner(Arc::new(RecordingRoom {
+            attempts: attempts_tx,
+        }));
+        let peer_id = SecretKey::generate().public();
+        let addr = EndpointAddr::from(peer_id);
+
+        assert!(coordinator.begin(peer_id));
+        assert_eq!(coordinator.activate(peer_id, addr.clone()), Ok(true));
+        let attempted = tokio::time::timeout(Duration::from_secs(1), attempts_rx.recv())
+            .await
+            .expect("first recovery attempt should be immediate")
+            .expect("recording room remains subscribed");
+        assert_eq!(attempted, vec![addr]);
+
+        coordinator.cancel(peer_id);
+        task.abort();
+    }
+}
@@ -0,0 +1,368 @@
+//! Chat file attachments: the compact descriptor that rides a gossip chat
+//! message, plus the pure validation/sanitization seams for the file-transfer
+//! plane.
+//!
+//! Attachment **bytes do not travel over gossip** — gossip is a small-frame
+//! broadcast plane (see `avatar` for why image bytes there are hard-capped to
+//! tens of KB). Instead a chat message carries a [`ChatAttachment`] *descriptor*
+//! (name, size, kind, id); the sender serves the actual bytes over the dedicated
+//! file ALPN (`protocol::FILES_ALPN`) via direct QUIC streams, and recipients
+//! fetch them point-to-point. Everything in this module is dependency-light and
+//! pure so it can be unit-tested away from the network and the GUI.
+
+use serde::{Deserialize, Serialize};
+
+/// Hard ceiling on a single attachment's byte size. Bounds the memory a peer can
+/// make us hold (when fetching) or serve, and the time a transfer can take.
+/// 25 MiB comfortably covers phone photos and ordinary documents.
+pub const MAX_ATTACHMENT_BYTES: u64 = 25 * 1024 * 1024;
+
+/// Max decoded pixels per side for an inline image preview. Defends against a
+/// decode-bomb (a small file that expands to an enormous bitmap), independent of
+/// the byte cap. Applied via `image::Limits` when validating/decoding.
+pub const MAX_IMAGE_PX: u32 = 4096;
+
+/// Longest filename we keep and display. Keeps the gossip descriptor compact and
+/// the UI tidy; the real bytes are unaffected.
+pub const MAX_FILENAME_LEN: usize = 96;
+
+/// A 32-byte opaque id identifying one attachment for the fetch request. Minted
+/// randomly per attachment by the sender (see core); the transfer itself is
+/// authenticated + encrypted + room-member gated, so the id only needs to be a
+/// hard-to-guess handle into the sender's serve store, not a content hash.
+pub type AttachmentId = [u8; 32];
+
+/// How the receiver should present an attachment. A *hint* derived from the
+/// sender's content sniff — never trusted for a safety decision. The receiver
+/// re-validates image bytes itself before decoding, and falls back to a file
+/// chip if an "Image" doesn't actually decode.
+#[derive(Serialize, Deserialize, Clone, Copy, PartialEq, Eq, Debug)]
+pub enum AttachmentKind {
+    Image,
+    File,
+}
+
+/// The descriptor carried inside a `GossipMessage::Chat`. Compact by design: it
+/// holds no file bytes, only what the UI needs to render a placeholder/chip and
+/// what a fetch needs to pull the bytes.
+#[derive(Serialize, Deserialize, Clone, PartialEq, Eq, Debug)]
+pub struct ChatAttachment {
+    /// Sanitized display filename (already path-stripped — see
+    /// [`sanitize_filename`]). Never used as a filesystem path on receipt without
+    /// the user choosing a save location.
+    pub name: String,
+    /// Byte length of the file. Bounds the fetch read; must be
+    /// `<= MAX_ATTACHMENT_BYTES` (enforced by [`size_within_cap`]).
+    pub size: u64,
+    /// Presentation hint (image vs. generic file).
+    pub kind: AttachmentKind,
+    /// Opaque handle the receiver writes on the file plane to request the bytes.
+    pub id: AttachmentId,
+}
+
+/// Sanitize an arbitrary (possibly hostile) filename for display and as a
+/// save-dialog default. Strips any directory component (both `/` and `\`),
+/// removes control characters, collapses whitespace, trims, caps the length
+/// while trying to preserve a short extension, and rejects the `.`/`..` traps.
+/// Always returns a non-empty, path-component-free name (falls back to `file`).
+pub fn sanitize_filename(raw: &str) -> String {
+    // Take only the final *non-empty* path component, defeating
+    // `../../etc/passwd`, `C:\foo\bar`, embedded separators, and trailing slashes
+    // (`a/b/c/` → `c`).
+    let base = raw
+        .rsplit(['/', '\\'])
+        .find(|s| !s.trim().is_empty())
+        .unwrap_or("")
+        .trim();
+
+    // Drop control chars; turn other whitespace into single spaces later.
+    let cleaned: String = base
+        .chars()
+        .filter(|c| !c.is_control())
+        .collect();
+    let collapsed = cleaned.split_whitespace().collect::<Vec<_>>().join(" ");
+    let collapsed = collapsed.trim_matches('.').trim();
+
+    if collapsed.is_empty() {
+        return "file".to_string();
+    }
+    if collapsed.chars().count() <= MAX_FILENAME_LEN {
+        return collapsed.to_string();
+    }
+
+    // Too long: keep the extension (if short + sane) and truncate the stem.
+    if let Some((stem, ext)) = collapsed.rsplit_once('.')
+        && !ext.is_empty()
+        && ext.chars().count() <= 8
+        && ext.chars().all(|c| c.is_ascii_alphanumeric())
+    {
+        let keep = MAX_FILENAME_LEN.saturating_sub(ext.chars().count() + 1);
+        let truncated: String = stem.chars().take(keep).collect();
+        return format!("{truncated}.{ext}");
+    }
+    collapsed.chars().take(MAX_FILENAME_LEN).collect()
+}
+
+/// Whether a declared/observed size is within the transfer cap and non-zero.
+/// Used both when sending (reject before serving) and when fetching (reject a
+/// descriptor before opening a stream).
+pub fn size_within_cap(size: u64) -> bool {
+    size > 0 && size <= MAX_ATTACHMENT_BYTES
+}
+
+/// Sniff the leading bytes for a known image container, to set the attachment
+/// *kind* hint at send time. Recognizes PNG, JPEG, GIF, WebP, and BMP. This is a
+/// presentation hint only — actual inline rendering still depends on the bytes
+/// decoding (we only build image features for PNG/JPEG), with a file-chip
+/// fallback otherwise.
+pub fn is_probably_image(bytes: &[u8]) -> bool {
+    let b = bytes;
+    let png = b.starts_with(&[0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A]);
+    let jpeg = b.starts_with(&[0xFF, 0xD8, 0xFF]);
+    let gif = b.starts_with(b"GIF87a") || b.starts_with(b"GIF89a");
+    let bmp = b.starts_with(b"BM");
+    let webp = b.len() >= 12 && b.starts_with(b"RIFF") && &b[8..12] == b"WEBP";
+    png || jpeg || gif || bmp || webp
+}
+
+/// Sniff the leading bytes for an audio container supported by the inline clip
+/// player. Audio remains [`AttachmentKind::File`] on the wire; this receiver-side
+/// check confirms that a filename-based player hint actually contains WAV, MP3,
+/// Ogg Vorbis, or FLAC data before playback is attempted.
+pub fn is_probably_audio(bytes: &[u8]) -> bool {
+    let flac = bytes.starts_with(b"fLaC");
+    let ogg = bytes.starts_with(b"OggS");
+    let wav = bytes.len() >= 12 && bytes.starts_with(b"RIFF") && &bytes[8..12] == b"WAVE";
+    let mp3_id3 = bytes.starts_with(b"ID3");
+    let mp3_frame = bytes.len() >= 2 && bytes[0] == 0xFF && bytes[1] & 0xE0 == 0xE0;
+    flac || ogg || wav || mp3_id3 || mp3_frame
+}
+
+/// Whether a sanitized attachment name has an extension supported by the
+/// inline audio player. This is only a pre-fetch presentation hint; fetched
+/// bytes are confirmed with [`is_probably_audio`] before being decoded.
+pub fn looks_like_audio_name(name: &str) -> bool {
+    let Some((_, extension)) = name.rsplit_once('.') else {
+        return false;
+    };
+    matches!(extension.to_ascii_lowercase().as_str(), "wav" | "mp3" | "ogg" | "oga" | "flac")
+}
+
+/// The attachment kind for some file bytes: [`AttachmentKind::Image`] if it
+/// sniffs as an image container, else [`AttachmentKind::File`].
+pub fn classify(bytes: &[u8]) -> AttachmentKind {
+    if is_probably_image(bytes) {
+        AttachmentKind::Image
+    } else {
+        AttachmentKind::File
+    }
+}
+
+/// Defensively decode image bytes under strict pixel limits to confirm they're a
+/// real, sane image before we hand them to the renderer. Returns the decoded
+/// dimensions on success. Guards against decode-bombs (small file → huge bitmap)
+/// regardless of [`MAX_ATTACHMENT_BYTES`]. Only PNG/JPEG are buildable in our
+/// `image` feature set; anything else returns `None` and the caller shows a chip.
+pub fn validate_image_bytes(bytes: &[u8]) -> Option<(u32, u32)> {
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(MAX_IMAGE_PX);
+    limits.max_image_height = Some(MAX_IMAGE_PX);
+    let reader = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?;
+    let mut reader = reader;
+    reader.limits(limits);
+    let img = reader.decode().ok()?;
+    let (w, h) = (img.width(), img.height());
+    if w == 0 || h == 0 || w > MAX_IMAGE_PX || h > MAX_IMAGE_PX {
+        return None;
+    }
+    Some((w, h))
+}
+
+/// Parse a file-plane request: it must be exactly one [`AttachmentId`] (32
+/// bytes). Anything else is rejected so a peer can't send a malformed/oversized
+/// request frame. Pure half of the serve handler.
+pub fn parse_request(bytes: &[u8]) -> Option<AttachmentId> {
+    if bytes.len() != 32 {
+        return None;
+    }
+    let mut id = [0u8; 32];
+    id.copy_from_slice(bytes);
+    Some(id)
+}
+
+/// A human-readable size like `2.3 MB` / `812 KB` / `40 B` for the file chip.
+pub fn human_size(bytes: u64) -> String {
+    const KB: u64 = 1024;
+    const MB: u64 = 1024 * KB;
+    if bytes >= MB {
+        format!("{:.1} MB", bytes as f64 / MB as f64)
+    } else if bytes >= KB {
+        format!("{:.0} KB", bytes as f64 / KB as f64)
+    } else {
+        format!("{bytes} B")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sanitize_strips_directory_traversal() {
+        assert_eq!(sanitize_filename("../../etc/passwd"), "passwd");
+        assert_eq!(sanitize_filename("/abs/path/photo.png"), "photo.png");
+        assert_eq!(sanitize_filename(r"C:\Users\me\secret.doc"), "secret.doc");
+        assert_eq!(sanitize_filename("a/b/c/"), "c");
+    }
+
+    #[test]
+    fn sanitize_rejects_dot_traps_and_empty() {
+        assert_eq!(sanitize_filename(""), "file");
+        assert_eq!(sanitize_filename("."), "file");
+        assert_eq!(sanitize_filename(".."), "file");
+        assert_eq!(sanitize_filename("   "), "file");
+        assert_eq!(sanitize_filename("/"), "file");
+    }
+
+    #[test]
+    fn sanitize_removes_control_chars_and_collapses_ws() {
+        // Control chars (incl. tab/newline) are stripped entirely.
+        assert_eq!(sanitize_filename("my\tphoto\n.png"), "myphoto.png");
+        assert_eq!(sanitize_filename("a\u{0000}b.txt"), "ab.txt");
+        // Real spaces are collapsed but preserved.
+        assert_eq!(sanitize_filename("my  photo .png"), "my photo .png");
+    }
+
+    #[test]
+    fn sanitize_caps_length_preserving_extension() {
+        let long_stem = "x".repeat(200);
+        let name = format!("{long_stem}.png");
+        let out = sanitize_filename(&name);
+        assert!(out.chars().count() <= MAX_FILENAME_LEN, "len was {}", out.chars().count());
+        assert!(out.ends_with(".png"), "extension preserved: {out}");
+    }
+
+    #[test]
+    fn size_cap_bounds() {
+        assert!(!size_within_cap(0));
+        assert!(size_within_cap(1));
+        assert!(size_within_cap(MAX_ATTACHMENT_BYTES));
+        assert!(!size_within_cap(MAX_ATTACHMENT_BYTES + 1));
+    }
+
+    #[test]
+    fn image_sniffing_recognizes_containers() {
+        assert!(is_probably_image(&[0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0]));
+        assert!(is_probably_image(&[0xFF, 0xD8, 0xFF, 0xE0]));
+        assert!(is_probably_image(b"GIF89a...."));
+        let mut webp = b"RIFF".to_vec();
+        webp.extend_from_slice(&[0, 0, 0, 0]);
+        webp.extend_from_slice(b"WEBP");
+        assert!(is_probably_image(&webp));
+        assert!(!is_probably_image(b"%PDF-1.7"));
+        assert!(!is_probably_image(b""));
+    }
+
+    #[test]
+    fn audio_sniffing_recognizes_supported_containers() {
+        assert!(is_probably_audio(b"fLaC\0\0\0\x22"));
+        assert!(is_probably_audio(b"OggS\0\x02"));
+
+        let mut wav = b"RIFF".to_vec();
+        wav.extend_from_slice(&[0, 0, 0, 0]);
+        wav.extend_from_slice(b"WAVE");
+        assert!(is_probably_audio(&wav));
+
+        assert!(is_probably_audio(b"ID3\x04\0\0"));
+        assert!(is_probably_audio(&[0xFF, 0xFB, 0x90, 0x64]));
+    }
+
+    #[test]
+    fn audio_sniffing_disambiguates_wav_from_webp() {
+        let mut wav = b"RIFF".to_vec();
+        wav.extend_from_slice(&[0, 0, 0, 0]);
+        wav.extend_from_slice(b"WAVE");
+        assert!(is_probably_audio(&wav));
+        assert!(!is_probably_image(&wav));
+
+        let mut webp = b"RIFF".to_vec();
+        webp.extend_from_slice(&[0, 0, 0, 0]);
+        webp.extend_from_slice(b"WEBP");
+        assert!(is_probably_image(&webp));
+        assert!(!is_probably_audio(&webp));
+    }
+
+    #[test]
+    fn audio_sniffing_rejects_non_audio() {
+        assert!(!is_probably_audio(b"%PDF-1.7"));
+        assert!(!is_probably_audio(&[0x89, b'P', b'N', b'G']));
+        assert!(!is_probably_audio(&[]));
+        assert!(!is_probably_audio(&[0xFF]));
+    }
+
+    #[test]
+    fn audio_name_detection_is_case_insensitive() {
+        for name in ["clip.wav", "clip.mp3", "clip.ogg", "clip.oga", "clip.flac"] {
+            assert!(looks_like_audio_name(name), "{name}");
+        }
+        assert!(looks_like_audio_name("VOICE.MP3"));
+        assert!(looks_like_audio_name("mix.FlAc"));
+        assert!(!looks_like_audio_name("recording"));
+        assert!(!looks_like_audio_name("notes.pdf"));
+        assert!(!looks_like_audio_name("photo.webp"));
+    }
+
+    #[test]
+    fn classify_maps_sniff_to_kind() {
+        assert_eq!(classify(&[0xFF, 0xD8, 0xFF]), AttachmentKind::Image);
+        assert_eq!(classify(b"fLaC\0\0\0\x22"), AttachmentKind::File);
+        assert_eq!(classify(b"plain text"), AttachmentKind::File);
+    }
+
+    #[test]
+    fn parse_request_requires_exact_32_bytes() {
+        assert_eq!(parse_request(&[7u8; 32]), Some([7u8; 32]));
+        assert_eq!(parse_request(&[7u8; 31]), None);
+        assert_eq!(parse_request(&[7u8; 33]), None);
+        assert_eq!(parse_request(&[]), None);
+    }
+
+    #[test]
+    fn validate_image_rejects_garbage() {
+        assert_eq!(validate_image_bytes(b"not an image"), None);
+        assert_eq!(validate_image_bytes(&[]), None);
+    }
+
+    #[test]
+    fn validate_image_accepts_a_real_png() {
+        // Encode a tiny PNG in-memory, then validate it.
+        let img = image::RgbImage::from_pixel(4, 3, image::Rgb([10, 20, 30]));
+        let mut buf = std::io::Cursor::new(Vec::new());
+        image::DynamicImage::ImageRgb8(img)
+            .write_to(&mut buf, image::ImageFormat::Png)
+            .unwrap();
+        assert_eq!(validate_image_bytes(&buf.into_inner()), Some((4, 3)));
+    }
+
+    #[test]
+    fn human_size_units() {
+        assert_eq!(human_size(40), "40 B");
+        assert_eq!(human_size(2048), "2 KB");
+        assert_eq!(human_size(3 * 1024 * 1024 + 300 * 1024), "3.3 MB");
+    }
+
+    #[test]
+    fn attachment_descriptor_round_trips_json() {
+        let a = ChatAttachment {
+            name: "photo.png".to_string(),
+            size: 12345,
+            kind: AttachmentKind::Image,
+            id: [9u8; 32],
+        };
+        let bytes = serde_json::to_vec(&a).unwrap();
+        let back: ChatAttachment = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(a, back);
+    }
+}
@@ -15,9 +15,11 @@ pub mod notify;
 pub mod screenshare;
 pub mod sanitize;
 pub mod avatar;
+pub mod background;
 pub mod recents;
 pub mod discovery;
 pub mod hotkeys;
+pub mod files;

