diff --git a/Client/tauri-client/src/components/MessageList.ts b/Client/tauri-client/src/components/MessageList.ts
index 78c24a8b..0e6a93f2 100644
--- a/Client/tauri-client/src/components/MessageList.ts
+++ b/Client/tauri-client/src/components/MessageList.ts
@@ -379,7 +379,8 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
     // doesn't cause jumps from estimate→measured height corrections.
     premeasureAll();
     scrollToBottom();
-    requestAnimationFrame(() => scrollToBottom());
+    const initialScrollRaf = requestAnimationFrame(() => scrollToBottom());
+    ac.signal.addEventListener("abort", () => cancelAnimationFrame(initialScrollRaf));
 
     unsubscribers.push(messagesStore.subscribeSelector(
       (s) => s.messagesByChannel,
diff --git a/Client/tauri-client/src/components/message-list/media.ts b/Client/tauri-client/src/components/message-list/media.ts
index 2fa8424a..f046b6d6 100644
--- a/Client/tauri-client/src/components/message-list/media.ts
+++ b/Client/tauri-client/src/components/message-list/media.ts
@@ -66,8 +66,19 @@ export function extractYouTubeId(url: string): string | null {
 /** Cache for YouTube video titles to avoid re-fetching on every re-render. */
 const ytTitleCache = new Map<string, string>();
 
+/** Strict pattern for YouTube video IDs (alphanumeric, hyphens, underscores). */
+const YOUTUBE_ID_RE = /^[\w-]{1,20}$/;
+
 /** Render a YouTube embed player with title header. */
 export function renderYouTubeEmbed(videoId: string, originalUrl: string): HTMLDivElement {
+  // Validate videoId to prevent injection into iframe src / img src.
+  if (!YOUTUBE_ID_RE.test(videoId)) {
+    const fallback = createElement("div", { class: "msg-embed" });
+    const link = createElement("a", { href: originalUrl, target: "_blank", rel: "noopener noreferrer" });
+    setText(link, originalUrl);
+    fallback.appendChild(link);
+    return fallback;
+  }
   const wrap = createElement("div", { class: "msg-embed msg-embed-youtube" });
 
   // Header: channel name + video title
@@ -85,10 +96,10 @@ export function renderYouTubeEmbed(videoId: string, originalUrl: string): HTMLDi
     setText(titleLink, cached);
   } else {
     setText(titleLink, "Loading...");
-    const oembedUrl = `https://www.youtube.com/oembed?url=https://www.youtube.com/watch?v=${videoId}&format=json`;
-    fetch(oembedUrl)
-      .then((res) => (res.ok ? res.json() : null))
-      .then((data: { title?: string } | null) => {
+    const oembedUrl = `https://www.youtube.com/oembed?url=https://www.youtube.com/watch?v=${encodeURIComponent(videoId)}&format=json`;
+    fetch(oembedUrl, { signal: AbortSignal.timeout(5000) })
+      .then((res) => (res.ok ? (res.json() as Promise<{ title?: string } | null>) : null))
+      .then((data) => {
         const title = data?.title ?? "YouTube Video";
         ytTitleCache.set(videoId, title);
         setText(titleLink, title);
diff --git a/Client/tauri-client/src/lib/livekitSession.ts b/Client/tauri-client/src/lib/livekitSession.ts
index 75c4e677..5c6f6a08 100644
--- a/Client/tauri-client/src/lib/livekitSession.ts
+++ b/Client/tauri-client/src/lib/livekitSession.ts
@@ -1,11 +1,4 @@
-// =============================================================================
 // LiveKit Session — lifecycle orchestrator for voice chat via LiveKit
-//
-// Replaces the old WebRTC-based voiceSession.ts. Manages LiveKit Room
-// connection, mic publishing (with optional RNNoise pre-processing),
-// remote track playback, and camera/screenshare.
-// =============================================================================
-
 import {
   Room,
   RoomEvent,
@@ -30,245 +23,17 @@ import type { NoiseSuppressor } from "@lib/noise-suppression";
 
 const log = createLogger("livekitSession");
 
-// ---------------------------------------------------------------------------
-// Module-level state (singleton)
-// ---------------------------------------------------------------------------
-
-let room: Room | null = null;
-let ws: WsClient | null = null;
-let noiseSuppressor: NoiseSuppressor | null = null;
-let onErrorCallback: ((message: string) => void) | null = null;
-let currentChannelId: number | null = null;
-/** Server host (e.g. "192.168.0.247:8443") for constructing LiveKit proxy URL. */
-let serverHost: string | null = null;
-
-// Speaking detection via audioLevel polling
-let speakingPollInterval: ReturnType<typeof setInterval> | null = null;
-/** Cached sensitivity threshold (0.0-0.15). Updated by setVoiceSensitivity. */
-let speakingThreshold = ((100 - 50) / 100) * 0.15; // default: sensitivity 50
-
-/** The raw mic stream acquired for RNNoise processing (must be stopped on cleanup). */
-let rawMicStream: MediaStream | null = null;
-
-// Remote audio playback
-const audioElements = new Map<string, HTMLAudioElement>();
-let audioContainer: HTMLDivElement | null = null;
-
-// Remote video callbacks
-type RemoteVideoCallback = (userId: number, stream: MediaStream) => void;
-type RemoteVideoRemovedCallback = (userId: number) => void;
-let onRemoteVideoCallback: RemoteVideoCallback | null = null;
-let onRemoteVideoRemovedCallback: RemoteVideoRemovedCallback | null = null;
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
+// --- Pure helpers (no instance state) ---
 
 /** Parse userId from LiveKit participant identity "user-{id}". Returns 0 if unparseable. */
-function parseUserId(identity: string): number {
+export function parseUserId(identity: string): number {
   const match = identity.match(/^user-(\d+)$/);
-  if (match !== null && match[1] !== undefined) {
-    return parseInt(match[1], 10);
-  }
+  if (match !== null && match[1] !== undefined) return parseInt(match[1], 10);
   return 0;
 }
 
-/** Get or create the hidden container for remote audio elements. */
-function getOrCreateAudioContainer(): HTMLDivElement {
-  if (audioContainer !== null) return audioContainer;
-
-  const existing = document.getElementById("voice-audio-container");
-  if (existing instanceof HTMLDivElement) {
-    audioContainer = existing;
-    return audioContainer;
-  }
-
-  const div = document.createElement("div");
-  div.id = "voice-audio-container";
-  div.style.display = "none";
-  document.body.appendChild(div);
-  audioContainer = div;
-  return audioContainer;
-}
-
-/** Get saved per-user volume (0-200 range, default 100). */
-function getSavedUserVolume(userId: number): number {
-  return loadPref<number>(`userVolume_${userId}`, 100);
-}
-
-/** Clean up all remote audio elements. */
-function cleanupAudioElements(): void {
-  for (const el of audioElements.values()) {
-    el.srcObject = null;
-    el.remove();
-  }
-  audioElements.clear();
-}
-
-// ---------------------------------------------------------------------------
-// RNNoise integration
-// ---------------------------------------------------------------------------
-
-/** Acquire mic, run through RNNoise, and publish the processed track to LiveKit. */
-async function publishWithNoiseSuppression(): Promise<void> {
-  if (room === null) return;
-
-  const savedDevice = loadPref<string>("audioInputDevice", "");
-  const constraints: MediaStreamConstraints = {
-    audio: {
-      deviceId: savedDevice ? { exact: savedDevice } : undefined,
-      echoCancellation: loadPref("echoCancellation", true),
-      noiseSuppression: loadPref("noiseSuppression", true),
-      autoGainControl: loadPref("autoGainControl", true),
-    },
-    video: false,
-  };
-  const rawStream = await navigator.mediaDevices.getUserMedia(constraints);
-  rawMicStream = rawStream;
-  noiseSuppressor = createNoiseSuppressor();
-  const processedStream = await noiseSuppressor.process(rawStream);
-  const processedTrack = processedStream.getAudioTracks()[0];
-  if (processedTrack) {
-    await room.localParticipant.publishTrack(processedTrack, {
-      source: Track.Source.Microphone,
-    });
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Room event handlers
-// ---------------------------------------------------------------------------
-
-function handleTrackSubscribed(
-  track: RemoteTrack,
-  publication: RemoteTrackPublication,
-  participant: RemoteParticipant,
-): void {
-  const userId = parseUserId(participant.identity);
-
-  if (track.kind === Track.Kind.Audio) {
-    // Attach audio track to a hidden <audio> element for playback
-    const container = getOrCreateAudioContainer();
-    const audioEl = track.attach();
-
-    // Apply saved per-user volume
-    const savedVolume = userId > 0 ? getSavedUserVolume(userId) : 100;
-    audioEl.volume = Math.min(savedVolume, 100) / 100;
-
-    // Respect current deafen state
-    if (voiceStore.getState().localDeafened) {
-      audioEl.muted = true;
-    }
-
-    // Apply saved output device
-    const savedOutput = loadPref<string>("audioOutputDevice", "");
-    if (savedOutput !== "" && typeof audioEl.setSinkId === "function") {
-      audioEl.setSinkId(savedOutput).catch((err) => {
-        log.warn("Failed to set output device on remote audio", err);
-      });
-    }
-
-    container.appendChild(audioEl);
-    const trackKey = `${participant.identity}-${track.sid}`;
-    audioElements.set(trackKey, audioEl);
-    // Create analyser for remote speaking detection
-    if (userId > 0) {
-      addRemoteAnalyser(userId, track.mediaStreamTrack);
-    }
-    log.debug("Remote audio track subscribed", { userId, trackSid: track.sid });
-  } else if (track.kind === Track.Kind.Video) {
-    if (userId > 0 && onRemoteVideoCallback !== null) {
-      // Create a MediaStream from the video track for the VideoGrid
-      const mediaTrack = track.mediaStreamTrack;
-      const stream = new MediaStream([mediaTrack]);
-      onRemoteVideoCallback(userId, stream);
-    }
-    log.debug("Remote video track subscribed", { userId, trackSid: track.sid });
-  }
-}
-
-function handleTrackUnsubscribed(
-  track: RemoteTrack,
-  _publication: RemoteTrackPublication,
-  participant: RemoteParticipant,
-): void {
-  const userId = parseUserId(participant.identity);
-
-  if (track.kind === Track.Kind.Audio) {
-    track.detach().forEach((el) => {
-      el.remove();
-    });
-    const trackKey = `${participant.identity}-${track.sid}`;
-    audioElements.delete(trackKey);
-    if (userId > 0) {
-      removeRemoteAnalyser(userId);
-    }
-    log.debug("Remote audio track unsubscribed", { userId, trackSid: track.sid });
-  } else if (track.kind === Track.Kind.Video) {
-    track.detach();
-    if (userId > 0) {
-      onRemoteVideoRemovedCallback?.(userId);
-    }
-    log.debug("Remote video track unsubscribed", { userId, trackSid: track.sid });
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Remote audio analysers — one per remote participant for speaking detection
-// ---------------------------------------------------------------------------
-
-interface RemoteAnalyser {
-  ctx: AudioContext;
-  analyser: AnalyserNode;
-  source: MediaStreamAudioSourceNode;
-  data: Uint8Array<ArrayBuffer>;
-}
-
-const remoteAnalysers = new Map<number, RemoteAnalyser>();
-
-function addRemoteAnalyser(userId: number, mediaTrack: MediaStreamTrack): void {
-  removeRemoteAnalyser(userId);
-  try {
-    const ctx = new AudioContext({ sampleRate: 48000 });
-    const analyser = ctx.createAnalyser();
-    analyser.fftSize = 256;
-    analyser.smoothingTimeConstant = 0.5;
-    const stream = new MediaStream([mediaTrack]);
-    const source = ctx.createMediaStreamSource(stream);
-    source.connect(analyser);
-    remoteAnalysers.set(userId, { ctx, analyser, source, data: new Uint8Array(128) as Uint8Array<ArrayBuffer> });
-  } catch (err) {
-    log.warn("Failed to create remote analyser", { userId, error: err });
-  }
-}
-
-function removeRemoteAnalyser(userId: number): void {
-  const ra = remoteAnalysers.get(userId);
-  if (ra) {
-    ra.source.disconnect();
-    ra.analyser.disconnect();
-    void ra.ctx.close();
-    remoteAnalysers.delete(userId);
-  }
-}
-
-function cleanupAllRemoteAnalysers(): void {
-  for (const [id] of remoteAnalysers) {
-    removeRemoteAnalyser(id);
-  }
-}
-
-/** Track whether local mic is currently gated by threshold. */
-let localMicGated = false;
-/** Local mic audio level analyser (Web Audio API). */
-let localAnalyser: AnalyserNode | null = null;
-let localAnalyserCtx: AudioContext | null = null;
-let localAnalyserSource: MediaStreamAudioSourceNode | null = null;
-let localAnalyserClonedTrack: MediaStreamTrack | null = null;
-const localAnalyserData = new Uint8Array(128);
-
 /** Compute RMS audio level (0-1) from frequency data. */
-function computeRms(data: Uint8Array<ArrayBuffer>): number {
+export function computeRms(data: Uint8Array<ArrayBuffer>): number {
   let sum = 0;
   for (let i = 0; i < data.length; i++) {
     const v = (data[i] ?? 0) / 255;
@@ -277,208 +42,77 @@ function computeRms(data: Uint8Array<ArrayBuffer>): number {
   return Math.sqrt(sum / data.length);
 }
 
-/** Start local mic audio analysis using Web Audio AnalyserNode. */
-function startLocalAnalyser(): void {
-  stopLocalAnalyser();
-  if (room === null) return;
-
-  const micPub = room.localParticipant.getTrackPublication(Track.Source.Microphone);
-  const mediaTrack = micPub?.track?.mediaStreamTrack;
-  if (!mediaTrack) return;
-
-  try {
-    localAnalyserCtx = new AudioContext({ sampleRate: 48000 });
-    localAnalyser = localAnalyserCtx.createAnalyser();
-    localAnalyser.fftSize = 256;
-    localAnalyser.smoothingTimeConstant = 0.5;
-
-    // Clone the track so mic gating (track.enabled=false) doesn't
-    // kill the analyser's audio input — avoids a deadlock where
-    // gated silence keeps the threshold below forever.
-    localAnalyserClonedTrack = mediaTrack.clone();
-    const stream = new MediaStream([localAnalyserClonedTrack]);
-    localAnalyserSource = localAnalyserCtx.createMediaStreamSource(stream);
-    localAnalyserSource.connect(localAnalyser);
-    log.debug("Local mic analyser started");
-  } catch (err) {
-    log.warn("Failed to start local mic analyser", err);
-  }
+/** Get saved per-user volume (0-200 range, default 100). */
+function getSavedUserVolume(userId: number): number {
+  return loadPref<number>(`userVolume_${userId}`, 100);
 }
 
-function stopLocalAnalyser(): void {
-  if (localAnalyserSource !== null) {
-    localAnalyserSource.disconnect();
-    localAnalyserSource = null;
-  }
-  if (localAnalyser !== null) {
-    localAnalyser.disconnect();
-    localAnalyser = null;
-  }
-  if (localAnalyserClonedTrack !== null) {
-    localAnalyserClonedTrack.stop();
-    localAnalyserClonedTrack = null;
-  }
-  if (localAnalyserCtx !== null) {
-    void localAnalyserCtx.close();
-    localAnalyserCtx = null;
+/** Compare two pre-sorted speaker ID arrays. Both must be sorted ascending. */
+function speakerSetsEqual(a: readonly number[], b: readonly number[]): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
   }
+  return true;
 }
 
-/** Start the speaking detection poll. Measures local mic via Web Audio
- *  AnalyserNode (since LiveKit's audioLevel is always 0 for local
- *  participant). Remote participants use LiveKit's audioLevel. */
-function startSpeakingPoll(): void {
-  stopSpeakingPoll();
-  localMicGated = false;
-  speakingPollInterval = setInterval(() => {
-    if (room === null || currentChannelId === null) return;
+// --- Types ---
 
-    const speakerIds: number[] = [];
+type RemoteVideoCallback = (userId: number, stream: MediaStream) => void;
+type RemoteVideoRemovedCallback = (userId: number) => void;
 
-    // Measure local mic level via Web Audio analyser
-    let localLevel = 0;
-    if (localAnalyser !== null) {
-      localAnalyser.getByteFrequencyData(localAnalyserData);
-      localLevel = computeRms(localAnalyserData);
+interface RemoteAnalyser {
+  analyser: AnalyserNode;
+  source: MediaStreamAudioSourceNode;
+  data: Uint8Array<ArrayBuffer>;
+}
+
+// --- LiveKitSession class ---
+
+export class LiveKitSession {
+  private room: Room | null = null;
+  private ws: WsClient | null = null;
+  private noiseSuppressor: NoiseSuppressor | null = null;
+  private onErrorCallback: ((message: string) => void) | null = null;
+  private currentChannelId: number | null = null;
+  private serverHost: string | null = null;
+  private speakingPollInterval: ReturnType<typeof setInterval> | null = null;
+  private speakingThreshold = ((100 - 50) / 100) * 0.15;
+  private rawMicStream: MediaStream | null = null;
+  private readonly audioElements = new Map<string, HTMLAudioElement>();
+  private audioContainer: HTMLDivElement | null = null;
+  private onRemoteVideoCallback: RemoteVideoCallback | null = null;
+  private onRemoteVideoRemovedCallback: RemoteVideoRemovedCallback | null = null;
+  private sharedAudioCtx: AudioContext | null = null;
+  private readonly remoteAnalysers = new Map<number, RemoteAnalyser>();
+  private localMicGated = false;
+  private localAnalyser: AnalyserNode | null = null;
+  private localAnalyserSource: MediaStreamAudioSourceNode | null = null;
+  private localAnalyserClonedTrack: MediaStreamTrack | null = null;
+  private readonly localAnalyserData = new Uint8Array(128);
+  private previousSpeakerIds: readonly number[] = [];
+  private tokenRefreshTimer: ReturnType<typeof setTimeout> | null = null;
+
+  // --- Shared AudioContext (lazy) ---
+
+  private getSharedAudioCtx(): AudioContext {
+    if (this.sharedAudioCtx === null || this.sharedAudioCtx.state === "closed") {
+      this.sharedAudioCtx = new AudioContext({ sampleRate: 48000 });
     }
-    const localSpeaking = localLevel > speakingThreshold;
-
-    // Gate local mic: disable track when below threshold (silence suppression)
-    const micPub = room.localParticipant.getTrackPublication(Track.Source.Microphone);
-    if (micPub?.track?.mediaStreamTrack) {
-      if (localSpeaking && localMicGated) {
-        micPub.track.mediaStreamTrack.enabled = true;
-        localMicGated = false;
-      } else if (!localSpeaking && !localMicGated) {
-        micPub.track.mediaStreamTrack.enabled = false;
-        localMicGated = true;
-      }
-    }
-
-    // Build speaker list for the ring
-    if (localSpeaking) {
-      const localId = parseUserId(room.localParticipant.identity);
-      if (localId > 0) speakerIds.push(localId);
-    }
-
-    // Check remote participants via their own audio analysers
-    for (const [userId, ra] of remoteAnalysers) {
-      ra.analyser.getByteFrequencyData(ra.data);
-      const rms = computeRms(ra.data);
-      if (rms > speakingThreshold) {
-        speakerIds.push(userId);
-      }
-    }
-
-    setSpeakers({
-      channel_id: currentChannelId,
-      speakers: speakerIds,
-    });
-  }, 100);
-}
-
-function stopSpeakingPoll(): void {
-  if (speakingPollInterval !== null) {
-    clearInterval(speakingPollInterval);
-    speakingPollInterval = null;
+    return this.sharedAudioCtx;
   }
-  stopLocalAnalyser();
-  cleanupAllRemoteAnalysers();
-}
 
-function handleDisconnected(reason?: DisconnectReason): void {
-  log.info("LiveKit room disconnected", { reason });
-
-  const isUnexpected = reason !== DisconnectReason.CLIENT_INITIATED;
-  leaveVoice(false);
-
-  if (isUnexpected) {
-    onErrorCallback?.("Voice connection lost — disconnected");
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-/** Set the WS client reference used for signaling. */
-export function setWsClient(client: WsClient): void {
-  ws = client;
-}
-
-/** Set the server host for constructing LiveKit proxy URLs. */
-export function setServerHost(host: string): void {
-  serverHost = host;
-}
-
-/**
- * Resolve a LiveKit URL. If the server sends a relative path like "/livekit",
- * construct the full wss:// URL using the server host. This proxies LiveKit
- * signaling through OwnCord's HTTPS to avoid mixed-content blocks.
- */
-/**
- * Resolve which LiveKit URL to use. Prefers the direct URL on localhost
- * (avoids self-signed TLS issues with WebView fetch). Falls back to the
- * HTTPS proxy path for remote connections.
- */
-function resolveLiveKitUrl(proxyPath: string, directUrl?: string): string {
-  if (serverHost !== null) {
-    const host = serverHost.split(":")[0] ?? "";
-    const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
-    if (isLocal && directUrl) {
-      return directUrl;
-    }
-    if (proxyPath.startsWith("/")) {
-      return `wss://${serverHost}${proxyPath}`;
+  private closeSharedAudioCtx(): void {
+    if (this.sharedAudioCtx !== null) {
+      void this.sharedAudioCtx.close();
+      this.sharedAudioCtx = null;
     }
   }
-  return proxyPath;
-}
 
-/** Set error callback for UI feedback (e.g. toast on connection failure). */
-export function setOnError(cb: (message: string) => void): void {
-  onErrorCallback = cb;
-}
+  // --- Room factory ---
 
-/** Clear the error callback. */
-export function clearOnError(): void {
-  onErrorCallback = null;
-}
-
-/** Set callback for when a remote user enables their camera. */
-export function setOnRemoteVideo(cb: RemoteVideoCallback): void {
-  onRemoteVideoCallback = cb;
-}
-
-/** Set callback for when a remote user disables their camera. */
-export function setOnRemoteVideoRemoved(cb: RemoteVideoRemovedCallback): void {
-  onRemoteVideoRemovedCallback = cb;
-}
-
-/** Clear remote video callbacks. */
-export function clearOnRemoteVideo(): void {
-  onRemoteVideoCallback = null;
-  onRemoteVideoRemovedCallback = null;
-}
-
-/**
- * Handle a voice_token message from the server. Creates a LiveKit Room,
- * connects to the SFU, and publishes the local microphone track.
- */
-export async function handleVoiceToken(
-  token: string,
-  url: string,
-  channelId: number,
-  directUrl?: string,
-): Promise<void> {
-  // Disconnect existing session first
-  if (room !== null) {
-    leaveVoice(false);
-  }
-
-  try {
-    // Create room with audio processing defaults
-    room = new Room({
+  private createRoom(): Room {
+    const newRoom = new Room({
       adaptiveStream: true,
       dynacast: true,
       audioCaptureDefaults: {
@@ -487,299 +121,544 @@ export async function handleVoiceToken(
         autoGainControl: loadPref("autoGainControl", true),
       },
     });
+    newRoom.on(RoomEvent.TrackSubscribed, this.handleTrackSubscribed);
+    newRoom.on(RoomEvent.TrackUnsubscribed, this.handleTrackUnsubscribed);
+    newRoom.on(RoomEvent.Disconnected, this.handleDisconnected);
+    return newRoom;
+  }
 
-    // Wire room events
-    room.on(RoomEvent.TrackSubscribed, handleTrackSubscribed);
-    room.on(RoomEvent.TrackUnsubscribed, handleTrackUnsubscribed);
-    room.on(RoomEvent.Disconnected, handleDisconnected);
+  // --- Audio container ---
 
-    // Connect to LiveKit server with retry (LiveKit may still be initializing)
-    const resolvedUrl = resolveLiveKitUrl(url, directUrl);
-    const MAX_RETRIES = 3;
-    const RETRY_DELAY_MS = 2000;
-    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
-      try {
-        await room.connect(resolvedUrl, token);
-        break;
-      } catch (connectErr) {
-        if (attempt < MAX_RETRIES) {
-          log.warn("LiveKit connect failed, retrying", { attempt, maxRetries: MAX_RETRIES, error: connectErr });
-          await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
-          // Room may have been nulled by a concurrent leaveVoice() during the delay
-          if (room === null) throw connectErr;
-          // Recreate room for fresh connection state
-          room.removeAllListeners();
-          room = new Room({
-            adaptiveStream: true,
-            dynacast: true,
-            audioCaptureDefaults: {
-              echoCancellation: loadPref("echoCancellation", true),
-              noiseSuppression: loadPref("noiseSuppression", true),
-              autoGainControl: loadPref("autoGainControl", true),
-            },
-          });
-          room.on(RoomEvent.TrackSubscribed, handleTrackSubscribed);
-          room.on(RoomEvent.TrackUnsubscribed, handleTrackUnsubscribed);
-          room.on(RoomEvent.Disconnected, handleDisconnected);
-        } else {
-          throw connectErr;
-        }
-      }
+  private getOrCreateAudioContainer(): HTMLDivElement {
+    if (this.audioContainer !== null) return this.audioContainer;
+    const existing = document.getElementById("voice-audio-container");
+    if (existing instanceof HTMLDivElement) {
+      this.audioContainer = existing;
+      return this.audioContainer;
     }
-    log.info("Connected to LiveKit room", { channelId, url: resolvedUrl });
+    const div = document.createElement("div");
+    div.id = "voice-audio-container";
+    div.style.display = "none";
+    document.body.appendChild(div);
+    this.audioContainer = div;
+    return this.audioContainer;
+  }
 
-    // Start audioLevel polling for speaking ring (uses sensitivity slider threshold)
-    speakingThreshold = ((100 - loadPref<number>("voiceSensitivity", 50)) / 100) * 0.15;
-    startSpeakingPoll();
+  private cleanupAudioElements(): void {
+    for (const el of this.audioElements.values()) {
+      el.srcObject = null;
+      el.remove();
+    }
+    this.audioElements.clear();
+  }
 
-    // Enable microphone: use RNNoise if Enhanced Noise Suppression is on
-    const enhancedNS = loadPref<boolean>("enhancedNoiseSuppression", false);
+  // --- RNNoise ---
+
+  private async publishWithNoiseSuppression(): Promise<void> {
+    if (this.room === null) return;
+    const savedDevice = loadPref<string>("audioInputDevice", "");
+    const constraints: MediaStreamConstraints = {
+      audio: {
+        deviceId: savedDevice ? { exact: savedDevice } : undefined,
+        echoCancellation: loadPref("echoCancellation", true),
+        noiseSuppression: loadPref("noiseSuppression", true),
+        autoGainControl: loadPref("autoGainControl", true),
+      },
+      video: false,
+    };
+    const rawStream = await navigator.mediaDevices.getUserMedia(constraints);
+    this.rawMicStream = rawStream;
     try {
-      if (enhancedNS) {
-        await publishWithNoiseSuppression();
-        log.info("Published mic with RNNoise noise suppression");
-      } else {
-        await room.localParticipant.setMicrophoneEnabled(true);
-        log.info("Published mic via LiveKit native capture");
+      this.noiseSuppressor = createNoiseSuppressor();
+      const processedStream = await this.noiseSuppressor.process(rawStream);
+      const processedTrack = processedStream.getAudioTracks()[0];
+      if (processedTrack) {
+        await this.room.localParticipant.publishTrack(processedTrack, {
+          source: Track.Source.Microphone,
+        });
       }
-    } catch (micErr) {
-      if (micErr instanceof DOMException && micErr.name === "NotAllowedError") {
-        log.warn("Microphone permission denied — joined in listen-only mode");
-        onErrorCallback?.("Microphone permission denied — joined in listen-only mode");
-      } else if (micErr instanceof DOMException && micErr.name === "NotFoundError") {
-        log.warn("No microphone found — joined in listen-only mode");
-        onErrorCallback?.("No microphone found — joined in listen-only mode");
-      } else {
-        log.warn("Microphone unavailable — joined in listen-only mode", micErr);
-        onErrorCallback?.("Microphone unavailable — joined in listen-only mode");
+    } catch (err) {
+      for (const track of rawStream.getTracks()) track.stop();
+      this.rawMicStream = null;
+      if (this.noiseSuppressor !== null) {
+        this.noiseSuppressor.destroy();
+        this.noiseSuppressor = null;
       }
+      throw err;
     }
-
-    // Apply saved input device
-    const savedInput = loadPref<string>("audioInputDevice", "");
-    if (savedInput) {
-      await room.switchActiveDevice("audioinput", savedInput);
-    }
-
-    // Apply saved output device
-    const savedOutput = loadPref<string>("audioOutputDevice", "");
-    if (savedOutput) {
-      await room.switchActiveDevice("audiooutput", savedOutput);
-    }
-
-    currentChannelId = channelId;
-
-    // Start local mic level analyser (must be after mic is published)
-    startLocalAnalyser();
-    log.info("Voice session active", { channelId });
-  } catch (err) {
-    log.error("Failed to connect to LiveKit", err);
-    onErrorCallback?.("Failed to join voice — connection error");
-    leaveVoice(false);
-  }
-}
-
-/**
- * Leave the current voice session and clean up all resources.
- * If sendWs is true (default), also notifies the server via voice_leave.
- */
-export function leaveVoice(sendWs = true): void {
-  if (sendWs && ws !== null) {
-    ws.send({ type: "voice_leave", payload: {} });
   }
 