 use std::fs::File;
 use std::path::{Path, PathBuf};
@@ -1,3 +1,7 @@
+// On Windows, suppress the extra console window for release GUI builds while
+// keeping it in debug builds so stderr/panics stay visible during development.
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
 fn main() {
    if let Err(e) = peerspeak::app::run_gui() {
        eprintln!("Error running GUI: {:?}", e);
@@ -5,7 +5,7 @@ use iroh_gossip::proto::TopicId;
 use tokio::sync::mpsc;
 use tokio::sync::mpsc::Receiver;
 use std::sync::{Arc, Mutex};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use async_trait::async_trait;
 use tokio_stream::StreamExt;
 use serde::{Serialize, Deserialize};
@@ -184,9 +184,16 @@ fn compute_bootstrap(
 pub enum GossipMessage {
    Announce(PeerState),
    Leave,
-    /// A room text-chat message: the author's display name, the text, and a
-    /// sender-stamped millisecond timestamp.
-    Chat { name: String, text: String, ts: u64 },
+    /// A room text-chat message: the author's display name, the text, a
+    /// sender-stamped millisecond timestamp, and an optional file attachment
+    /// descriptor (the bytes are fetched off-gossip on the file plane).
+    Chat {
+        name: String,
+        text: String,
+        ts: u64,
+        #[serde(default)]
+        attachment: Option<crate::files::ChatAttachment>,
+    },
 }