-  // Stop raw mic stream acquired for RNNoise
-  if (rawMicStream !== null) {
-    for (const track of rawMicStream.getTracks()) {
-      track.stop();
-    }
-    rawMicStream = null;
-  }
+  // --- Room event handlers (arrow fns to preserve `this`) ---
 
-  // Destroy noise suppressor
-  if (noiseSuppressor !== null) {
-    noiseSuppressor.destroy();
-    noiseSuppressor = null;
-  }
-
-  // Stop speaking detection polling
-  stopSpeakingPoll();
-
-  // Disconnect LiveKit room
-  if (room !== null) {
-    room.removeAllListeners();
-    void room.disconnect();
-    room = null;
-  }
-
-  // Clean up remote audio elements
-  cleanupAudioElements();
-
-  currentChannelId = null;
-  log.info("Left voice session");
-}
-
-/** Mute or unmute the local microphone. */
-export function setMuted(muted: boolean): void {
-  setLocalMuted(muted);
-  if (room !== null) {
-    void room.localParticipant.setMicrophoneEnabled(!muted);
-  }
-}
-
-/** Deafen or undeafen — mutes all remote audio playback. */
-export function setDeafened(deafened: boolean): void {
-  setLocalDeafened(deafened);
-  if (room !== null) {
-    // Toggle subscription on remote audio tracks for deafen
-    for (const participant of room.remoteParticipants.values()) {
-      for (const pub of participant.audioTrackPublications.values()) {
-        pub.setSubscribed(!deafened);
+  private handleTrackSubscribed = (
+    track: RemoteTrack,
+    _publication: RemoteTrackPublication,
+    participant: RemoteParticipant,
+  ): void => {
+    const userId = parseUserId(participant.identity);
+    if (track.kind === Track.Kind.Audio) {
+      const container = this.getOrCreateAudioContainer();
+      const audioEl = track.attach();
+      const savedVolume = userId > 0 ? getSavedUserVolume(userId) : 100;
+      audioEl.volume = Math.min(savedVolume, 100) / 100;
+      if (voiceStore.getState().localDeafened) audioEl.muted = true;
+      const savedOutput = loadPref<string>("audioOutputDevice", "");
+      if (savedOutput !== "" && typeof audioEl.setSinkId === "function") {
+        audioEl.setSinkId(savedOutput).catch((err) => {
+          log.warn("Failed to set output device on remote audio", err);
+        });
       }
-    }
-  }
-  // Also mute/unmute audio elements directly for immediate effect
-  for (const el of audioElements.values()) {
-    el.muted = deafened;
-  }
-  log.debug("Deafen state changed", { deafened });
-}
-
-/** Enable camera: publish video track, notify server. */
-export async function enableCamera(): Promise<void> {
-  if (room === null || ws === null) {
-    log.warn("Cannot enable camera: no active voice session");
-    onErrorCallback?.("Join a voice channel first");
-    return;
-  }
-
-  // Optimistic UI update — highlight button immediately
-  setLocalCamera(true);
-
-  try {
-    await room.localParticipant.setCameraEnabled(true);
-
-    // Apply saved video device
-    const savedVideoDevice = loadPref<string>("videoInputDevice", "");
-    if (savedVideoDevice) {
-      await room.switchActiveDevice("videoinput", savedVideoDevice);
-    }
-
-    ws.send({ type: "voice_camera", payload: { enabled: true } });
-    log.info("Camera enabled");
-  } catch (err) {
-    // Revert optimistic update on failure
-    setLocalCamera(false);
-    log.error("Failed to enable camera", err);
-    if (err instanceof DOMException && err.name === "NotAllowedError") {
-      onErrorCallback?.("Camera permission denied");
-    } else if (err instanceof DOMException && err.name === "NotFoundError") {
-      onErrorCallback?.("No camera found");
-    } else {
-      onErrorCallback?.("Failed to start camera");
-    }
-  }
-}
-
-/** Disable camera: unpublish video track, notify server. */
-export async function disableCamera(): Promise<void> {
-  if (room !== null) {
-    await room.localParticipant.setCameraEnabled(false);
-  }
-
-  setLocalCamera(false);
-  if (ws !== null) {
-    ws.send({ type: "voice_camera", payload: { enabled: false } });
-  }
-  log.info("Camera disabled");
-}
-
-/** Switch the input (microphone) device on an active session. */
-export async function switchInputDevice(deviceId: string): Promise<void> {
-  if (room === null) {
-    log.debug("Skipping input device switch — no active voice session");
-    return;
-  }
-
-  try {
-    const enhancedNS = loadPref<boolean>("enhancedNoiseSuppression", false);
-    if (enhancedNS && noiseSuppressor !== null) {
-      // Need to re-acquire mic and re-process through RNNoise
-      // Stop old raw stream
-      if (rawMicStream !== null) {
-        for (const track of rawMicStream.getTracks()) {
-          track.stop();
-        }
-        rawMicStream = null;
+      container.appendChild(audioEl);
+      const trackKey = `${participant.identity}-${track.sid}`;
+      this.audioElements.set(trackKey, audioEl);
+      if (userId > 0) this.addRemoteAnalyser(userId, track.mediaStreamTrack);
+      log.debug("Remote audio track subscribed", { userId, trackSid: track.sid });
+    } else if (track.kind === Track.Kind.Video) {
+      if (userId > 0 && this.onRemoteVideoCallback !== null) {
+        const stream = new MediaStream([track.mediaStreamTrack]);
+        this.onRemoteVideoCallback(userId, stream);
       }
-      noiseSuppressor.destroy();
-      noiseSuppressor = null;
+      log.debug("Remote video track subscribed", { userId, trackSid: track.sid });
+    }
+  };
 
-      // Unpublish current mic track
-      for (const pub of room.localParticipant.audioTrackPublications.values()) {
-        if (pub.source === Track.Source.Microphone && pub.track) {
-          await room.localParticipant.unpublishTrack(pub.track);
+  private handleTrackUnsubscribed = (
+    track: RemoteTrack,
+    _publication: RemoteTrackPublication,
+    participant: RemoteParticipant,
+  ): void => {
+    const userId = parseUserId(participant.identity);
+    if (track.kind === Track.Kind.Audio) {
+      track.detach().forEach((el) => el.remove());
+      const trackKey = `${participant.identity}-${track.sid}`;
+      this.audioElements.delete(trackKey);
+      if (userId > 0) this.removeRemoteAnalyser(userId);
+      log.debug("Remote audio track unsubscribed", { userId, trackSid: track.sid });
+    } else if (track.kind === Track.Kind.Video) {
+      track.detach();
+      if (userId > 0) this.onRemoteVideoRemovedCallback?.(userId);
+      log.debug("Remote video track unsubscribed", { userId, trackSid: track.sid });
+    }
+  };
+
+  // --- Remote audio analysers ---
+
+  private addRemoteAnalyser(userId: number, mediaTrack: MediaStreamTrack): void {
+    this.removeRemoteAnalyser(userId);
+    try {
+      const ctx = this.getSharedAudioCtx();
+      const analyser = ctx.createAnalyser();
+      analyser.fftSize = 256;
+      analyser.smoothingTimeConstant = 0.5;
+      const stream = new MediaStream([mediaTrack]);
+      const source = ctx.createMediaStreamSource(stream);
+      source.connect(analyser);
+      this.remoteAnalysers.set(userId, { analyser, source, data: new Uint8Array(128) as Uint8Array<ArrayBuffer> });
+    } catch (err) {
+      log.warn("Failed to create remote analyser", { userId, error: err });
+    }
+  }
+
+  private removeRemoteAnalyser(userId: number): void {
+    const ra = this.remoteAnalysers.get(userId);
+    if (ra) {
+      ra.source.disconnect();
+      ra.analyser.disconnect();
+      this.remoteAnalysers.delete(userId);
+    }
+  }
+
+  private cleanupAllRemoteAnalysers(): void {
+    for (const [id] of this.remoteAnalysers) this.removeRemoteAnalyser(id);
+  }
+
+  // --- Local mic analyser ---
+
+  private startLocalAnalyser(): void {
+    this.stopLocalAnalyser();
+    if (this.room === null) return;
+    const micPub = this.room.localParticipant.getTrackPublication(Track.Source.Microphone);
+    const mediaTrack = micPub?.track?.mediaStreamTrack;
+    if (!mediaTrack) return;
+    try {
+      const ctx = this.getSharedAudioCtx();
+      this.localAnalyser = ctx.createAnalyser();
+      this.localAnalyser.fftSize = 256;
+      this.localAnalyser.smoothingTimeConstant = 0.5;
+      this.localAnalyserClonedTrack = mediaTrack.clone();
+      const stream = new MediaStream([this.localAnalyserClonedTrack]);
+      this.localAnalyserSource = ctx.createMediaStreamSource(stream);
+      this.localAnalyserSource.connect(this.localAnalyser);
+      log.debug("Local mic analyser started");
+    } catch (err) {
+      log.warn("Failed to start local mic analyser", err);
+    }
+  }
+
+  private stopLocalAnalyser(): void {
+    if (this.localAnalyserSource !== null) {
+      this.localAnalyserSource.disconnect();
+      this.localAnalyserSource = null;
+    }
+    if (this.localAnalyser !== null) {
+      this.localAnalyser.disconnect();
+      this.localAnalyser = null;
+    }
+    if (this.localAnalyserClonedTrack !== null) {
+      this.localAnalyserClonedTrack.stop();
+      this.localAnalyserClonedTrack = null;
+    }
+  }
+
+  // --- Speaking poll ---
+
+  private startSpeakingPoll(): void {
+    this.stopSpeakingPoll();
+    this.localMicGated = false;
+    this.previousSpeakerIds = [];
+    this.speakingPollInterval = setInterval(() => {
+      if (this.room === null || this.currentChannelId === null) return;
+      const speakerIds: number[] = [];
+      let localLevel = 0;
+      if (this.localAnalyser !== null) {
+        this.localAnalyser.getByteFrequencyData(this.localAnalyserData);
+        localLevel = computeRms(this.localAnalyserData);
+      }
+      const localSpeaking = localLevel > this.speakingThreshold;
+      const micPub = this.room.localParticipant.getTrackPublication(Track.Source.Microphone);
+      if (micPub?.track?.mediaStreamTrack) {
+        if (localSpeaking && this.localMicGated) {
+          micPub.track.mediaStreamTrack.enabled = true;
+          this.localMicGated = false;
+        } else if (!localSpeaking && !this.localMicGated) {
+          micPub.track.mediaStreamTrack.enabled = false;
+          this.localMicGated = true;
         }
       }
-
-      // Re-publish with new device
-      await publishWithNoiseSuppression();
-    } else {
-      // Empty deviceId means "use system default" — skip switchActiveDevice
-      // (it throws on empty string). Re-enable mic via LiveKit's native capture.
-      if (deviceId) {
-        await room.switchActiveDevice("audioinput", deviceId);
-      } else {
-        await room.localParticipant.setMicrophoneEnabled(false);
-        await room.localParticipant.setMicrophoneEnabled(true);
+      if (localSpeaking) {
+        const localId = parseUserId(this.room.localParticipant.identity);
+        if (localId > 0) speakerIds.push(localId);
       }
+      for (const [userId, ra] of this.remoteAnalysers) {
+        ra.analyser.getByteFrequencyData(ra.data);
+        if (computeRms(ra.data) > this.speakingThreshold) speakerIds.push(userId);
+      }
+      // Sort in place so speakerSetsEqual can compare without allocations.
+      speakerIds.sort((x, y) => x - y);
+      if (!speakerSetsEqual(speakerIds, this.previousSpeakerIds)) {
+        this.previousSpeakerIds = speakerIds; // already a fresh array each tick
+        setSpeakers({ channel_id: this.currentChannelId, speakers: speakerIds });
+      }
+    }, 100);
+  }
+
+  private stopSpeakingPoll(): void {
+    if (this.speakingPollInterval !== null) {
+      clearInterval(this.speakingPollInterval);
+      this.speakingPollInterval = null;
     }
-    log.info("Switched input device", { deviceId });
-  } catch (err) {
-    log.error("Failed to switch input device", err);
-    onErrorCallback?.("Failed to switch microphone");
-  }
-}
-
-/** Switch the output (speaker) device on an active session. */
-export async function switchOutputDevice(deviceId: string): Promise<void> {
-  if (room !== null) {
-    await room.switchActiveDevice("audiooutput", deviceId);
+    this.stopLocalAnalyser();
+    this.cleanupAllRemoteAnalysers();
+    this.previousSpeakerIds = [];
   }
 