 pub struct IrohGossipState {
@@ -198,6 +205,10 @@ pub struct IrohGossipState {
    secret_key: SecretKey,
    self_state: Arc<Mutex<Option<PeerState>>>,
    peers: Arc<Mutex<HashMap<EndpointId, PeerState>>>,
+    /// Previously verified peers whose live roster entry was removed by a
+    /// transient disconnect. Retained only so a later authenticated `Leave`
+    /// still reaches core and cancels background recovery.
+    disconnected_peers: Arc<Mutex<HashSet<EndpointId>>>,
    event_tx: mpsc::Sender<RoomEvent>,
    event_rx: Mutex<Option<mpsc::Receiver<RoomEvent>>>,
    active_topic: Mutex<Option<tokio::task::JoinHandle<()>>>,
@@ -223,6 +234,7 @@ impl IrohGossipState {
            secret_key,
            self_state: Arc::new(Mutex::new(None)),
            peers: Arc::new(Mutex::new(HashMap::new())),
+            disconnected_peers: Arc::new(Mutex::new(HashSet::new())),
            event_tx,
            event_rx: Mutex::new(Some(event_rx)),
            active_topic: Mutex::new(None),
@@ -295,6 +307,7 @@ impl RoomState for IrohGossipState {

        let event_tx = self.event_tx.clone();
        let peers = self.peers.clone();
+        let disconnected_peers = self.disconnected_peers.clone();
        let address_lookup = self.address_lookup.clone();
        let self_state_clone = self.self_state.clone();
        let gossip_sender_clone = gossip_sender.clone();
@@ -393,6 +406,7 @@ impl RoomState for IrohGossipState {
                                        // peer-supplied: cap/validate once at ingest
                                        // so invalid offers never render a Watch button.
                                        state.sharing = state.sharing.and_then(crate::screenshare::sanitize_ticket);
+                                        disconnected_peers.lock().unwrap().remove(&payload.author);
                                        let (is_new, state_changed) = {
                                            let mut peer_map = peers.lock().unwrap();
                                            let is_new = !peer_map.contains_key(&payload.author);
@@ -423,17 +437,32 @@ impl RoomState for IrohGossipState {
                                    GossipMessage::Leave => {
                                        crate::log_msg(&format!("Gossip peer leave request from author={:?}", payload.author));
                                        let removed = peers.lock().unwrap().remove(&payload.author).is_some();
-                                        if removed {
+                                        let was_disconnected = disconnected_peers
+                                            .lock()
+                                            .unwrap()
+                                            .remove(&payload.author);
+                                        if removed || was_disconnected {
                                            let _ = event_tx.send(RoomEvent::PeerLeft(payload.author)).await;
                                        }
                                    }
-                                    GossipMessage::Chat { name, text, ts } => {
+                                    GossipMessage::Chat { name, text, ts, attachment } => {
                                        crate::log_msg(&format!("Gossip chat from author={:?}", payload.author));
+                                        // Defensively normalize an untrusted attachment
+                                        // descriptor: sanitize the filename and drop it
+                                        // entirely if it declares an out-of-cap size.
+                                        let attachment = attachment.and_then(|mut a| {
+                                            if !crate::files::size_within_cap(a.size) {
+                                                return None;
+                                            }
+                                            a.name = crate::files::sanitize_filename(&a.name);
+                                            Some(a)
+                                        });
                                        let _ = event_tx.send(RoomEvent::ChatMessage {
                                            from: payload.author,
                                            name,
                                            text,
                                            ts,
+                                            attachment,
                                        }).await;
                                    }
                                }
@@ -472,6 +501,7 @@ impl RoomState for IrohGossipState {
                        // cached presence entry; a rejoin re-announces as new.
                        let removed = peers.lock().unwrap().remove(&peer_id).is_some();
                        if removed {
+                            disconnected_peers.lock().unwrap().insert(peer_id);
                            crate::log_msg(&format!("Peer connection lost (NeighborDown): {:?}", peer_id));
                            let _ = event_tx.send(RoomEvent::PeerConnectionLost(peer_id)).await;
                        }
@@ -516,7 +546,48 @@ impl RoomState for IrohGossipState {
        Ok(())
    }

-    async fn send_chat(&self, text: String) -> Result<(), NetError> {
+    async fn rebootstrap_peers(&self, peers: Vec<EndpointAddr>) -> Result<(), NetError> {
+        let self_id = self._endpoint.id();
+        let mut peer_ids = Vec::new();
+        for addr in peers {
+            if addr.id == self_id || peer_ids.contains(&addr.id) {
+                continue;
+            }
+            self.address_lookup.add_endpoint_info(addr.clone());
+            peer_ids.push(addr.id);
+        }
+
+        if peer_ids.is_empty() {
+            return Ok(());
+        }
+
+        // Clone the sender before awaiting: active_sender is a standard mutex and
+        // must never be held across an async gossip operation.
+        let sender = self
+            .active_sender
+            .lock()
+            .unwrap()
+            .clone()
+            .ok_or_else(|| NetError::Other("Not in a room".to_string()))?;
+
+        crate::log_msg(&format!("Rebootstrapping gossip peers: {:?}", peer_ids));
+        sender
+            .join_peers(peer_ids)
+            .await
+            .map_err(|e| NetError::Gossip(e.to_string()))
+    }
+
+    fn mark_peer_disconnected(&self, peer_id: EndpointId) {
+        if self.peers.lock().unwrap().remove(&peer_id).is_some() {
+            self.disconnected_peers.lock().unwrap().insert(peer_id);
+        }
+    }
+
+    async fn send_chat(
+        &self,
+        text: String,
+        attachment: Option<crate::files::ChatAttachment>,
+    ) -> Result<(), NetError> {
        let name = {
            let guard = self.self_state.lock().unwrap();
            match guard.as_ref() {
@@ -533,7 +604,7 @@ impl RoomState for IrohGossipState {
                &self.secret_key,
                &topic,
                ts,
-                GossipMessage::Chat { name, text, ts },
+                GossipMessage::Chat { name, text, ts, attachment },
            );
            if let Ok(bytes) = serde_json::to_vec(&payload) {
                sender.broadcast(bytes.into()).await
@@ -571,6 +642,7 @@ impl RoomState for IrohGossipState {
        }

        self.peers.lock().unwrap().clear();
+        self.disconnected_peers.lock().unwrap().clear();
        Ok(())
    }

@@ -694,13 +766,15 @@ mod tests {
            name: "Alice".to_string(),
            text: "Hello".to_string(),
            ts: 123456789,
+            attachment: None,
        };
        let serialized = serde_json::to_string(&original).unwrap();
        let deserialized: GossipMessage = serde_json::from_str(&serialized).unwrap();
-        if let GossipMessage::Chat { name, text, ts } = deserialized {
+        if let GossipMessage::Chat { name, text, ts, attachment } = deserialized {
            assert_eq!(name, "Alice");
            assert_eq!(text, "Hello");
            assert_eq!(ts, 123456789);
+            assert_eq!(attachment, None);
        } else {
            panic!("Expected GossipMessage::Chat");
        }
@@ -710,10 +784,11 @@ mod tests {
            name: "".to_string(),
            text: "".to_string(),
            ts: u64::MAX,
+            attachment: None,
        };
        let serialized_empty = serde_json::to_string(&original_empty).unwrap();
        let deserialized_empty: GossipMessage = serde_json::from_str(&serialized_empty).unwrap();
-        if let GossipMessage::Chat { name, text, ts } = deserialized_empty {
+        if let GossipMessage::Chat { name, text, ts, .. } = deserialized_empty {
            assert_eq!(name, "");
            assert_eq!(text, "");
            assert_eq!(ts, u64::MAX);
@@ -722,6 +797,40 @@ mod tests {
        }
    }

+    #[test]
+    fn test_gossip_chat_attachment_round_trip_and_back_compat() {
+        let att = crate::files::ChatAttachment {
+            name: "photo.png".to_string(),
+            size: 4096,
+            kind: crate::files::AttachmentKind::Image,
+            id: [42u8; 32],
+        };
+        let original = GossipMessage::Chat {
+            name: "Alice".to_string(),
+            text: "look at this".to_string(),
+            ts: 1,
+            attachment: Some(att.clone()),
+        };
+        let serialized = serde_json::to_string(&original).unwrap();
+        let deserialized: GossipMessage = serde_json::from_str(&serialized).unwrap();
+        if let GossipMessage::Chat { attachment, .. } = deserialized {
+            assert_eq!(attachment, Some(att));
+        } else {
+            panic!("Expected GossipMessage::Chat");
+        }
+
+        // A pre-v2 chat payload (no `attachment` field) must still deserialize,
+        // defaulting the attachment to None (serde(default)).
+        let legacy = r#"{"Chat":{"name":"Old","text":"hi","ts":7}}"#;
+        let parsed: GossipMessage = serde_json::from_str(legacy).unwrap();
+        if let GossipMessage::Chat { name, attachment, .. } = parsed {
+            assert_eq!(name, "Old");
+            assert_eq!(attachment, None);
+        } else {
+            panic!("Expected GossipMessage::Chat");
+        }
+    }
+
    #[test]
    fn test_gossip_payload_chat_round_trip() {
        let secret = SecretKey::generate();
@@ -734,6 +843,7 @@ mod tests {
                name: "Bob".to_string(),
                text: "Hi there".to_string(),
                ts: 987654321,
+                attachment: None,
            },
        );

@@ -741,7 +851,7 @@ mod tests {
        let deserialized: GossipPayload = serde_json::from_str(&serialized).unwrap();

        assert_eq!(deserialized.author, secret.public());
-        if let GossipMessage::Chat { name, text, ts } = deserialized.msg {
+        if let GossipMessage::Chat { name, text, ts, .. } = deserialized.msg {
            assert_eq!(name, "Bob");
            assert_eq!(text, "Hi there");
            assert_eq!(ts, 987654321);
@@ -756,10 +866,11 @@ mod tests {
            name: "🎙 User".to_string(),
            text: "héllo 🎙 世界".to_string(),
            ts: 1717171717,
+            attachment: None,
        };
        let serialized = serde_json::to_string(&original).unwrap();
        let deserialized: GossipMessage = serde_json::from_str(&serialized).unwrap();
-        if let GossipMessage::Chat { name, text, ts } = deserialized {
+        if let GossipMessage::Chat { name, text, ts, .. } = deserialized {
            assert_eq!(name, "🎙 User");
            assert_eq!(text, "héllo 🎙 世界");
            assert_eq!(ts, 1717171717);
@@ -799,7 +910,7 @@ mod tests {
        let secret = SecretKey::generate();
        let topic = [4u8; 32];
        let mut p = sign_gossip(&secret, &topic, 5_000, GossipMessage::Leave);
-        p.msg = GossipMessage::Chat { name: "x".into(), text: "y".into(), ts: 5_000 };
+        p.msg = GossipMessage::Chat { name: "x".into(), text: "y".into(), ts: 5_000, attachment: None };
        assert_eq!(
            verify_gossip(&p, &topic, 5_000, GOSSIP_FRESHNESS_MS),
            Err(GossipReject::BadSignature)
@@ -872,8 +983,8 @@ mod tests {
    fn state_mutation_replay_gate_leaves_chat_ordering_untouched() {
        let author = fresh_id();
        let mut seen = HashMap::new();
-        let later_chat = GossipMessage::Chat { name: "A".into(), text: "later".into(), ts: 200 };
-        let earlier_chat = GossipMessage::Chat { name: "A".into(), text: "earlier".into(), ts: 100 };
+        let later_chat = GossipMessage::Chat { name: "A".into(), text: "later".into(), ts: 200, attachment: None };
+        let earlier_chat = GossipMessage::Chat { name: "A".into(), text: "earlier".into(), ts: 100, attachment: None };

        assert!(admit_state_mutation(&mut seen, author, &later_chat, 200));
        assert!(admit_state_mutation(&mut seen, author, &earlier_chat, 100));
@@ -9,7 +9,8 @@ use std::collections::{HashMap, HashSet};
 use std::time::Duration;
 use async_trait::async_trait;

-use crate::protocol::AUDIO_ALPN;
+use crate::protocol::{AUDIO_ALPN, FILES_ALPN};
+use crate::files::{AttachmentId, ChatAttachment};

 /// Per-peer datagram send queue depth. Audio is real-time, so a backlog is
 /// useless latency — keep it shallow and drop the oldest frame when full.
@@ -31,6 +32,10 @@ const MAX_BACKOFF: Duration = Duration::from_secs(5);
 /// already means "the peer closed this on purpose."
 const GOODBYE_CODE: u32 = 1;

+/// Bound on each phase (connect, read) of a chat-attachment fetch, so a slow or
+/// stalled sender can't hang the fetch indefinitely.
+const FILE_FETCH_TIMEOUT: Duration = Duration::from_secs(30);
+
 /// State shared between the transport, its protocol handler, and every per-peer
 /// supervisor task. One supervisor owns a peer's whole connection lifecycle.
 struct Shared {
@@ -60,6 +65,11 @@ struct Shared {
    /// verified gossip roster plus peers still inside reconnect grace; transport
    /// connections alone never mutate this set.
    admitted_audio: StdMutex<HashSet<EndpointId>>,
+    /// Chat file attachments we're serving to room members this session, keyed by
+    /// the random attachment id. Populated when we send a chat file; read by the
+    /// file protocol handler to answer a member's fetch. Cleared on leave. Each
+    /// blob is already byte-capped at send time.
+    served_files: StdMutex<HashMap<crate::files::AttachmentId, Arc<Vec<u8>>>>,
    incoming_tx: mpsc::Sender<(EndpointId, Bytes)>,
    /// Best-effort link-state notifications for the UI (connecting / connected).
    conn_events_tx: mpsc::Sender<ConnEvent>,
@@ -402,6 +412,97 @@ impl iroh::protocol::ProtocolHandler for AudioRouter {
    }
 }