-  // Also update any existing audio elements
-  for (const el of audioElements.values()) {
-    if (typeof el.setSinkId === "function") {
+  private handleDisconnected = (reason?: DisconnectReason): void => {
+    log.info("LiveKit room disconnected", { reason });
+    const isUnexpected = reason !== DisconnectReason.CLIENT_INITIATED;
+    this.leaveVoice(false);
+    if (isUnexpected) this.onErrorCallback?.("Voice connection lost — disconnected");
+  };
+
+  // --- URL resolution ---
+
+  private resolveLiveKitUrl(proxyPath: string, directUrl?: string): string {
+    if (this.serverHost !== null) {
+      const host = this.serverHost.split(":")[0] ?? "";
+      const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
+      if (isLocal && directUrl) return directUrl;
+      if (proxyPath.startsWith("/")) return `wss://${this.serverHost}${proxyPath}`;
+    }
+    return proxyPath;
+  }
+
+  // --- Token refresh ---
+
+  /** Token refresh interval: 3.5 hours (refresh 30min before 4h TTL expiry). */
+  private static readonly TOKEN_REFRESH_MS = 3.5 * 60 * 60 * 1000;
+
+  private startTokenRefreshTimer(): void {
+    this.clearTokenRefreshTimer();
+    this.tokenRefreshTimer = setTimeout(() => {
+      this.requestTokenRefresh();
+    }, LiveKitSession.TOKEN_REFRESH_MS);
+    log.debug("Token refresh timer started", { refreshInMs: LiveKitSession.TOKEN_REFRESH_MS });
+  }
+
+  private clearTokenRefreshTimer(): void {
+    if (this.tokenRefreshTimer !== null) {
+      clearTimeout(this.tokenRefreshTimer);
+      this.tokenRefreshTimer = null;
+    }
+  }
+
+  private requestTokenRefresh(): void {
+    if (this.ws === null || this.room === null) {
+      log.debug("Skipping token refresh — no active session");
+      return;
+    }
+    log.info("Requesting voice token refresh");
+    this.ws.send({ type: "voice_token_refresh", payload: {} });
+    // Re-arm as fallback in case the server doesn't respond (network hiccup,
+    // restart). If the server does respond, handleVoiceTokenRefresh restarts
+    // the timer, superseding this one.
+    this.startTokenRefreshTimer();
+  }
+
+  /**
+   * Handle a voice_token message that is a refresh (room already connected).
+   * LiveKit tokens are validated at connect time only — the existing connection
+   * stays alive regardless of token expiry. We just restart the refresh timer
+   * so we keep requesting fresh tokens periodically.
+   */
+  handleVoiceTokenRefresh(): void {
+    this.startTokenRefreshTimer();
+    log.info("Voice token refreshed, timer restarted");
+  }
+
+  // --- Public API ---
+
+  setWsClient(client: WsClient): void { this.ws = client; }
+  setServerHost(host: string): void { this.serverHost = host; }
+  setOnError(cb: (message: string) => void): void { this.onErrorCallback = cb; }
+  clearOnError(): void { this.onErrorCallback = null; }
+  setOnRemoteVideo(cb: RemoteVideoCallback): void { this.onRemoteVideoCallback = cb; }
+  setOnRemoteVideoRemoved(cb: RemoteVideoRemovedCallback): void { this.onRemoteVideoRemovedCallback = cb; }
+
+  clearOnRemoteVideo(): void {
+    this.onRemoteVideoCallback = null;
+    this.onRemoteVideoRemovedCallback = null;
+  }
+
+  async handleVoiceToken(
+    token: string, url: string, channelId: number, directUrl?: string,
+  ): Promise<void> {
+    // If already connected to the same channel, this is a token refresh response.
+    // LiveKit validates tokens only at connect time, so just restart the timer.
+    // Guard on room.state to avoid treating a mid-retry token as a refresh.
+    if (this.room !== null && this.currentChannelId === channelId
+        && this.room.state === "connected") {
+      this.handleVoiceTokenRefresh();
+      return;
+    }
+    if (this.room !== null) this.leaveVoice(false);
+    try {
+      this.room = this.createRoom();
+      const resolvedUrl = this.resolveLiveKitUrl(url, directUrl);
+      const MAX_RETRIES = 3;
+      const RETRY_DELAY_MS = 2000;
+      for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+        try {
+          await this.room.connect(resolvedUrl, token);
+          break;
+        } catch (connectErr) {
+          if (attempt < MAX_RETRIES) {
+            log.warn("LiveKit connect failed, retrying", { attempt, maxRetries: MAX_RETRIES, error: connectErr });
+            await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+            if (this.room === null) throw connectErr;
+            this.room.removeAllListeners();
+            this.room = this.createRoom();
+          } else {
+            throw connectErr;
+          }
+        }
+      }
+      log.info("Connected to LiveKit room", { channelId, url: resolvedUrl });
+      this.speakingThreshold = ((100 - loadPref<number>("voiceSensitivity", 50)) / 100) * 0.15;
+      this.startSpeakingPoll();
+      const enhancedNS = loadPref<boolean>("enhancedNoiseSuppression", false);
       try {
-        await el.setSinkId(deviceId);
-      } catch (err) {
-        log.warn("Failed to set output device on audio element", err);
+        if (enhancedNS) {
+          await this.publishWithNoiseSuppression();
+          log.info("Published mic with RNNoise noise suppression");
+        } else {
+          await this.room.localParticipant.setMicrophoneEnabled(true);
+          log.info("Published mic via LiveKit native capture");
+        }
+      } catch (micErr) {
+        if (micErr instanceof DOMException && micErr.name === "NotAllowedError") {
+          log.warn("Microphone permission denied — joined in listen-only mode");
+          this.onErrorCallback?.("Microphone permission denied — joined in listen-only mode");
+        } else if (micErr instanceof DOMException && micErr.name === "NotFoundError") {
+          log.warn("No microphone found — joined in listen-only mode");
+          this.onErrorCallback?.("No microphone found — joined in listen-only mode");
+        } else {
+          log.warn("Microphone unavailable — joined in listen-only mode", micErr);
+          this.onErrorCallback?.("Microphone unavailable — joined in listen-only mode");
+        }
+      }
+      const savedInput = loadPref<string>("audioInputDevice", "");
+      if (savedInput) await this.room.switchActiveDevice("audioinput", savedInput);
+      const savedOutput = loadPref<string>("audioOutputDevice", "");
+      if (savedOutput) await this.room.switchActiveDevice("audiooutput", savedOutput);
+      this.currentChannelId = channelId;
+      this.startLocalAnalyser();
+      this.startTokenRefreshTimer();
+      log.info("Voice session active", { channelId });
+    } catch (err) {
+      log.error("Failed to connect to LiveKit", err);
+      if (this.room !== null) {
+        this.onErrorCallback?.("Failed to join voice — connection error");
+      }
+      this.leaveVoice(false);
+    }
+  }
+
+  leaveVoice(sendWs = true): void {
+    this.clearTokenRefreshTimer();
+    if (sendWs && this.ws !== null) {
+      this.ws.send({ type: "voice_leave", payload: {} });
+    }
+    if (this.rawMicStream !== null) {
+      for (const track of this.rawMicStream.getTracks()) track.stop();
+      this.rawMicStream = null;
+    }
+    if (this.noiseSuppressor !== null) {
+      this.noiseSuppressor.destroy();
+      this.noiseSuppressor = null;
+    }
+    this.stopSpeakingPoll();
+    if (this.room !== null) {
+      const r = this.room;
+      this.room = null;
+      r.removeAllListeners();
+      r.disconnect().catch((err) => log.warn("room.disconnect() error (non-fatal)", err));
+    }
+    this.cleanupAudioElements();
+    this.closeSharedAudioCtx();
+    this.currentChannelId = null;
+    log.info("Left voice session");
+  }
+
+  cleanupAll(): void {
+    this.leaveVoice(false);
+    this.onErrorCallback = null;
+    this.onRemoteVideoCallback = null;
+    this.onRemoteVideoRemovedCallback = null;
+    this.ws = null;
+    this.serverHost = null;
+  }
+
+  setMuted(muted: boolean): void {
+    setLocalMuted(muted);
+    if (this.room !== null) void this.room.localParticipant.setMicrophoneEnabled(!muted);
+  }
+
+  setDeafened(deafened: boolean): void {
+    setLocalDeafened(deafened);
+    if (this.room !== null) {
+      for (const participant of this.room.remoteParticipants.values()) {
+        for (const pub of participant.audioTrackPublications.values()) pub.setSubscribed(!deafened);
+      }
+    }
+    for (const el of this.audioElements.values()) el.muted = deafened;
+    log.debug("Deafen state changed", { deafened });
+  }
+
+  async enableCamera(): Promise<void> {
+    if (this.room === null || this.ws === null) {
+      log.warn("Cannot enable camera: no active voice session");
+      this.onErrorCallback?.("Join a voice channel first");
+      return;
+    }
+    setLocalCamera(true);
+    try {
+      await this.room.localParticipant.setCameraEnabled(true);
+      const savedVideoDevice = loadPref<string>("videoInputDevice", "");
+      if (savedVideoDevice) await this.room.switchActiveDevice("videoinput", savedVideoDevice);
+      this.ws.send({ type: "voice_camera", payload: { enabled: true } });
+      log.info("Camera enabled");
+    } catch (err) {
+      setLocalCamera(false);
+      log.error("Failed to enable camera", err);
+      if (err instanceof DOMException && err.name === "NotAllowedError") {
+        this.onErrorCallback?.("Camera permission denied");
+      } else if (err instanceof DOMException && err.name === "NotFoundError") {
+        this.onErrorCallback?.("No camera found");
+      } else {
+        this.onErrorCallback?.("Failed to start camera");
       }
     }
   }
-  log.info("Switched output device", { deviceId });
-}
 
-/**
- * Set per-user volume (0-200%). Persisted to localStorage.
- * Note: HTMLAudioElement.volume only supports 0.0-1.0, so volumes above
- * 100% are clamped.
- */
-export function setUserVolume(userId: number, volume: number): void {
-  const clamped = Math.max(0, Math.min(200, volume));
-  savePref(`userVolume_${userId}`, clamped);
+  async disableCamera(): Promise<void> {
+    try {
+      if (this.room !== null) await this.room.localParticipant.setCameraEnabled(false);
+    } catch (err) {
+      log.warn("Failed to disable camera track (non-fatal)", err);
+    } finally {
+      setLocalCamera(false);
+      if (this.ws !== null) this.ws.send({ type: "voice_camera", payload: { enabled: false } });
+      log.info("Camera disabled");
+    }
+  }
 
-  // Find audio elements for this user's tracks
-  if (room !== null) {
-    for (const participant of room.remoteParticipants.values()) {
-      const pUserId = parseUserId(participant.identity);
-      if (pUserId === userId) {
-        for (const pub of participant.audioTrackPublications.values()) {
-          if (pub.track) {
-            const els = pub.track.attachedElements;
-            for (const el of els) {
-              if (el instanceof HTMLAudioElement) {
-                el.volume = Math.min(clamped, 100) / 100;
+  async switchInputDevice(deviceId: string): Promise<void> {
+    if (this.room === null) {
+      log.debug("Skipping input device switch — no active voice session");
+      return;
+    }
+    try {
+      const enhancedNS = loadPref<boolean>("enhancedNoiseSuppression", false);
+      if (enhancedNS && this.noiseSuppressor !== null) {
+        if (this.rawMicStream !== null) {
+          for (const track of this.rawMicStream.getTracks()) track.stop();
+          this.rawMicStream = null;
+        }
+        this.noiseSuppressor.destroy();
+        this.noiseSuppressor = null;
+        for (const pub of this.room.localParticipant.audioTrackPublications.values()) {
+          if (pub.source === Track.Source.Microphone && pub.track) {
+            await this.room.localParticipant.unpublishTrack(pub.track);
+          }
+        }
+        await this.publishWithNoiseSuppression();
+      } else {
+        if (deviceId) {
+          await this.room.switchActiveDevice("audioinput", deviceId);
+        } else {
+          await this.room.localParticipant.setMicrophoneEnabled(false);
+          await this.room.localParticipant.setMicrophoneEnabled(true);
+        }
+      }
+      log.info("Switched input device", { deviceId });
+    } catch (err) {
+      log.error("Failed to switch input device", err);
+      this.onErrorCallback?.("Failed to switch microphone");
+    }
+  }
+
+  async switchOutputDevice(deviceId: string): Promise<void> {
+    if (this.room !== null) await this.room.switchActiveDevice("audiooutput", deviceId);
+    for (const el of this.audioElements.values()) {
+      if (typeof el.setSinkId === "function") {
+        try { await el.setSinkId(deviceId); } catch (err) {
+          log.warn("Failed to set output device on audio element", err);
+        }
+      }
+    }
+    log.info("Switched output device", { deviceId });
+  }
+
+  setUserVolume(userId: number, volume: number): void {
+    const clamped = Math.max(0, Math.min(200, volume));
+    savePref(`userVolume_${userId}`, clamped);
+    if (this.room !== null) {
+      for (const participant of this.room.remoteParticipants.values()) {
+        if (parseUserId(participant.identity) === userId) {
+          for (const pub of participant.audioTrackPublications.values()) {
+            if (pub.track) {
+              for (const el of pub.track.attachedElements) {
+                if (el instanceof HTMLAudioElement) el.volume = Math.min(clamped, 100) / 100;
               }
             }
           }
@@ -787,79 +666,67 @@ export function setUserVolume(userId: number, volume: number): void {
       }
     }
   }
-}
 