+/// Protocol handler for the file-transfer plane (`FILES_ALPN`). Mirrors
+/// [`AudioRouter`]: it's persistent on the router and bound to the active
+/// session's [`Shared`] on join. On an inbound stream it authenticates the peer
+/// (iroh ALPN handshake gives us `remote_id`), gates on **live room membership**
+/// (same invariant as audio admission, so a former member can't pull files),
+/// reads a single 32-byte attachment id, and streams back the matching blob from
+/// the session serve store — or nothing if the id is unknown.
+#[derive(Clone, Default)]
+pub struct FileRouter {
+    current: Arc<StdMutex<Option<Arc<Shared>>>>,
+}
+
+impl std::fmt::Debug for FileRouter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("FileRouter").finish_non_exhaustive()
+    }
+}
+
+impl FileRouter {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Route inbound file fetches to `transport`'s session (called on join).
+    pub fn bind(&self, transport: &IrohTransport) {
+        *self.current.lock().unwrap() = Some(transport.shared.clone());
+    }
+
+    /// Stop serving files until the next [`bind`](Self::bind) (called on leave).
+    pub fn clear(&self) {
+        *self.current.lock().unwrap() = None;
+    }
+}
+
+/// Max bytes we'll read for a fetch *request* frame. A request is exactly one
+/// 32-byte id; this small ceiling rejects a peer trying to stream us a huge
+/// "request" as a cheap DoS.
+const FILE_REQUEST_MAX: usize = 64;
+
+impl iroh::protocol::ProtocolHandler for FileRouter {
+    fn accept(
+        &self,
+        connection: Connection,
+    ) -> impl std::future::Future<Output = Result<(), iroh::protocol::AcceptError>> + Send {
+        let peer_id = connection.remote_id();
+        let shared = self.current.lock().unwrap().clone();
+        async move {
+            // No active call → nothing to serve.
+            let Some(shared) = shared else {
+                return Ok(());
+            };
+            // Member gating: only current room members may fetch our files. Reuses
+            // the audio admission roster (the authoritative room membership set).
+            if !shared.audio_sender_admitted(peer_id) {
+                crate::log_msg(&format!(
+                    "Transport: rejected file fetch from non-member {}",
+                    crate::short_id(&peer_id.to_string())
+                ));
+                return Ok(());
+            }
+            // Accept one bidirectional stream: read the id, write the bytes.
+            let Ok((mut send, mut recv)) = connection.accept_bi().await else {
+                return Ok(());
+            };
+            let Ok(req) = recv.read_to_end(FILE_REQUEST_MAX).await else {
+                return Ok(());
+            };
+            let Some(id) = crate::files::parse_request(&req) else {
+                return Ok(());
+            };
+            let blob = shared.served_files.lock().unwrap().get(&id).cloned();
+            if let Some(blob) = blob {
+                let _ = send.write_all(&blob).await;
+            }
+            // Finish either way: an unknown id closes with an empty body, which
+            // the fetcher reads as a zero-length result and treats as "gone".
+            let _ = send.finish();
+            // CRITICAL: `finish()` only marks the stream's EOF — it does NOT wait
+            // for the written bytes to be delivered and acknowledged. If we return
+            // here the `connection` drops, and its CONNECTION_CLOSE can race ahead
+            // of the still-in-flight stream data, so the fetcher's read aborts with
+            // "connection lost". Wait for the fetcher to receive everything and
+            // close the connection itself (it drops `conn` right after read_to_end);
+            // that close is our signal the transfer landed. Bounded so a fetcher
+            // that vanishes can't pin this task forever.
+            let _ = tokio::time::timeout(FILE_FETCH_TIMEOUT, connection.closed()).await;
+            Ok(())
+        }
+    }
+}
+
 pub struct IrohTransport {
    shared: Arc<Shared>,
    incoming_rx: tokio::sync::Mutex<Option<mpsc::Receiver<(EndpointId, Bytes)>>>,
@@ -426,6 +527,7 @@ impl IrohTransport {
            peers: tokio::sync::Mutex::new(HashMap::new()),
            live_conns: StdMutex::new(HashMap::new()),
            admitted_audio: StdMutex::new(HashSet::new()),
+            served_files: StdMutex::new(HashMap::new()),
            incoming_tx,
            conn_events_tx,
        });
@@ -455,6 +557,7 @@ impl IrohTransport {
        self.shared.senders.lock().unwrap().clear();
        self.shared.addrs.lock().unwrap().clear();
        self.shared.admitted_audio.lock().unwrap().clear();
+        self.shared.served_files.lock().unwrap().clear();
        // Give the CONNECTION_CLOSE frames a moment to flush before the caller
        // shuts the endpoint/router down (the `conns` clones are still alive
        // here, so the endpoint can still transmit them).
@@ -483,6 +586,59 @@ impl IrohTransport {
    pub fn audio_sender_admitted(&self, peer_id: EndpointId) -> bool {
        self.shared.audio_sender_admitted(peer_id)
    }
+
+    /// Make `bytes` available to room members under `id` for the rest of this
+    /// session (served by the [`FileRouter`] handler). Called by core when we
+    /// send a chat file. The blob is cleared on leave.
+    pub fn serve_attachment(&self, id: AttachmentId, bytes: Arc<Vec<u8>>) {
+        self.shared.served_files.lock().unwrap().insert(id, bytes);
+    }
+
+    /// Fetch a chat attachment's bytes from its sender over the file plane. Dials
+    /// the sender on `FILES_ALPN` (preferring a known full address), writes the
+    /// 32-byte id, and reads the response bounded by the descriptor's declared
+    /// size (which the caller has already validated against the global cap). The
+    /// read limit means a malicious sender can't stream us more than advertised.
+    pub async fn fetch_attachment(
+        &self,
+        from: EndpointId,
+        att: &ChatAttachment,
+    ) -> Result<Vec<u8>, NetError> {
+        if !crate::files::size_within_cap(att.size) {
+            return Err(NetError::Other("attachment size out of range".to_string()));
+        }
+        let addr = self.shared.addrs.lock().unwrap().get(&from).cloned();
+        let connect = async {
+            match addr {
+                Some(addr) => self.shared.endpoint.connect(addr, FILES_ALPN).await,
+                None => self.shared.endpoint.connect(from, FILES_ALPN).await,
+            }
+        };
+        let conn = tokio::time::timeout(FILE_FETCH_TIMEOUT, connect)
+            .await
+            .map_err(|_| NetError::Other("file fetch: connect timed out".to_string()))?
+            .map_err(|e| NetError::Other(format!("file fetch: connect failed: {e}")))?;
+
+        let (mut send, mut recv) = conn
+            .open_bi()
+            .await
+            .map_err(|e| NetError::Other(format!("file fetch: open stream failed: {e}")))?;
+        send.write_all(&att.id)
+            .await
+            .map_err(|e| NetError::Other(format!("file fetch: request write failed: {e}")))?;
+        send.finish()
+            .map_err(|e| NetError::Other(format!("file fetch: request finish failed: {e}")))?;
+
+        let read = recv.read_to_end(att.size as usize);
+        let bytes = tokio::time::timeout(FILE_FETCH_TIMEOUT, read)
+            .await
+            .map_err(|_| NetError::Other("file fetch: read timed out".to_string()))?
+            .map_err(|e| NetError::Other(format!("file fetch: read failed: {e}")))?;
+        if bytes.is_empty() {
+            return Err(NetError::Other("file fetch: sender no longer has the file".to_string()));
+        }
+        Ok(bytes)
+    }
 }

 #[async_trait]
@@ -57,7 +57,15 @@ pub enum RoomEvent {
    /// A peer sent a room text-chat message. Carries the sender's id, their
    /// display name (embedded so it shows even without a presence entry), the
    /// text, and a sender-stamped millisecond timestamp.
-    ChatMessage { from: EndpointId, name: String, text: String, ts: u64 },
+    ChatMessage {
+        from: EndpointId,
+        name: String,
+        text: String,
+        ts: u64,
+        /// Optional file attachment descriptor; the bytes are fetched off-gossip
+        /// on the file plane. Already filename-sanitized + size-capped on ingest.
+        attachment: Option<crate::files::ChatAttachment>,
+    },
 }

 /// Transport-level link state for a peer, surfaced so the UI can show when a
@@ -194,9 +202,25 @@ pub trait RoomState: Send + Sync {
    /// Updates our local state (e.g. when user mutes/unmutes) and broadcasts it.
    async fn update_self_state(&self, self_state: PeerState) -> Result<(), NetError>;

+    /// Ask the active gossip topic to connect to retained peer addresses without
+    /// leaving or replacing the subscription. This is a recovery primitive only:
+    /// it does not add peers to the authenticated room roster. A peer becomes
+    /// active only after its normal signed `Announce` is received and verified.
+    async fn rebootstrap_peers(&self, peers: Vec<EndpointAddr>) -> Result<(), NetError>;
+
+    /// Remove a peer from the authenticated live roster before background
+    /// recovery. This only revokes membership; a fresh verified `Announce` is
+    /// required to add the peer again.
+    fn mark_peer_disconnected(&self, peer_id: EndpointId);
+
    /// Broadcasts a room text-chat message authored by us (our display name is
-    /// taken from the current self-state).
-    async fn send_chat(&self, text: String) -> Result<(), NetError>;
+    /// taken from the current self-state), optionally carrying a file attachment
+    /// descriptor whose bytes are served separately on the file plane.
+    async fn send_chat(
+        &self,
+        text: String,
+        attachment: Option<crate::files::ChatAttachment>,
+    ) -> Result<(), NetError>;

    /// Leaves the room and announces departure.
    async fn leave(&self) -> Result<(), NetError>;
@@ -342,4 +366,3 @@ mod tests {
        assert_eq!(original, deserialized);
    }
 }
-
@@ -22,16 +22,26 @@ pub const FRIENDS_PROTO: u32 = 1;
 /// Gossip plane version (`GossipPayload`/`GossipMessage`/`PeerState`, signing,
 /// freshness). Bump on any change. Mirrored in [`GOSSIP_SIG_DOMAIN`] and folded
 /// into [`versioned_topic`].
-pub const GOSSIP_PROTO: u32 = 1;
+///
+/// v2 (0.3.0): `GossipMessage::Chat` gained an optional file attachment
+/// (`ChatAttachment`), so a pre-v2 peer can't interpret/serve chat files — bumped
+/// to fail fast rather than half-work.
+pub const GOSSIP_PROTO: u32 = 2;
+/// File-transfer plane version (chat attachment request/stream shape). Bump on
+/// any change. Mirrored in [`FILES_ALPN`].
+pub const FILES_PROTO: u32 = 1;

 /// ALPN for the audio datagram plane: `peerspeak/audio/<AUDIO_PROTO>`.
 pub const AUDIO_ALPN: &[u8] = b"peerspeak/audio/1";
 /// ALPN for the friends/presence plane: `peerspeak/friends/<FRIENDS_PROTO>`.
 pub const FRIENDS_ALPN: &[u8] = b"peerspeak/friends/1";
+/// ALPN for the file-transfer plane: `peerspeak/files/<FILES_PROTO>`. Carries
+/// chat attachment bytes via direct QUIC streams (not gossip).
+pub const FILES_ALPN: &[u8] = b"peerspeak/files/1";
 /// ed25519 gossip signature domain: `peerspeak-gossip-v<GOSSIP_PROTO>`. Carries
 /// the gossip protocol version into every signed payload — a version mismatch
 /// fails verification (cryptographic separation between gossip versions).
-pub const GOSSIP_SIG_DOMAIN: &str = "peerspeak-gossip-v1";
+pub const GOSSIP_SIG_DOMAIN: &str = "peerspeak-gossip-v2";

 /// Version-namespace a room topic so peers on different gossip protocol versions
 /// derive **different subscription topics from the same ticket** and therefore
@@ -62,6 +72,7 @@ mod tests {
    fn alpns_match_their_proto_versions() {
        assert_eq!(AUDIO_ALPN, format!("peerspeak/audio/{AUDIO_PROTO}").as_bytes());
        assert_eq!(FRIENDS_ALPN, format!("peerspeak/friends/{FRIENDS_PROTO}").as_bytes());
+        assert_eq!(FILES_ALPN, format!("peerspeak/files/{FILES_PROTO}").as_bytes());
        assert_eq!(GOSSIP_SIG_DOMAIN, format!("peerspeak-gossip-v{GOSSIP_PROTO}"));
    }

@@ -60,6 +60,9 @@ pub enum AppTheme {
    GruvboxDark,
    SolarizedLight,
    GruvboxLight,
+    AyuDark,
+    AyuMirage,
+    AyuLight,
 }

 /// Build a `Color` from a packed `0xRRGGBB` literal — keeps the palette tables
@@ -70,7 +73,7 @@ fn hex(c: u32) -> Color {

 impl AppTheme {
    /// Every theme, in picker order.
-    pub const ALL: [AppTheme; 10] = [
+    pub const ALL: [AppTheme; 13] = [
        AppTheme::Mocha,
        AppTheme::Macchiato,
        AppTheme::Frappe,
@@ -81,6 +84,9 @@ impl AppTheme {
        AppTheme::GruvboxDark,
        AppTheme::SolarizedLight,
        AppTheme::GruvboxLight,
+        AppTheme::AyuDark,
+        AppTheme::AyuMirage,
+        AppTheme::AyuLight,
    ];

    /// Human-readable name for the picker.
@@ -96,6 +102,9 @@ impl AppTheme {
            AppTheme::GruvboxDark => "Gruvbox Dark",
            AppTheme::SolarizedLight => "Solarized Light",
            AppTheme::GruvboxLight => "Gruvbox Light",
+            AppTheme::AyuDark => "Ayu Dark",
+            AppTheme::AyuMirage => "Ayu Mirage",
+            AppTheme::AyuLight => "Ayu Light",
        }
    }

@@ -103,7 +112,10 @@ impl AppTheme {
    pub fn is_dark(self) -> bool {
        !matches!(
            self,
-            AppTheme::Latte | AppTheme::SolarizedLight | AppTheme::GruvboxLight
+            AppTheme::Latte
+                | AppTheme::SolarizedLight
+                | AppTheme::GruvboxLight
+                | AppTheme::AyuLight
        )
    }

@@ -120,6 +132,8 @@ impl AppTheme {
            AppTheme::GruvboxDark => iced::Theme::GruvboxDark,
            AppTheme::SolarizedLight => iced::Theme::SolarizedLight,
            AppTheme::GruvboxLight => iced::Theme::GruvboxLight,
+            AppTheme::AyuDark | AppTheme::AyuMirage => iced::Theme::TokyoNight,
+            AppTheme::AyuLight => iced::Theme::Light,
        }
    }

@@ -281,6 +295,52 @@ impl AppTheme {
                green: hex(0x79740e),
                yellow: hex(0xb57614),
            },
+            AppTheme::AyuDark => Palette {
+                crust: hex(0x06080a),
+                mantle: hex(0x0b0e14),
+                base: hex(0x0d1017),
+                surface: hex(0x1c222b),
+                overlay: hex(0x565b66),
+                text: hex(0xbfbdb6),
+                subtext: hex(0x9da1a6),
+                blue: hex(0xe6b450),
+                lavender: hex(0x59c2ff),
+                red: hex(0xf07178),
+                maroon: hex(0xff8f40),
+                green: hex(0xaad94c),
+                yellow: hex(0xffb454),
+            },
+            AppTheme::AyuMirage => Palette {
+                crust: hex(0x171b24),
+                mantle: hex(0x1a1f29),
+                base: hex(0x1f2430),
+                surface: hex(0x232834),
+                overlay: hex(0x707a8c),
+                text: hex(0xcccac2),
+                subtext: hex(0xa6abb4),
+                blue: hex(0xffcc66),
+                lavender: hex(0x73d0ff),
+                red: hex(0xf28779),
+                maroon: hex(0xffa759),
+                green: hex(0xd5ff80),
+                yellow: hex(0xffd173),
+            },
+            // Ayu Light's canonical orange is deepened for legibility on white.
+            AppTheme::AyuLight => Palette {
+                crust: hex(0xe6e9ec),
+                mantle: hex(0xf3f4f5),
+                base: hex(0xfcfcfc),
+                surface: hex(0xe8eaed),
+                overlay: hex(0x8a9199),
+                text: hex(0x5c6166),
+                subtext: hex(0x737980),
+                blue: hex(0xc7500e),
+                lavender: hex(0x399ee6),
+                red: hex(0xf07171),
+                maroon: hex(0xfa8d3e),
+                green: hex(0x86b300),
+                yellow: hex(0xff9940),
+            },
        }
    }
 }
@@ -371,11 +431,11 @@ mod tests {
    fn all_themes_distinct_and_labeled() {
        // ALL covers exactly the variants once, each with a unique non-empty label
        // and a distinct base colour (so swatches don't look identical).
-        assert_eq!(AppTheme::ALL.len(), 10);
+        assert_eq!(AppTheme::ALL.len(), 13);
        let mut labels: Vec<&str> = AppTheme::ALL.iter().map(|t| t.label()).collect();
        labels.sort_unstable();
        labels.dedup();
-        assert_eq!(labels.len(), 10, "labels must be unique + non-empty");
+        assert_eq!(labels.len(), 13, "labels must be unique + non-empty");
        assert!(labels.iter().all(|l| !l.is_empty()));
    }