-/** Get the current per-user volume (0-200%, default 100). */
-export function getUserVolume(userId: number): number {
-  return getSavedUserVolume(userId);
-}
+  getUserVolume(userId: number): number { return getSavedUserVolume(userId); }
 
-/** Update the speaking detection sensitivity threshold.
- *  High sensitivity (100) = low threshold (picks up quiet sounds).
- *  Low sensitivity (0) = high threshold (only loud sounds). */
-export function setVoiceSensitivity(sensitivity: number): void {
-  const clamped = Math.max(0, Math.min(100, sensitivity));
-  speakingThreshold = ((100 - clamped) / 100) * 0.15;
-}
-
-/** Get the local camera stream for self-view display. */
-export function getLocalCameraStream(): MediaStream | null {
-  if (room === null) return null;
-  const cameraPub = room.localParticipant.getTrackPublication(Track.Source.Camera);
-  if (cameraPub?.track?.mediaStreamTrack) {
-    return new MediaStream([cameraPub.track.mediaStreamTrack]);
-  }
-  return null;
-}
-
-/** Snapshot of current voice session state for debugging. */
-export function getSessionDebugInfo(): Record<string, unknown> {
-  if (room === null) {
-    return {
-      hasRoom: false,
-      hasNoiseSuppressor: noiseSuppressor !== null,
-      currentChannelId,
-    };
+  setVoiceSensitivity(sensitivity: number): void {
+    const clamped = Math.max(0, Math.min(100, sensitivity));
+    this.speakingThreshold = ((100 - clamped) / 100) * 0.15;
   }
 
-  const remoteParticipants: Record<string, unknown>[] = [];
-  for (const p of room.remoteParticipants.values()) {
-    const tracks: Record<string, unknown>[] = [];
-    for (const pub of p.trackPublications.values()) {
-      tracks.push({
-        sid: pub.trackSid,
-        source: pub.source,
-        kind: pub.kind,
-        subscribed: pub.isSubscribed,
-        enabled: pub.isEnabled,
-      });
+  getLocalCameraStream(): MediaStream | null {
+    if (this.room === null) return null;
+    const cameraPub = this.room.localParticipant.getTrackPublication(Track.Source.Camera);
+    if (cameraPub?.track?.mediaStreamTrack) return new MediaStream([cameraPub.track.mediaStreamTrack]);
+    return null;
+  }
+
+  getSessionDebugInfo(): Record<string, unknown> {
+    if (this.room === null) {
+      return { hasRoom: false, hasNoiseSuppressor: this.noiseSuppressor !== null, currentChannelId: this.currentChannelId };
     }
-    remoteParticipants.push({
+    const remoteParticipants = [...this.room.remoteParticipants.values()].map((p) => ({
       identity: p.identity,
       userId: parseUserId(p.identity),
-      tracks,
-    });
+      tracks: [...p.trackPublications.values()].map((pub) => ({
+        sid: pub.trackSid, source: pub.source, kind: pub.kind,
+        subscribed: pub.isSubscribed, enabled: pub.isEnabled,
+      })),
+    }));
+    const localTracks = [...this.room.localParticipant.trackPublications.values()].map((pub) => ({
+      sid: pub.trackSid, source: pub.source, kind: pub.kind, isMuted: pub.isMuted,
+    }));
+    return {
+      hasRoom: true, roomName: this.room.name, roomState: this.room.state,
+      hasNoiseSuppressor: this.noiseSuppressor !== null, currentChannelId: this.currentChannelId,
+      localParticipant: this.room.localParticipant.identity, localTracks,
+      remoteParticipants, audioElements: this.audioElements.size,
+    };
   }
-
-  const localTracks: Record<string, unknown>[] = [];
-  for (const pub of room.localParticipant.trackPublications.values()) {
-    localTracks.push({
-      sid: pub.trackSid,
-      source: pub.source,
-      kind: pub.kind,
-      isMuted: pub.isMuted,
-    });
-  }
-
-  return {
-    hasRoom: true,
-    roomName: room.name,
-    roomState: room.state,
-    hasNoiseSuppressor: noiseSuppressor !== null,
-    currentChannelId,
-    localParticipant: room.localParticipant.identity,
-    localTracks,
-    remoteParticipants,
-    audioElements: audioElements.size,
-  };
 }
+
+// --- Singleton instance + re-exported bound methods ---
+
+const session = new LiveKitSession();
+
+export const setWsClient = session.setWsClient.bind(session);
+export const setServerHost = session.setServerHost.bind(session);
+export const setOnError = session.setOnError.bind(session);
+export const clearOnError = session.clearOnError.bind(session);
+export const setOnRemoteVideo = session.setOnRemoteVideo.bind(session);
+export const setOnRemoteVideoRemoved = session.setOnRemoteVideoRemoved.bind(session);
+export const clearOnRemoteVideo = session.clearOnRemoteVideo.bind(session);
+export const handleVoiceToken = session.handleVoiceToken.bind(session);
+export const leaveVoice = session.leaveVoice.bind(session);
+export const cleanupAll = session.cleanupAll.bind(session);
+export const setMuted = session.setMuted.bind(session);
+export const setDeafened = session.setDeafened.bind(session);
+export const enableCamera = session.enableCamera.bind(session);
+export const disableCamera = session.disableCamera.bind(session);
+export const switchInputDevice = session.switchInputDevice.bind(session);
+export const switchOutputDevice = session.switchOutputDevice.bind(session);
+export const setUserVolume = session.setUserVolume.bind(session);
+export const getUserVolume = session.getUserVolume.bind(session);
+export const setVoiceSensitivity = session.setVoiceSensitivity.bind(session);
+export const getLocalCameraStream = session.getLocalCameraStream.bind(session);
+export const getSessionDebugInfo = session.getSessionDebugInfo.bind(session);
diff --git a/Client/tauri-client/src/lib/types.ts b/Client/tauri-client/src/lib/types.ts
index 32544b5e..ac5e3f9d 100644
--- a/Client/tauri-client/src/lib/types.ts
+++ b/Client/tauri-client/src/lib/types.ts
@@ -430,7 +430,8 @@ export type ClientMessage =
   | (WsEnvelope<VoiceDeafenPayload> & { readonly type: "voice_deafen" })
   | (WsEnvelope<VoiceCameraPayload> & { readonly type: "voice_camera" })
   | (WsEnvelope<VoiceScreensharePayload> & { readonly type: "voice_screenshare" })
-  | (WsEnvelope<SoundboardPlayPayload> & { readonly type: "soundboard_play" });
+  | (WsEnvelope<SoundboardPlayPayload> & { readonly type: "soundboard_play" })
+  | (WsEnvelope<Record<string, never>> & { readonly type: "voice_token_refresh" });
 
 // -----------------------------------------------------------------------------
 // REST API Response Types
diff --git a/Client/tauri-client/src/lib/ws.ts b/Client/tauri-client/src/lib/ws.ts
index ed26be75..15cd1f1c 100644
--- a/Client/tauri-client/src/lib/ws.ts
+++ b/Client/tauri-client/src/lib/ws.ts
@@ -96,7 +96,11 @@ export function createWsClient() {
     if (state !== newState) {
       state = newState;
       for (const listener of stateListeners) {
-        listener(state);
+        try {
+          listener(state);
+        } catch (err) {
+          log.error("State listener error", err);
+        }
       }
     }
   }
diff --git a/Client/tauri-client/src/pages/MainPage.ts b/Client/tauri-client/src/pages/MainPage.ts
index 875a3ef5..04122f16 100644
--- a/Client/tauri-client/src/pages/MainPage.ts
+++ b/Client/tauri-client/src/pages/MainPage.ts
@@ -20,6 +20,7 @@ import { channelsStore, getActiveChannel } from "@stores/channels.store";
 import { voiceStore } from "@stores/voice.store";
 import {
   leaveVoice as voiceSessionLeave,
+  cleanupAll as voiceCleanupAll,
   setOnRemoteVideo,
   setOnRemoteVideoRemoved,
   clearOnRemoteVideo,
@@ -126,19 +127,27 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
 
     unsubscribers.push(
       ws.onStateChange((wsState) => {
-        if (banner === null) return;
-        if (wsState === "reconnecting") {
-          banner.showReconnecting();
-        } else if (wsState === "connected") {
-          banner.hide();
+        try {
+          if (banner === null) return;
+          if (wsState === "reconnecting") {
+            banner.showReconnecting();
+          } else if (wsState === "connected") {
+            banner.hide();
+          }
+        } catch (err) {
+          log.error("State change handler error", err);
         }
       }),
     );
 
     unsubscribers.push(
       ws.on("server_restart", (payload) => {
-        if (banner !== null) {
-          banner.showRestart(payload.delay_seconds);
+        try {
+          if (banner !== null) {
+            banner.showRestart(payload.delay_seconds);
+          }
+        } catch (err) {
+          log.error("Server restart handler error", err);
         }
       }),
     );
@@ -279,21 +288,25 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     let prevLocalCamera = voiceStore.getState().localCamera;
     let prevCameraSignature = "";
     unsubscribers.push(voiceStore.subscribe((state) => {
-      // Build a lightweight signature of camera-relevant state
-      let sig = state.localCamera ? "1" : "0";
-      const channelId = state.currentChannelId;
-      if (channelId !== null) {
-        const users = state.voiceUsers.get(channelId);
-        if (users) {
-          for (const [uid, u] of users) {
-            if (u.camera) sig += `:${uid}`;
+      try {
+        // Build a lightweight signature of camera-relevant state
+        let sig = state.localCamera ? "1" : "0";
+        const channelId = state.currentChannelId;
+        if (channelId !== null) {
+          const users = state.voiceUsers.get(channelId);
+          if (users) {
+            for (const [uid, u] of users) {
+              if (u.camera) sig += `:${uid}`;
+            }
           }
         }
-      }
-      if (sig !== prevCameraSignature || state.localCamera !== prevLocalCamera) {
-        prevCameraSignature = sig;
-        prevLocalCamera = state.localCamera;
-        videoModeCtrl?.checkVideoMode();
+        if (sig !== prevCameraSignature || state.localCamera !== prevLocalCamera) {
+          prevCameraSignature = sig;
+          prevLocalCamera = state.localCamera;
+          videoModeCtrl?.checkVideoMode();
+        }
+      } catch (err) {
+        log.error("Voice store subscription error", err);
       }
     }));
 
@@ -327,42 +340,50 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
 
   function destroy(): void {
     log.info("MainPage destroying");
-    // Clean up voice session before destroying UI — prevents stale
-    // module-level state persisting across logout/reconnect cycles.
-    voiceSessionLeave(false);
-    clearVoiceOnError();
-    clearOnRemoteVideo();
-    channelCtrl?.destroyChannel();
-    channelCtrl = null;
+    try {
+      // Full voice cleanup — tears down room, callbacks, ws ref, serverHost.
+      // Prevents stale module-level state persisting across logout/reconnect cycles.
+      voiceCleanupAll();
+      channelCtrl?.destroyChannel();
+      channelCtrl = null;
 
-    reactionCtrl?.destroy();
-    reactionCtrl = null;
-    msgCtrl = null;
-    videoModeCtrl?.destroy();
-    videoModeCtrl = null;
+      reactionCtrl?.destroy();
+      reactionCtrl = null;
+      msgCtrl = null;
+      videoModeCtrl?.destroy();
+      videoModeCtrl = null;
 
-    videoGrid = null;
+      videoGrid = null;
 
-    for (const child of children) {
-      child.destroy?.();
+      for (const child of children) {
+        try {
+          child.destroy?.();
+        } catch (err) {
+          log.error("Child destroy error", err);
+        }
+      }
+      children = [];
+
+      for (const unsub of unsubscribers) {
+        try {
+          unsub();
+        } catch (err) {
+          log.error("Unsubscribe error", err);
+        }
+      }
+      unsubscribers = [];
+
+      if (banner !== null) {
+        banner.destroy();
+        banner = null;
+      }
+    } finally {
+      if (root !== null) {
+        root.remove();
+        root = null;
+      }
+      container = null;
     }
-    children = [];
-
-    for (const unsub of unsubscribers) {
-      unsub();
-    }
-    unsubscribers = [];
-
-    if (banner !== null) {
-      banner.destroy();
-      banner = null;
-    }
-
-    if (root !== null) {
-      root.remove();
-      root = null;
-    }
-    container = null;
   }
 
   return { mount, destroy };
diff --git a/Client/tauri-client/src/pages/main-page/ChatArea.ts b/Client/tauri-client/src/pages/main-page/ChatArea.ts
index c9ccf7aa..1182fae9 100644
--- a/Client/tauri-client/src/pages/main-page/ChatArea.ts
+++ b/Client/tauri-client/src/pages/main-page/ChatArea.ts
@@ -74,7 +74,7 @@ export function createChatArea(opts: ChatAreaOptions): ChatAreaResult {
     getCurrentChannelId: () => getChannelCtrl()?.currentChannelId ?? null,
     onJumpToMessage: (msgId: number) => {
       const ctrl = getChannelCtrl();
-      if (ctrl?.messageList === null || ctrl?.messageList === undefined) return false;
+      if (ctrl == null || ctrl.messageList == null) return false;
       return ctrl.messageList.scrollToMessage(msgId);
     },
   });
@@ -87,7 +87,7 @@ export function createChatArea(opts: ChatAreaOptions): ChatAreaResult {
     getCurrentChannelId: () => getChannelCtrl()?.currentChannelId ?? null,
     onJumpToMessage: (_channelId: number, msgId: number) => {
       const ctrl = getChannelCtrl();
-      if (ctrl?.messageList === null || ctrl?.messageList === undefined) return false;
+      if (ctrl == null || ctrl.messageList == null) return false;
       return ctrl.messageList.scrollToMessage(msgId);
     },
   });
diff --git a/Server/api/livekit_proxy.go b/Server/api/livekit_proxy.go
index 62c2b027..b21b7063 100644
--- a/Server/api/livekit_proxy.go
+++ b/Server/api/livekit_proxy.go
@@ -19,7 +19,7 @@ import (
 //
 // The client connects to wss://server:8443/livekit/ which is proxied to
 // ws://localhost:7880/ on the LiveKit server.
-func NewLiveKitProxy(livekitURL string) http.Handler {
+func NewLiveKitProxy(livekitURL string, allowedOrigins []string) http.Handler {
 	target, err := url.Parse(livekitURL)
 	if err != nil {
 		target, _ = url.Parse("http://localhost:7880")
@@ -54,7 +54,7 @@ func NewLiveKitProxy(livekitURL string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Detect WebSocket upgrade requests.
 		if isWebSocketUpgrade(r) {
-			proxyWebSocket(w, r, &wsTarget)
+			proxyWebSocket(w, r, &wsTarget, allowedOrigins)
 			return
 		}
 		httpProxy.ServeHTTP(w, r)
@@ -72,7 +72,7 @@ func isWebSocketUpgrade(r *http.Request) bool {
 