@@ -0,0 +1,141 @@
+//! End-to-end loopback test for the chat file-transfer plane (`FILES_ALPN`).
+//!
+//! Spins up two real iroh endpoints on localhost (relay disabled, addresses
+//! exchanged directly), registers the production [`FileRouter`] on each, serves a
+//! multi-megabyte blob on one side, and fetches it from the other through the
+//! real `serve_attachment`/`fetch_attachment` path.
+//!
+//! This is the regression guard for the "file fetch: read failed: connection
+//! lost" bug: the serve handler used to return (and drop the connection) the
+//! instant it called `finish()`, so the CONNECTION_CLOSE raced ahead of the
+//! still-in-flight stream data and the fetcher's `read_to_end` aborted. A blob
+//! large enough to span many packets makes that race deterministic — the fix
+//! (waiting on `connection.closed()` before returning) keeps the link up until
+//! the fetcher has the bytes.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use iroh::address_lookup::memory::MemoryLookup;
+use iroh::endpoint::presets;
+use iroh::protocol::Router;
+use iroh::{Endpoint, RelayMode};
+
+use peerspeak::files::{ChatAttachment, AttachmentKind};
+use peerspeak::network::NetworkTransport;
+use peerspeak::network::iroh_impl::{FileRouter, IrohTransport};
+use peerspeak::protocol::FILES_ALPN;
+
+struct Node {
+    endpoint: Endpoint,
+    transport: Arc<IrohTransport>,
+    _router: Router,
+    lookup: MemoryLookup,
+}
+
+async fn spawn_node() -> Node {
+    let lookup = MemoryLookup::new();
+    let endpoint = Endpoint::builder(presets::Minimal)
+        .secret_key(iroh::SecretKey::generate())
+        .relay_mode(RelayMode::Disabled)
+        .address_lookup(lookup.clone())
+        .bind()
+        .await
+        .expect("bind endpoint");
+
+    let transport = Arc::new(IrohTransport::new(endpoint.clone()));
+    // Mirror production: a persistent FileRouter bound to this session's transport
+    // is what the router accepts inbound file fetches on.
+    let file_router = FileRouter::new();
+    file_router.bind(&transport);
+    let router = Router::builder(endpoint.clone())
+        .accept(FILES_ALPN, file_router)
+        .spawn();
+
+    Node { endpoint, transport, _router: router, lookup }
+}
+
+/// A pseudo-random-ish multi-megabyte payload spanning many QUIC packets, so a
+/// premature connection close on the serve side reliably corrupts/aborts the read.
+fn big_blob() -> Vec<u8> {
+    (0..(2 * 1024 * 1024u32))
+        .map(|i| (i.wrapping_mul(2654435761) >> 13) as u8)
+        .collect()
+}
+
+#[tokio::test]
+async fn loopback_attachment_round_trips_intact() {
+    let server = spawn_node().await;
+    let client = spawn_node().await;
+
+    // Seed each side with the other's full address so direct dialing works.
+    server.lookup.add_endpoint_info(client.endpoint.addr());
+    client.lookup.add_endpoint_info(server.endpoint.addr());
+
+    let server_id = server.endpoint.id();
+    let client_id = client.endpoint.id();
+
+    // The serve handler gates on room membership (the audio admission roster), so
+    // the server must admit the client before it will answer the fetch.
+    server.transport.admit_audio_sender(client_id);
+    client.transport.admit_audio_sender(server_id);
+
+    // The fetcher dials the retained full address; seed it so fetch_attachment
+    // doesn't have to fall back to a bare-id lookup.
+    client.transport.connect_peer(server.endpoint.addr()).await;
+
+    let blob = big_blob();
+    let id = [42u8; 32];
+    server.transport.serve_attachment(id, Arc::new(blob.clone()));
+
+    let att = ChatAttachment {
+        name: "exterior-landscape.jpg".to_string(),
+        size: blob.len() as u64,
+        kind: AttachmentKind::Image,
+        id,
+    };
+
+    let fetched = tokio::time::timeout(
+        Duration::from_secs(30),
+        client.transport.fetch_attachment(server_id, &att),
+    )
+    .await
+    .expect("fetch did not time out")
+    .expect("fetch succeeded");
+
+    assert_eq!(fetched.len(), blob.len(), "fetched the full blob");
+    assert_eq!(fetched, blob, "fetched bytes match served bytes exactly");
+}
+
+#[tokio::test]
+async fn loopback_unknown_id_reports_gone() {
+    let server = spawn_node().await;
+    let client = spawn_node().await;
+
+    server.lookup.add_endpoint_info(client.endpoint.addr());
+    client.lookup.add_endpoint_info(server.endpoint.addr());
+
+    let server_id = server.endpoint.id();
+    let client_id = client.endpoint.id();
+    server.transport.admit_audio_sender(client_id);
+    client.transport.admit_audio_sender(server_id);
+    client.transport.connect_peer(server.endpoint.addr()).await;
+
+    // Never served — the handler closes with an empty body and the fetcher must
+    // surface that as an error, not hang or return empty bytes.
+    let att = ChatAttachment {
+        name: "missing.bin".to_string(),
+        size: 4096,
+        kind: AttachmentKind::File,
+        id: [7u8; 32],
+    };
+
+    let result = tokio::time::timeout(
+        Duration::from_secs(30),
+        client.transport.fetch_attachment(server_id, &att),
+    )
+    .await
+    .expect("fetch did not time out");
+
+    assert!(result.is_err(), "unknown id should error, got {result:?}");
+}
@@ -0,0 +1,354 @@
+//! Phase-0 spike for post-grace gossip recovery.
+//!
+//! These tests prove that `GossipSender::join_peers` can restore an existing
+//! topic subscription after the other peer drops and rejoins without its own
+//! bootstrap target. The second case disables relays, clears the surviving
+//! node's lookup, and moves the peer to a fresh endpoint address so only the
+//! retained full address passed to `rebootstrap_peers` can drive recovery.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use iroh::address_lookup::memory::MemoryLookup;
+use iroh::endpoint::presets;
+use iroh::protocol::Router;
+use iroh::{Endpoint, EndpointAddr, EndpointId, RelayMode, SecretKey};
+use iroh_gossip::net::Gossip;
+use tokio::sync::mpsc;
+
+use peerspeak::network::gossip::IrohGossipState;
+use peerspeak::network::{PeerSpeakTicket, PeerState, RoomEvent, RoomState};
+
+const EVENT_TIMEOUT: Duration = Duration::from_secs(10);
+
+struct GossipNode {
+    endpoint: Endpoint,
+    lookup: MemoryLookup,
+    room: Arc<IrohGossipState>,
+    _router: Router,
+}
+
+async fn spawn_node(secret: SecretKey) -> GossipNode {
+    let lookup = MemoryLookup::new();
+    let endpoint = Endpoint::builder(presets::Minimal)
+        .secret_key(secret.clone())
+        .relay_mode(RelayMode::Disabled)
+        .address_lookup(lookup.clone())
+        .bind()
+        .await
+        .expect("bind gossip endpoint");
+    let gossip = Gossip::builder().spawn(endpoint.clone());
+    let router = Router::builder(endpoint.clone())
+        .accept(iroh_gossip::net::GOSSIP_ALPN, gossip.clone())
+        .spawn();
+    let room = Arc::new(IrohGossipState::new(
+        endpoint.clone(),
+        gossip,
+        lookup.clone(),
+        secret,
+    ));
+
+    GossipNode {
+        endpoint,
+        lookup,
+        room,
+        _router: router,
+    }
+}
+
+fn state(name: &str, addr: EndpointAddr) -> PeerState {
+    PeerState {
+        name: name.to_string(),
+        is_muted: false,
+        addr,
+        sharing: None,
+        avatar: Default::default(),
+    }
+}
+
+async fn await_joined(rx: &mut mpsc::Receiver<RoomEvent>, peer_id: EndpointId) -> PeerState {
+    let deadline = tokio::time::Instant::now() + EVENT_TIMEOUT;
+    loop {
+        match tokio::time::timeout_at(deadline, rx.recv()).await {
+            Ok(Some(RoomEvent::PeerJoined(id, peer_state))) if id == peer_id => return peer_state,
+            Ok(Some(_)) => continue,
+            Ok(None) => panic!("room event channel closed while waiting for PeerJoined"),
+            Err(_) => panic!("timed out waiting for PeerJoined({peer_id:?})"),
+        }
+    }
+}
+
+async fn await_joined_all(rx: &mut mpsc::Receiver<RoomEvent>, peer_ids: &[EndpointId]) {
+    let deadline = tokio::time::Instant::now() + EVENT_TIMEOUT;
+    let mut remaining = peer_ids.to_vec();
+    while !remaining.is_empty() {
+        match tokio::time::timeout_at(deadline, rx.recv()).await {
+            Ok(Some(RoomEvent::PeerJoined(id, _))) => remaining.retain(|wanted| *wanted != id),
+            Ok(Some(_)) => {}
+            Ok(None) => panic!("room event channel closed while waiting for PeerJoined set"),
+            Err(_) => panic!("timed out waiting for PeerJoined set: {remaining:?}"),
+        }
+    }
+}
+
+async fn await_left(rx: &mut mpsc::Receiver<RoomEvent>, peer_id: EndpointId) {
+    let deadline = tokio::time::Instant::now() + EVENT_TIMEOUT;
+    loop {
+        match tokio::time::timeout_at(deadline, rx.recv()).await {
+            Ok(Some(RoomEvent::PeerLeft(id))) if id == peer_id => return,
+            Ok(Some(_)) => continue,
+            Ok(None) => panic!("room event channel closed while waiting for PeerLeft"),
+            Err(_) => panic!("timed out waiting for PeerLeft({peer_id:?})"),
+        }
+    }
+}
+
+async fn await_absent(room: &IrohGossipState, peer_id: EndpointId) {
+    let deadline = tokio::time::Instant::now() + EVENT_TIMEOUT;
+    loop {
+        if !room.active_peers().iter().any(|(id, _)| *id == peer_id) {
+            return;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "timed out waiting for peer to leave the roster"
+        );
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+}
+
+fn ticket(host_addr: EndpointAddr) -> String {
+    PeerSpeakTicket {
+        host_addr,
+        topic_id: rand::random(),