 // proxyWebSocket opens a backend WS connection and shovels data in both
 // directions until either side closes.
-func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL) {
+func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL, allowedOrigins []string) {
 	// Build backend URL preserving the request path and query.
 	backendURL := *target
 	backendURL.Path = r.URL.Path
@@ -83,7 +83,7 @@ func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL) {
 		Subprotocols: r.Header.Values("Sec-WebSocket-Protocol"),
 	})
 	if err != nil {
-		slog.Warn("livekit proxy: backend dial failed", "url", backendURL.String(), "err", err)
+		slog.Warn("livekit proxy: backend dial failed", "host", backendURL.Host, "path", backendURL.Path, "err", err)
 		http.Error(w, "backend unavailable", http.StatusBadGateway)
 		return
 	}
@@ -92,7 +92,7 @@ func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL) {
 	// Accept the frontend WebSocket.
 	frontConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
 		Subprotocols:   []string{backConn.Subprotocol()},
-		OriginPatterns: []string{"*"},
+		OriginPatterns: allowedOrigins,
 	})
 	if err != nil {
 		slog.Warn("livekit proxy: frontend accept failed", "err", err)
@@ -100,7 +100,11 @@ func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL) {
 	}
 	defer frontConn.Close(websocket.StatusNormalClosure, "")
 
-	ctx := r.Context()
+	// Use a cancellable context so when one direction finishes, the other
+	// goroutine's copyWS read/write is unblocked and can drain cleanly.
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
 	errc := make(chan error, 2)
 
 	// Frontend → Backend
@@ -113,7 +117,9 @@ func proxyWebSocket(w http.ResponseWriter, r *http.Request, target *url.URL) {
 		errc <- copyWS(ctx, frontConn, backConn)
 	}()
 
-	// Wait for either direction to finish.
+	// Wait for either direction to finish, then cancel+drain both.
+	<-errc
+	cancel()
 	<-errc
 }
 
diff --git a/Server/api/router.go b/Server/api/router.go
index b15e58e4..15b5e50d 100644
--- a/Server/api/router.go
+++ b/Server/api/router.go
@@ -89,10 +89,14 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 		r.Post("/api/v1/livekit/webhook",
 			ws.MountWebhookRoute(hub, cfg.Voice.LiveKitAPIKey, cfg.Voice.LiveKitAPISecret))
 
+		// LiveKit health check — admin-IP-restricted.
+		r.With(AdminIPRestrict(cfg.Server.AdminAllowedCIDRs)).
+			Get("/api/v1/livekit/health", handleLiveKitHealth(hub))
+
 		// Reverse proxy LiveKit signaling through OwnCord's HTTPS server.
 		// This avoids mixed-content blocks (secure page → insecure WS).
 		// Client connects to wss://server:8443/livekit/* → ws://localhost:7880/*
-		r.Handle("/livekit/*", http.StripPrefix("/livekit", NewLiveKitProxy(cfg.Voice.LiveKitURL)))
+		r.Handle("/livekit/*", http.StripPrefix("/livekit", NewLiveKitProxy(cfg.Voice.LiveKitURL, cfg.Server.AllowedOrigins)))
 	}
 
 	go hub.Run()
@@ -152,6 +156,36 @@ func handleInfo(cfg *config.Config, ver string) http.HandlerFunc {
 	}
 }
 
+// livekitHealthResponse is the JSON shape returned by GET /api/v1/livekit/health.
+type livekitHealthResponse struct {
+	Status           string `json:"status"`
+	LiveKitReachable bool   `json:"livekit_reachable"`
+	Error            string `json:"error,omitempty"`
+}
+
+func handleLiveKitHealth(hub *ws.Hub) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ok, err := hub.LiveKitHealthCheck()
+		if ok {
+			writeJSON(w, http.StatusOK, livekitHealthResponse{
+				Status:           "ok",
+				LiveKitReachable: true,
+			})
+			return
+		}
+
+		errMsg := "unknown"
+		if err != nil {
+			errMsg = err.Error()
+		}
+		writeJSON(w, http.StatusServiceUnavailable, livekitHealthResponse{
+			Status:           "degraded",
+			LiveKitReachable: false,
+			Error:            errMsg,
+		})
+	}
+}
+
 // setRequestIDHeader copies the request ID from context into the response header.
 func setRequestIDHeader(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/Server/db/voice_queries.go b/Server/db/voice_queries.go
index 31b5a00f..b2e94dec 100644
--- a/Server/db/voice_queries.go
+++ b/Server/db/voice_queries.go
@@ -170,6 +170,21 @@ func (d *DB) ClearAllVoiceStates() error {
 	return nil
 }
 
+// CountActiveCameras returns the number of users with camera enabled in the
+// given voice channel. Uses the DB as source of truth (race-free via SQLite
+// serialization) rather than querying LiveKit.
+func (d *DB) CountActiveCameras(channelID int64) (int, error) {
+	var count int
+	err := d.sqlDB.QueryRow(
+		`SELECT COUNT(*) FROM voice_states WHERE channel_id = ? AND camera = 1`,
+		channelID,
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("CountActiveCameras: %w", err)
+	}
+	return count, nil
+}
+
 // UpdateVoiceCamera sets the camera field for the given user's voice state.
 func (d *DB) UpdateVoiceCamera(userID int64, camera bool) error {
 	_, err := d.sqlDB.Exec(
diff --git a/Server/main.go b/Server/main.go
index 2b77610f..bdcfb67a 100644
--- a/Server/main.go
+++ b/Server/main.go
@@ -48,7 +48,10 @@ func main() {
 // run is the real entrypoint — separated for testability.
 func run(log *slog.Logger, logBuf *admin.RingBuffer) error {
 	// Clean up old binary from a previous update.
-	if exePath, err := os.Executable(); err == nil {
+	exePath, exeErr := os.Executable()
+	if exeErr != nil {
+		log.Warn("failed to determine executable path", "error", exeErr)
+	} else {
 		oldPath := exePath + ".old"
 		if _, statErr := os.Stat(oldPath); statErr == nil {
 			if rmErr := os.Remove(oldPath); rmErr != nil {
@@ -148,11 +151,23 @@ func run(log *slog.Logger, logBuf *admin.RingBuffer) error {
 	go func() {
 		ticker := time.NewTicker(15 * time.Minute)
 		defer ticker.Stop()
+		consecutiveFailures := 0
+		const maxConsecutiveFailures = 5
 		for {
 			select {
 			case <-ticker.C:
+				if consecutiveFailures >= maxConsecutiveFailures {
+					log.Error("maintenance loop: circuit breaker open, skipping tick",
+						"consecutive_failures", consecutiveFailures)
+					// Reset after one skip to allow retry next tick.
+					consecutiveFailures = maxConsecutiveFailures - 1
+					continue
+				}
+
+				tickFailed := false
 				if err := database.DeleteExpiredSessions(); err != nil {
 					log.Warn("failed to delete expired sessions", "error", err)
+					tickFailed = true
 				}
 
 				// Clean up orphaned attachments (uploaded but never linked to a message).
@@ -160,6 +175,7 @@ func run(log *slog.Logger, logBuf *admin.RingBuffer) error {
 				orphanFiles, orphanErr := database.DeleteOrphanedAttachments(cutoff)
 				if orphanErr != nil {
 					log.Warn("failed to delete orphaned attachments", "error", orphanErr)
+					tickFailed = true
 				} else if len(orphanFiles) > 0 {
 					// Best-effort file cleanup.
 					if fileStorage != nil {
@@ -171,6 +187,12 @@ func run(log *slog.Logger, logBuf *admin.RingBuffer) error {
 					}
 					log.Info("cleaned up orphaned attachments", "count", len(orphanFiles))
 				}
+
+				if tickFailed {
+					consecutiveFailures++
+				} else {
+					consecutiveFailures = 0
+				}
 			case <-stopMaintenance:
 				return
 			}
diff --git a/Server/migrations/003_voice_optimization.sql b/Server/migrations/003_voice_optimization.sql
index e1b882b3..fe87a607 100644
--- a/Server/migrations/003_voice_optimization.sql
+++ b/Server/migrations/003_voice_optimization.sql
@@ -6,4 +6,4 @@ ALTER TABLE voice_states ADD COLUMN screenshare INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE channels ADD COLUMN voice_max_users INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE channels ADD COLUMN voice_quality TEXT;
 ALTER TABLE channels ADD COLUMN mixing_threshold INTEGER;
-ALTER TABLE channels ADD COLUMN voice_max_video INTEGER NOT NULL DEFAULT 10;
+ALTER TABLE channels ADD COLUMN voice_max_video INTEGER NOT NULL DEFAULT 25;
diff --git a/Server/ws/coverage_boost_test.go b/Server/ws/coverage_boost_test.go
index 5e582a60..11249cbe 100644
--- a/Server/ws/coverage_boost_test.go
+++ b/Server/ws/coverage_boost_test.go
@@ -592,6 +592,9 @@ func TestHandleVoiceMute_InvalidPayload(t *testing.T) {
 	hub.Register(c)
 	time.Sleep(20 * time.Millisecond)
 
+	// Put client in voice so the "not in voice" guard doesn't fire first.
+	ws.SetClientVoiceChID(c, 999)
+
 	raw, _ := json.Marshal(map[string]any{
 		"type":    "voice_mute",
 		"payload": "not-an-object",
@@ -613,6 +616,9 @@ func TestHandleVoiceDeafen_InvalidPayload(t *testing.T) {
 	hub.Register(c)
 	time.Sleep(20 * time.Millisecond)
 
+	// Put client in voice so the "not in voice" guard doesn't fire first.
+	ws.SetClientVoiceChID(c, 999)
+
 	raw, _ := json.Marshal(map[string]any{
 		"type":    "voice_deafen",
 		"payload": "not-an-object",
@@ -2055,3 +2061,130 @@ func TestHandleChatSend_WithNonNilAvatar(t *testing.T) {
 		t.Error("expected chat_message with non-nil avatar")
 	}
 }
+
+// ─── Webhook parse helpers ──────────────────────────────────────────────────
+
+func TestWebhookParseIdentity_Valid(t *testing.T) {
+	id, err := ws.ParseIdentityForTest("user-42")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != 42 {
+		t.Errorf("id = %d, want 42", id)
+	}
+}
+
+func TestWebhookParseIdentity_Invalid(t *testing.T) {
+	_, err := ws.ParseIdentityForTest("invalid")
+	if err == nil {
+		t.Fatal("expected error for invalid identity, got nil")
+	}
+}
+
+func TestWebhookParseRoomChannelID_Valid(t *testing.T) {
+	id, err := ws.ParseRoomChannelIDForTest("channel-5")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != 5 {
+		t.Errorf("id = %d, want 5", id)
+	}
+}
+
+func TestWebhookParseRoomChannelID_Invalid(t *testing.T) {
+	_, err := ws.ParseRoomChannelIDForTest("bad")
+	if err == nil {
+		t.Fatal("expected error for invalid room name, got nil")
+	}
+}
+
+// ─── Voice control "not in voice" guards ────────────────────────────────────
+
+func TestHandleVoiceMute_NotInVoice(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "vm-not-in-voice")
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	time.Sleep(20 * time.Millisecond)
+
+	raw, _ := json.Marshal(map[string]any{
+		"type": "voice_mute",
+		"payload": map[string]any{
+			"muted": true,
+		},
+	})
+	hub.HandleMessageForTest(c, raw)
+	time.Sleep(50 * time.Millisecond)
+
+	code := drainForErrorCode(send, 200*time.Millisecond)
+	if code != "VOICE_ERROR" {
+		t.Errorf("error code = %q, want VOICE_ERROR", code)
+	}
+}
+
+func TestHandleVoiceDeafen_NotInVoice(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "vd-not-in-voice")
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	time.Sleep(20 * time.Millisecond)
+
+	raw, _ := json.Marshal(map[string]any{
+		"type": "voice_deafen",
+		"payload": map[string]any{
+			"deafened": true,
+		},
+	})
+	hub.HandleMessageForTest(c, raw)
+	time.Sleep(50 * time.Millisecond)
+
+	code := drainForErrorCode(send, 200*time.Millisecond)
+	if code != "VOICE_ERROR" {
+		t.Errorf("error code = %q, want VOICE_ERROR", code)
+	}
+}
+
+// ─── Voice join with invalid quality fallback ───────────────────────────────
+
+func TestHandleVoiceJoin_InvalidQualityFallsBackToMedium(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "vj-badquality-user")
+
+	vcID, err := database.CreateChannel("badquality-vc", "voice", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	_, err = database.Exec("UPDATE channels SET voice_quality = 'garbage' WHERE id = ?", vcID)
+	if err != nil {
+		t.Fatalf("UPDATE: %v", err)
+	}
+
+	send := make(chan []byte, 64)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	time.Sleep(20 * time.Millisecond)
+
+	raw, _ := json.Marshal(map[string]any{
+		"type": "voice_join",
+		"payload": map[string]any{
+			"channel_id": vcID,
+		},
+	})
+	hub.HandleMessageForTest(c, raw)
+	time.Sleep(100 * time.Millisecond)
+
+	msgs := drainChanTimeout(send, 300*time.Millisecond)
+	for _, msg := range msgs {
+		var env map[string]any
+		if json.Unmarshal(msg, &env) == nil && env["type"] == "voice_config" {
+			p := env["payload"].(map[string]any)
+			if p["quality"] != "medium" {
+				t.Errorf("voice_config quality = %v, want medium", p["quality"])
+			}
+			return
+		}
+	}
+	t.Error("expected voice_config with medium quality fallback")
+}
diff --git a/Server/ws/export_test.go b/Server/ws/export_test.go
index 2357371c..ad934fc5 100644
--- a/Server/ws/export_test.go
+++ b/Server/ws/export_test.go
@@ -41,3 +41,13 @@ func ParseChannelIDForTest(payload json.RawMessage) (int64, error) {
 func BuildJSONForTest(v any) []byte {
 	return buildJSON(v)
 }
+
+// ParseIdentityForTest exposes parseIdentity for external tests.
+func ParseIdentityForTest(identity string) (int64, error) {
+	return parseIdentity(identity)
+}
+
+// ParseRoomChannelIDForTest exposes parseRoomChannelID for external tests.
+func ParseRoomChannelIDForTest(roomName string) (int64, error) {
+	return parseRoomChannelID(roomName)
+}
diff --git a/Server/ws/handlers.go b/Server/ws/handlers.go
index 4d19d285..fe516d23 100644
--- a/Server/ws/handlers.go
+++ b/Server/ws/handlers.go
@@ -121,6 +121,8 @@ func (h *Hub) handleMessage(c *Client, raw []byte) {
 		h.handleVoiceJoin(c, env.Payload)
 	case "voice_leave":
 		h.handleVoiceLeave(c)
+	case "voice_token_refresh":
+		h.handleVoiceTokenRefresh(c)
 	case "voice_mute":
 		h.handleVoiceMute(c, env.Payload)
 	case "voice_deafen":
@@ -214,7 +216,13 @@ func (h *Hub) handleChatSend(c *Client, reqID string, payload json.RawMessage) {
 	if len(p.Attachments) > 0 {
 		linked, linkErr := h.db.LinkAttachmentsToMessage(msgID, p.Attachments)
 		if linkErr != nil {
-			slog.Error("ws handleChatSend LinkAttachments", "err", linkErr)
+			slog.Error("ws handleChatSend LinkAttachments", "err", linkErr, "msg_id", msgID)
+			// Delete the orphaned message so it doesn't persist without its attachments.
+			if delErr := h.db.DeleteMessage(msgID, c.userID, true); delErr != nil {
+				slog.Error("ws handleChatSend DeleteMessage (cleanup)", "err", delErr, "msg_id", msgID)
+			}
+			c.sendMsg(buildErrorMsg(ErrCodeInternal, "failed to send message with attachments"))
+			return
 		}
 		if linked > 0 {
 			attMap, attErr := h.db.GetAttachmentsByMessageIDs([]int64{msgID})
diff --git a/Server/ws/hub.go b/Server/ws/hub.go
index 39832b82..02297b88 100644
--- a/Server/ws/hub.go
+++ b/Server/ws/hub.go
@@ -104,6 +104,17 @@ func (h *Hub) SetLiveKit(lk *LiveKitClient) {
 	h.livekit = lk
 }
 