+        name: "rebootstrap-spike".to_string(),
+    }
+    .to_string()
+}
+
+async fn establish_room(
+    a: &GossipNode,
+    b: &GossipNode,
+    ticket: &str,
+    events_a: &mut mpsc::Receiver<RoomEvent>,
+) {
+    // B is the ticket host. Its own bootstrap set is empty; A is the only side
+    // that initially dials, which is also how the recovery setup is controlled.
+    b.room
+        .join(ticket, state("Bob", b.endpoint.addr()), vec![])
+        .await
+        .expect("host joins topic");
+    a.room
+        .join(ticket, state("Alice", a.endpoint.addr()), vec![])
+        .await
+        .expect("client joins topic");
+    let joined = await_joined(events_a, b.endpoint.id()).await;
+    assert_eq!(joined.name, "Bob");
+}
+
+#[tokio::test]
+async fn rebootstrap_restores_roster_on_existing_subscription() {
+    let a = spawn_node(SecretKey::generate()).await;
+    let b = spawn_node(SecretKey::generate()).await;
+    let ticket = ticket(b.endpoint.addr());
+    let mut events_a = a.room.subscribe_events().await.expect("subscribe A events");
+
+    establish_room(&a, &b, &ticket, &mut events_a).await;
+
+    // Drop only B's topic subscription. A stays subscribed. B then rejoins as
+    // the ticket host, so compute_bootstrap removes self and B has nobody to dial.
+    b.room.leave().await.expect("B leaves topic");
+    await_absent(&a.room, b.endpoint.id()).await;
+    b.room
+        .join(&ticket, state("Bob recovered", b.endpoint.addr()), vec![])
+        .await
+        .expect("B rejoins without bootstrap peers");
+
+    tokio::time::sleep(Duration::from_millis(250)).await;
+    assert!(
+        !a.room
+            .active_peers()
+            .iter()
+            .any(|(id, _)| *id == b.endpoint.id()),
+        "B must not recover before A explicitly re-bootstraps it"
+    );
+
+    a.room
+        .rebootstrap_peers(vec![b.endpoint.addr()])
+        .await
+        .expect("targeted gossip re-bootstrap");
+
+    let recovered = await_joined(&mut events_a, b.endpoint.id()).await;
+    assert_eq!(recovered.name, "Bob recovered");
+}
+
+#[tokio::test]
+async fn rebootstrap_uses_retained_full_address_with_empty_lookup() {
+    let a = spawn_node(SecretKey::generate()).await;
+    let b_secret = SecretKey::generate();
+    let b = spawn_node(b_secret.clone()).await;
+    let b_id = b.endpoint.id();
+    let old_b_addr = b.endpoint.addr();
+    let ticket = ticket(old_b_addr.clone());
+    let mut events_a = a.room.subscribe_events().await.expect("subscribe A events");
+
+    establish_room(&a, &b, &ticket, &mut events_a).await;
+    b.room.leave().await.expect("old B leaves topic");
+    await_absent(&a.room, b_id).await;
+
+    // Move the same authenticated identity to a newly-bound direct-only endpoint.
+    // The old cached path is now dead; the new full address is the only valid one.
+    b.endpoint.close().await;
+    drop(b);
+    tokio::time::sleep(Duration::from_millis(250)).await;
+    let b_rebound = spawn_node(b_secret).await;
+    let new_b_addr = b_rebound.endpoint.addr();
+    assert_eq!(new_b_addr.id, b_id, "identity must survive the rebind");
+    assert_ne!(
+        new_b_addr, old_b_addr,
+        "rebound peer must have a fresh address"
+    );
+
+    b_rebound
+        .room
+        .join(&ticket, state("Bob rebound", new_b_addr.clone()), vec![])
+        .await
+        .expect("rebound host joins without bootstrap peers");
+
+    // Remove the stale lookup entry. `rebootstrap_peers` must seed the retained
+    // new full address before asking gossip to join the peer by id.
+    a.lookup.remove_endpoint_info(b_id);
+    assert!(
+        a.lookup.get_endpoint_info(b_id).is_none(),
+        "A lookup starts empty for B"
+    );
+    tokio::time::sleep(Duration::from_millis(250)).await;
+    assert!(
+        !a.room.active_peers().iter().any(|(id, _)| *id == b_id),
+        "rebound B must not be rediscovered without the retained address"
+    );
+
+    a.room
+        .rebootstrap_peers(vec![new_b_addr])
+        .await
+        .expect("retained-address gossip re-bootstrap");
+    assert!(
+        a.lookup.get_endpoint_info(b_id).is_some(),
+        "re-bootstrap must restore B's address to the lookup"
+    );
+
+    let recovered = await_joined(&mut events_a, b_id).await;
+    assert_eq!(recovered.name, "Bob rebound");
+}
+
+#[tokio::test]
+async fn demoted_peer_requires_a_fresh_signed_announce_to_rejoin() {
+    let a = spawn_node(SecretKey::generate()).await;
+    let b = spawn_node(SecretKey::generate()).await;
+    let ticket = ticket(b.endpoint.addr());
+    let mut events_a = a.room.subscribe_events().await.expect("subscribe A events");
+
+    establish_room(&a, &b, &ticket, &mut events_a).await;
+    a.room.mark_peer_disconnected(b.endpoint.id());
+    assert!(
+        !a.room
+            .active_peers()
+            .iter()
+            .any(|(id, _)| *id == b.endpoint.id()),
+        "demotion must revoke live roster membership"
+    );
+
+    b.room
+        .update_self_state(state("Bob authenticated again", b.endpoint.addr()))
+        .await
+        .expect("broadcast fresh signed announce");
+
+    let recovered = await_joined(&mut events_a, b.endpoint.id()).await;
+    assert_eq!(recovered.name, "Bob authenticated again");
+}
+
+#[tokio::test]
+async fn signed_leave_after_demotion_still_emits_peer_left() {
+    let a = spawn_node(SecretKey::generate()).await;
+    let b = spawn_node(SecretKey::generate()).await;
+    let ticket = ticket(b.endpoint.addr());
+    let mut events_a = a.room.subscribe_events().await.expect("subscribe A events");
+
+    establish_room(&a, &b, &ticket, &mut events_a).await;
+    a.room.mark_peer_disconnected(b.endpoint.id());
+
+    b.room
+        .leave()
+        .await
+        .expect("broadcast signed Leave after demotion");
+    await_left(&mut events_a, b.endpoint.id()).await;
+}
+
+#[tokio::test]
+async fn targeted_rebootstrap_preserves_healthy_peer_in_three_peer_room() {
+    let a = spawn_node(SecretKey::generate()).await;
+    let b = spawn_node(SecretKey::generate()).await;
+    let c_secret = SecretKey::generate();
+    let c = spawn_node(c_secret.clone()).await;
+    let c_id = c.endpoint.id();
+    let ticket = ticket(c.endpoint.addr());
+    let mut events_a = a.room.subscribe_events().await.expect("subscribe A events");
+    let mut events_b = b.room.subscribe_events().await.expect("subscribe B events");
+
+    c.room
+        .join(&ticket, state("Carol", c.endpoint.addr()), vec![])
+        .await
+        .expect("C hosts topic");
+    b.room
+        .join(&ticket, state("Bob", b.endpoint.addr()), vec![])
+        .await
+        .expect("B joins C");
+    await_joined(&mut events_b, c_id).await;
+    a.room
+        .join(&ticket, state("Alice", a.endpoint.addr()), vec![])
+        .await
+        .expect("A joins C");
+    await_joined_all(&mut events_a, &[b.endpoint.id(), c_id]).await;
+    await_joined(&mut events_b, a.endpoint.id()).await;
+
+    // Remove only C. A and B keep their existing topic subscriptions and remain
+    // mutually present while C is rebound to a fresh address.
+    c.endpoint.close().await;
+    drop(c);
+    a.room.mark_peer_disconnected(c_id);
+    b.room.mark_peer_disconnected(c_id);
+    let c_rebound = spawn_node(c_secret).await;
+    let rebound_addr = c_rebound.endpoint.addr();
+    c_rebound
+        .room
+        .join(
+            &ticket,
+            state("Carol recovered", rebound_addr.clone()),
+            vec![],
+        )
+        .await
+        .expect("rebound C rejoins as host without bootstrap");
+
+    a.room
+        .rebootstrap_peers(vec![rebound_addr])
+        .await
+        .expect("A targets only C for recovery");
+    let recovered = await_joined(&mut events_a, c_id).await;
+    assert_eq!(recovered.name, "Carol recovered");
+    await_joined(&mut events_b, c_id).await;
+
+    assert!(
+        a.room
+            .active_peers()
+            .iter()
+            .any(|(id, _)| *id == b.endpoint.id()),
+        "healthy B must remain present at A throughout C recovery"
+    );
+    assert!(
+        b.room
+            .active_peers()
+            .iter()
+            .any(|(id, _)| *id == a.endpoint.id()),
+        "healthy A must remain present at B throughout C recovery"
+    );
+}
@@ -25,8 +25,7 @@ use peerspeak::codec::opus_impl::OpusEncoder;
 use peerspeak::core::jitter::{FRAME_SAMPLES, JitterBuffer};
 use peerspeak::network::{ConnEvent, NetworkTransport};
 use peerspeak::network::iroh_impl::{AudioRouter, IrohTransport};
-
-const AUDIO_ALPN: &[u8] = b"peerspeak-audio";
+use peerspeak::protocol::AUDIO_ALPN;

 struct Node {
    endpoint: Endpoint,
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Cross-compile peerspeak to x86_64-pc-windows-gnu (run inside the peerspeak-win distrobox).
+# Produces a statically-linked, self-contained .exe (no extra DLLs) for the
+# Windows installer in packaging/windows/. Requires the rust-src component and
+# the x86_64-pc-windows-gnu target; invoke with build-std for the static link:
+#   RUSTC_BOOTSTRAP=1 ./win-cross-build.sh -Z build-std=std,panic_abort
+set -euo pipefail
+cd "$(dirname "$0")"
+
+export CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=x86_64-w64-mingw32-gcc
+export CC_x86_64_pc_windows_gnu=x86_64-w64-mingw32-gcc
+export CXX_x86_64_pc_windows_gnu=x86_64-w64-mingw32-g++
+export AR_x86_64_pc_windows_gnu=x86_64-w64-mingw32-ar
+# Bundled libopus declares cmake_minimum_required < 3.5; cmake 4.x refuses it.
+export CMAKE_POLICY_VERSION_MINIMUM=3.5
+
+cargo build --release --target x86_64-pc-windows-gnu --bin peerspeak "$@"