+// LiveKitHealthCheck probes the LiveKit server for connectivity.
+// It tries the SDK client first (ListRooms), and falls back to an HTTP probe
+// if a managed process is configured. Returns false with a reason if LiveKit
+// is not configured or unreachable.
+func (h *Hub) LiveKitHealthCheck() (bool, error) {
+	if h.livekit == nil {
+		return false, fmt.Errorf("not configured")
+	}
+	return h.livekit.HealthCheck()
+}
+
 // SetLiveKitProcess sets the LiveKit process manager on the hub.
 func (h *Hub) SetLiveKitProcess(p *LiveKitProcess) {
 	h.lkProcess = p
@@ -113,7 +124,7 @@ func (h *Hub) SetLiveKitProcess(p *LiveKitProcess) {
 // Must be called in its own goroutine.
 //
 // A panic recovery wrapper restarts the select loop automatically. If the hub
-// panics more than 5 times within a 60-second window it stops permanently to
+// panics more than 3 times within a 60-second window it stops permanently to
 // avoid a tight crash loop.
 func (h *Hub) Run() {
 	var panicCount int
@@ -140,7 +151,7 @@ func (h *Hub) Run() {
 						"panic_count", panicCount,
 						"stack", string(buf[:n]))
 
-					if panicCount >= 5 {
+					if panicCount >= 3 {
 						slog.Error("hub: too many panics in 60s, stopping")
 						return
 					}
@@ -172,7 +183,7 @@ func (h *Hub) Run() {
 		}()
 
 		// If we reach here without a panic recovery continuing, stop.
-		if panicCount >= 5 {
+		if panicCount >= 3 {
 			return
 		}
 		// If stop was signaled, exit.
@@ -278,13 +289,25 @@ func (h *Hub) Unregister(c *Client) {
 
 // BroadcastToChannel enqueues msg for delivery to all clients subscribed to
 // channelID. When channelID is 0 the message is sent to every connected client.
+// Non-blocking: if the broadcast channel is full the message is dropped with a warning.
 func (h *Hub) BroadcastToChannel(channelID int64, msg []byte) {
-	h.broadcast <- broadcastMsg{channelID: channelID, msg: msg}
+	select {
+	case h.broadcast <- broadcastMsg{channelID: channelID, msg: msg}:
+	default:
+		slog.Warn("hub: broadcast channel full, dropping message",
+			"channel_id", channelID, "msg_len", len(msg))
+	}
 }
 
 // BroadcastToAll enqueues msg for delivery to every connected client.
+// Non-blocking: if the broadcast channel is full the message is dropped with a warning.
 func (h *Hub) BroadcastToAll(msg []byte) {
-	h.broadcast <- broadcastMsg{channelID: 0, msg: msg}
+	select {
+	case h.broadcast <- broadcastMsg{channelID: 0, msg: msg}:
+	default:
+		slog.Warn("hub: broadcast channel full, dropping global message",
+			"msg_len", len(msg))
+	}
 }
 
 // BroadcastServerRestart sends a server_restart message to all connected clients.
diff --git a/Server/ws/livekit.go b/Server/ws/livekit.go
index 36bb528d..a76412d0 100644
--- a/Server/ws/livekit.go
+++ b/Server/ws/livekit.go
@@ -19,6 +19,9 @@ import (
 )
 
 // tokenTTL is the validity duration for generated LiveKit access tokens.
+// Kept at 4h to limit exposure if a token is leaked — there is no server-side
+// revocation for LiveKit JWTs. The client can request a refresh via
+// voice_token_refresh before expiry.
 const tokenTTL = 4 * time.Hour
 
 // LiveKitClient provides token generation and room management via
@@ -157,6 +160,20 @@ func (c *LiveKitClient) CountVideoTracks(channelID int64) (int, error) {
 	return count, nil
 }
 
+// HealthCheck verifies connectivity to the LiveKit server by listing rooms.
+// Returns true if the server responds successfully.
+func (c *LiveKitClient) HealthCheck() (bool, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	_, err := c.roomSvc.ListRooms(ctx, &livekit.ListRoomsRequest{})
+	if err != nil {
+		return false, fmt.Errorf("livekit health check failed: %w", err)
+	}
+
+	return true, nil
+}
+
 // wsToHTTP converts a WebSocket URL to an HTTP URL.
 func wsToHTTP(wsURL string) string {
 	switch {
diff --git a/Server/ws/livekit_process.go b/Server/ws/livekit_process.go
index e6e1429c..9af382d4 100644
--- a/Server/ws/livekit_process.go
+++ b/Server/ws/livekit_process.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -20,9 +21,10 @@ import (
 
 // LiveKitProcess manages the companion livekit-server binary.
 type LiveKitProcess struct {
-	cfg      *config.VoiceConfig
-	tlsCfg   *config.TLSConfig
-	dataDir  string
+	cfg        *config.VoiceConfig
+	tlsCfg     *config.TLSConfig
+	dataDir    string
+	httpClient *http.Client // for health checks — no redirect following
 
 	mu      sync.Mutex
 	cmd     *exec.Cmd
@@ -39,6 +41,11 @@ func NewLiveKitProcess(cfg *config.VoiceConfig, tlsCfg *config.TLSConfig, dataDi
 		cfg:     cfg,
 		tlsCfg:  tlsCfg,
 		dataDir: dataDir,
+		httpClient: &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
 	}
 }
 
@@ -56,7 +63,7 @@ rtc:
   port_range_end: 60000
   use_external_ip: true
 keys:
-  %s: %s
+  "%s": "%s"
 logging:
   level: info
 `, p.cfg.LiveKitAPIKey, p.cfg.LiveKitAPISecret)
@@ -100,8 +107,18 @@ func (p *LiveKitProcess) Start() error {
 }
 
 // runLoop starts and restarts the process until stopped or context cancelled.
+// Uses exponential backoff (3s → 6s → 12s … up to 60s) and stops after 10
+// consecutive rapid failures (process exits within 30 seconds).
 func (p *LiveKitProcess) runLoop(ctx context.Context, cfgPath string) {
-	const restartDelay = 3 * time.Second
+	const (
+		baseDelay      = 3 * time.Second
+		maxDelay       = 60 * time.Second
+		maxRetries     = 10
+		stableAfter    = 30 * time.Second // reset counter if process runs longer than this
+	)
+
+	rapidFailures := 0
+	delay := baseDelay
 
 	for {
 		if ctx.Err() != nil {
@@ -111,6 +128,7 @@ func (p *LiveKitProcess) runLoop(ctx context.Context, cfgPath string) {
 		cmd := exec.CommandContext(ctx, p.cfg.LiveKitBinaryPath, "--config", cfgPath)
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
+		cmd.WaitDelay = 6 * time.Second // bound Wait to prevent goroutine leak on Windows
 
 		p.mu.Lock()
 		if p.stopped {
@@ -122,8 +140,10 @@ func (p *LiveKitProcess) runLoop(ctx context.Context, cfgPath string) {
 
 		slog.Info("livekit: starting process",
 			"binary", p.cfg.LiveKitBinaryPath,
-			"config", cfgPath)
+			"config", cfgPath,
+			"rapid_failures", rapidFailures)
 
+		startTime := time.Now()
 		err := cmd.Run()
 
 		p.mu.Lock()
@@ -136,18 +156,39 @@ func (p *LiveKitProcess) runLoop(ctx context.Context, cfgPath string) {
 			return
 		}
 
+		// If the process ran for a while, it was stable — reset backoff.
+		if time.Since(startTime) > stableAfter {
+			rapidFailures = 0
+			delay = baseDelay
+		} else {
+			rapidFailures++
+		}
+
 		if err != nil {
 			slog.Error("livekit: process exited unexpectedly",
 				"error", err,
-				"restart_delay", restartDelay)
+				"rapid_failures", rapidFailures,
+				"restart_delay", delay)
+		}
+
+		if rapidFailures >= maxRetries {
+			slog.Error("livekit: too many rapid failures, giving up",
+				"rapid_failures", rapidFailures)
+			return
 		}
 
 		select {
-		case <-time.After(restartDelay):
+		case <-time.After(delay):
 			slog.Info("livekit: restarting process")
 		case <-ctx.Done():
 			return
 		}
+
+		// Exponential backoff capped at maxDelay.
+		delay *= 2
+		if delay > maxDelay {
+			delay = maxDelay
+		}
 	}
 }
 
@@ -158,6 +199,28 @@ func (p *LiveKitProcess) IsRunning() bool {
 	return p.cmd != nil && p.cmd.Process != nil
 }
 
+// HealthCheck probes the LiveKit HTTP endpoint to verify it is accepting
+// connections. Returns true if the server responds (any status code).
+func (p *LiveKitProcess) HealthCheck() (bool, error) {
+	httpURL := wsToHTTP(p.cfg.LiveKitURL)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, httpURL, nil)
+	if err != nil {
+		return false, fmt.Errorf("creating health check request: %w", err)
+	}
+
+	resp, err := p.httpClient.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("livekit health check failed: %w", err)
+	}
+	resp.Body.Close()
+
+	return true, nil
+}
+
 // Stop gracefully stops the companion process.
 func (p *LiveKitProcess) Stop() {
 	p.mu.Lock()
diff --git a/Server/ws/livekit_webhook.go b/Server/ws/livekit_webhook.go
index fe88dbbf..a92e9f65 100644
--- a/Server/ws/livekit_webhook.go
+++ b/Server/ws/livekit_webhook.go
@@ -22,7 +22,7 @@ import (
 // RoomEvent.ActiveSpeakersChanged (lower latency than webhooks).
 func (h *Hub) NewLiveKitWebhookHandler(apiKey, apiSecret string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
+		body, err := io.ReadAll(io.LimitReader(r.Body, 64*1024))
 		if err != nil {
 			slog.Error("livekit webhook: read body failed", "error", err)
 			http.Error(w, "bad request", http.StatusBadRequest)
@@ -151,9 +151,11 @@ func (h *Hub) handleWebhookParticipantLeft(event *livekit.WebhookEvent) {
 	h.mu.RUnlock()
 
 	if exists {
+		// Only clean up if the user is still in the channel that fired the
+		// webhook. If they've already moved or left, don't touch their state.
 		currentChID := c.getVoiceChID()
 		if currentChID == channelID {
-			c.setVoiceChID(0)
+			c.clearVoiceChID()
 
 			if h.db != nil {
 				_ = h.db.LeaveVoiceChannel(userID)
diff --git a/Server/ws/messages.go b/Server/ws/messages.go
index 95bc7fca..fa91b90c 100644
--- a/Server/ws/messages.go
+++ b/Server/ws/messages.go
@@ -3,6 +3,7 @@ package ws
 import (
 	"encoding/json"
 	"fmt"
+	"log/slog"
 
 	"github.com/owncord/server/db"
 )
@@ -155,6 +156,7 @@ type serverRestartPayload struct {
 func buildJSON(v any) []byte {
 	b, err := json.Marshal(v)
 	if err != nil {
+		slog.Error("buildJSON marshal failed", "error", err, "type", fmt.Sprintf("%T", v))
 		// Fallback: send a generic error rather than panicking.
 		b, _ = json.Marshal(map[string]string{"type": "error", "message": "internal marshal error"})
 	}
diff --git a/Server/ws/serve.go b/Server/ws/serve.go
index 715e9541..f257d173 100644
--- a/Server/ws/serve.go
+++ b/Server/ws/serve.go
@@ -92,6 +92,7 @@ func ServeWS(hub *Hub, database *db.DB, allowedOrigins []string) http.HandlerFun
 				writeCtx, writeCancel := context.WithCancel(ctx)
 				go writePump(writeCtx, conn, c)
 				readPump(ctx, conn, hub, c)
+				c.closeSend()
 				writeCancel()
 				return
 			}
@@ -120,9 +121,12 @@ func ServeWS(hub *Hub, database *db.DB, allowedOrigins []string) http.HandlerFun
 		hub.BroadcastToAll(buildPresenceMsg(user.ID, "online"))
 
 		// writePump runs in background; readPump blocks.
+		// When readPump returns (disconnect), close the send channel first
+		// so writePump drains any remaining messages, then cancel its context.
 		writeCtx, writeCancel := context.WithCancel(ctx)
 		go writePump(writeCtx, conn, c)
 		readPump(ctx, conn, hub, c)
+		c.closeSend()
 		writeCancel()
 	}
 }
diff --git a/Server/ws/voice_broadcast.go b/Server/ws/voice_broadcast.go
index 9415e0cf..3177e7a9 100644
--- a/Server/ws/voice_broadcast.go
+++ b/Server/ws/voice_broadcast.go
@@ -13,16 +13,21 @@ const (
 	voiceScreenshareWindow    = time.Second
 )
 
+// voiceQualities maps accepted voice quality presets to their target bitrate
+// in bits/s. This is the single source of truth — voice_join.go validates
+// against these keys, qualityBitrate looks up the value.
+var voiceQualities = map[string]int{
+	"low":    32000,
+	"medium": 64000,
+	"high":   128000,
+}
+
 // qualityBitrate returns the target audio bitrate in bits/s based on a quality preset.
 func qualityBitrate(quality string) int {
-	switch quality {
-	case "low":
-		return 32000
-	case "high":
-		return 128000
-	default:
-		return 64000
+	if bitrate, ok := voiceQualities[quality]; ok {
+		return bitrate
 	}
+	return voiceQualities["medium"]
 }
 
 // broadcastVoiceStateUpdate fetches the current voice state for the client
diff --git a/Server/ws/voice_controls.go b/Server/ws/voice_controls.go
index 6d254315..c149b015 100644
--- a/Server/ws/voice_controls.go
+++ b/Server/ws/voice_controls.go
@@ -13,6 +13,11 @@ import (
 // 2. Updates DB.
 // 3. Broadcasts voice_state update to channel.
 func (h *Hub) handleVoiceMute(c *Client, payload json.RawMessage) {
+	if c.getVoiceChID() == 0 {
+		c.sendMsg(buildErrorMsg(ErrCodeVoiceError, "not in a voice channel"))
+		return
+	}
+
 	var p struct {
 		Muted bool `json:"muted"`
 	}
@@ -36,6 +41,11 @@ func (h *Hub) handleVoiceMute(c *Client, payload json.RawMessage) {
 // 2. Updates DB.
 // 3. Broadcasts voice_state update to channel.
 func (h *Hub) handleVoiceDeafen(c *Client, payload json.RawMessage) {
+	if c.getVoiceChID() == 0 {
+		c.sendMsg(buildErrorMsg(ErrCodeVoiceError, "not in a voice channel"))
+		return
+	}
+
 	var p struct {
 		Deafened bool `json:"deafened"`
 	}
@@ -58,7 +68,7 @@ func (h *Hub) handleVoiceDeafen(c *Client, payload json.RawMessage) {
 // 1. Rate limits at 2/sec per user.
 // 2. Checks USE_VIDEO permission.
 // 3. Parses enabled bool.
-// 4. Enforces MaxVideo limit via LiveKit.
+// 4. Enforces MaxVideo limit via DB count (race-free).
 // 5. Updates DB.
 // 6. Broadcasts voice_state update to channel.
 func (h *Hub) handleVoiceCamera(c *Client, payload json.RawMessage) {
@@ -87,12 +97,13 @@ func (h *Hub) handleVoiceCamera(c *Client, payload json.RawMessage) {
 	}
 
 	// Enforce MaxVideo limit when enabling camera.
+	// Count from DB (race-free via SQLite serialization) instead of LiveKit API.
 	if p.Enabled {
 		ch, chErr := h.db.GetChannel(voiceChID)
-		if chErr == nil && ch != nil && ch.VoiceMaxVideo > 0 && h.livekit != nil {
-			videoCount, countErr := h.livekit.CountVideoTracks(voiceChID)
+		if chErr == nil && ch != nil && ch.VoiceMaxVideo > 0 {
+			videoCount, countErr := h.db.CountActiveCameras(voiceChID)
 			if countErr != nil {
-				slog.Error("handleVoiceCamera CountVideoTracks", "err", countErr, "channel_id", voiceChID)
+				slog.Error("handleVoiceCamera CountActiveCameras", "err", countErr, "channel_id", voiceChID)
 			} else if videoCount >= ch.VoiceMaxVideo {
 				c.sendMsg(buildErrorMsg(ErrCodeVideoLimit,
 					fmt.Sprintf("maximum %d video streams reached", ch.VoiceMaxVideo)))
diff --git a/Server/ws/voice_join.go b/Server/ws/voice_join.go
index b91e8adf..001352d1 100644
--- a/Server/ws/voice_join.go
+++ b/Server/ws/voice_join.go
@@ -2,11 +2,20 @@ package ws
 
 import (
 	"encoding/json"
+	"fmt"
 	"log/slog"
+	"time"
 
 	"github.com/owncord/server/permissions"
 )
 
+// validVoiceQuality returns true if q is an accepted voice quality preset.
+// Uses voiceQualities (defined in voice_broadcast.go) as the single source of truth.
+func validVoiceQuality(q string) bool {
+	_, ok := voiceQualities[q]
+	return ok
+}
+
 // handleVoiceJoin processes a voice_join message.
 // 1. Parses channel_id.
 // 2. Checks CONNECT_VOICE permission.
@@ -73,30 +82,39 @@ func (h *Hub) handleVoiceJoin(c *Client, payload json.RawMessage) {
 	c.setVoiceChID(channelID)
 
 	// Generate LiveKit token if LiveKit client is available.
+	// Token generation failure is fatal — without a token the client cannot
+	// connect to the SFU, so we must roll back the DB join.
 	if h.livekit != nil {
 		if c.user == nil {
 			slog.Error("handleVoiceJoin: nil user on client", "user_id", c.userID)
+			h.rollbackVoiceJoin(c, channelID)
 			c.sendMsg(buildErrorMsg(ErrCodeInternal, "not authenticated"))
 			return
 		}
-		canPublish := true
+		// Derive publish permissions from role — prevents SFU-level bypass
+		// when client connects directly via direct_url.
+		canPublish := h.hasChannelPerm(c, channelID, permissions.SpeakVoice)
 		canSubscribe := true
 		token, tokenErr := h.livekit.GenerateToken(c.userID, c.user.Username, channelID, canPublish, canSubscribe)
 		if tokenErr != nil {
 			slog.Error("ws handleVoiceJoin GenerateToken", "err", tokenErr, "user_id", c.userID)
-			// Non-fatal: voice join still succeeds at the DB/state level.
-		} else {
-			// Send both proxy path and direct URL. The client uses direct_url
-			// when on localhost (avoids self-signed TLS issues with WebView
-			// fetch) and falls back to the /livekit proxy for remote clients.
-			c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL()))
+			h.rollbackVoiceJoin(c, channelID)
+			c.sendMsg(buildErrorMsg(ErrCodeInternal, "failed to generate voice token"))
+			return
 		}
+		// Send both proxy path and direct URL. The client uses direct_url
+		// when on localhost (avoids self-signed TLS issues with WebView
+		// fetch) and falls back to the /livekit proxy for remote clients.
+		c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL()))
 	}
 
-	// Get and broadcast the joiner's state.
+	// Get and broadcast the joiner's state. Failure here means other users
+	// won't see the join (ghost state), so roll back to avoid inconsistency.
 	state, err := h.db.GetVoiceState(c.userID)
 	if err != nil || state == nil {
 		slog.Error("ws handleVoiceJoin GetVoiceState", "err", err, "user_id", c.userID)
+		h.rollbackVoiceJoin(c, channelID)
+		c.sendMsg(buildErrorMsg(ErrCodeInternal, "failed to join voice channel"))
 		return
 	}
 
@@ -119,10 +137,68 @@ func (h *Hub) handleVoiceJoin(c *Client, payload json.RawMessage) {
 	// Send voice_config to the joiner.
 	quality := "medium"
 	if ch.VoiceQuality != nil && *ch.VoiceQuality != "" {
-		quality = *ch.VoiceQuality
+		q := *ch.VoiceQuality
+		if validVoiceQuality(q) {
+			quality = q
+		} else {
+			slog.Warn("ws handleVoiceJoin invalid voice quality, using default",
+				"quality", q, "channel_id", channelID)
+		}
 	}
 	bitrate := qualityBitrate(quality)
 	c.sendMsg(buildVoiceConfig(channelID, quality, bitrate, maxUsers))
 
 	slog.Info("voice join", "user_id", c.userID, "channel_id", channelID)
 }
+
+// handleVoiceTokenRefresh generates a fresh LiveKit token for a client
+// that is already in a voice channel. This lets clients request a new token
+// (e.g. before a manual reconnect) without leaving and rejoining voice.
+func (h *Hub) handleVoiceTokenRefresh(c *Client) {
+	ratKey := fmt.Sprintf("voice_token_refresh:%d", c.userID)
+	if !h.limiter.Allow(ratKey, 1, 60*time.Second) {
+		c.sendMsg(buildRateLimitError("token refresh rate limited", 60))
+		return
+	}
+
+	channelID := c.getVoiceChID()
+	if channelID == 0 {
+		c.sendMsg(buildErrorMsg(ErrCodeBadRequest, "not in voice"))
+		return
+	}
+
+	if h.livekit == nil {
+		c.sendMsg(buildErrorMsg(ErrCodeInternal, "voice not configured"))
+		return
+	}
+
+	if c.user == nil {
+		slog.Error("handleVoiceTokenRefresh: nil user on client", "user_id", c.userID)
+		c.sendMsg(buildErrorMsg(ErrCodeInternal, "not authenticated"))
+		return
+	}
+
+	canPublish := h.hasChannelPerm(c, channelID, permissions.SpeakVoice)
+	canSubscribe := true
+	token, err := h.livekit.GenerateToken(c.userID, c.user.Username, channelID, canPublish, canSubscribe)
+	if err != nil {
+		slog.Error("ws handleVoiceTokenRefresh GenerateToken", "err", err, "user_id", c.userID)
+		c.sendMsg(buildErrorMsg(ErrCodeInternal, "failed to generate voice token"))
+		return
+	}
+
+	c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL()))
+	slog.Info("voice token refreshed", "user_id", c.userID, "channel_id", channelID)
+}
+
+// rollbackVoiceJoin undoes a partially-completed voice join: clears the
+// client's voice channel ID, removes the DB voice state row, and broadcasts
+// voice_leave so other clients don't see a ghost participant.
+func (h *Hub) rollbackVoiceJoin(c *Client, channelID int64) {
+	c.clearVoiceChID()
+	if err := h.db.LeaveVoiceChannel(c.userID); err != nil {
+		slog.Error("ws rollbackVoiceJoin LeaveVoiceChannel", "err", err,
+			"user_id", c.userID, "channel_id", channelID)
+	}
+	h.BroadcastToAll(buildVoiceLeave(channelID, c.userID))
+}
diff --git a/Server/ws/voice_leave.go b/Server/ws/voice_leave.go
index a2e2e718..b5931ef5 100644
--- a/Server/ws/voice_leave.go
+++ b/Server/ws/voice_leave.go
@@ -25,7 +25,7 @@ func (h *Hub) handleVoiceLeave(c *Client) {
 	// Remove from LiveKit (best-effort).
 	if h.livekit != nil {
 		if err := h.livekit.RemoveParticipant(oldChID, c.userID); err != nil {
-			slog.Debug("handleVoiceLeave RemoveParticipant (may already be gone)",
+			slog.Warn("handleVoiceLeave RemoveParticipant failed (may already be gone)",
 				"err", err, "user_id", c.userID, "channel_id", oldChID)
 		}
 	}
diff --git a/TODOS.md b/TODOS.md
new file mode 100644
index 00000000..c7092215
--- /dev/null
+++ b/TODOS.md
@@ -0,0 +1,13 @@
+# TODOS
+
+Deferred work items from engineering review (2026-03-21).
+
+## Voice E2E Test Infrastructure
+
+**What:** Add E2E test infrastructure for voice flows (voice_join → LiveKit connect → audio → voice_leave).
+**Why:** The voice path is critical UX with zero automated E2E coverage. Unit tests cover handlers and controllers, but nothing tests the full integration.
+**Pros:** Catches integration bugs between server + LiveKit + client.
+**Cons:** Requires LiveKit binary in CI, WebRTC support in test browser, ~200 lines of test infra.
+**Context:** The existing native E2E infrastructure (WebView2 CDP) could be extended. Needs CI setup first.
+**Depends on:** LiveKit binary available in CI environment.
+**Added:** 2026-03-21 (eng review of feature/livekit-migration)