v1.20.2

.dockerignore

@@ -0,0 +1,16 @@
+node_modules/
+.nogit/
+nogit/
+.git/
+.playwright-mcp/
+.vscode/
+test/
+dist_rust/
+dist_ts_web/
+rust/target/
+sip_trace.log
+sip_trace_*.log
+proxy.out
+proxy_v2.out
+*.pid
+.server.pid

.gitea/workflows/docker_tags.yaml

@@ -0,0 +1,32 @@
+name: Docker (tags)
+
+on:
+  push:
+    tags:
+      - '*'
+
+env:
+  IMAGE: code.foss.global/host.today/ht-docker-node:dbase_dind
+  NPMCI_LOGIN_DOCKER_GITEA: ${{ github.server_url }}|${{ gitea.repository_owner }}|${{ secrets.GITEA_TOKEN }}
+  NPMCI_LOGIN_DOCKER_DOCKERREGISTRY: ${{ secrets.NPMCI_LOGIN_DOCKER_DOCKERREGISTRY }}
+
+jobs:
+  release:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @git.zone/tsdocker
+
+      - name: Release
+        run: |
+          tsdocker login
+          tsdocker build
+          tsdocker push

.smartconfig.json

@@ -8,5 +8,16 @@
         "production": true
       }
     ]
+  },
+  "@git.zone/tsrust": {
+    "targets": ["linux_amd64", "linux_arm64"]
+  },
+  "@git.zone/tsdocker": {
+    "registries": ["code.foss.global"],
+    "registryRepoMap": {
+      "code.foss.global": "serve.zone/siprouter",
+      "dockerregistry.lossless.digital": "serve.zone/siprouter"
+    },
+    "platforms": ["linux/amd64", "linux/arm64"]
   }
 }

Dockerfile

@@ -0,0 +1,74 @@
+# gitzone dockerfile_service
+## STAGE 1 // BUILD
+FROM code.foss.global/host.today/ht-docker-node:lts AS build
+
+# System build tools that the Rust dep tree needs beyond the base image:
+#   - cmake      : used by the `cmake` crate (transitive via ort_sys / a webrtc
+#                  sub-crate) to build a C/C++ library from source when a
+#                  prebuilt-binary download path doesn't apply.
+#   - pkg-config : used by audiopus_sys and other *-sys crates to locate libs
+#                  on the native target (safe no-op if they vendor their own).
+# These are normally pre-installed on dev machines but not in ht-docker-node:lts.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      cmake \
+      pkg-config \
+ && rm -rf /var/lib/apt/lists/*
+
+# buildx sets TARGETARCH automatically for each platform it's building:
+#   linux/amd64  -> TARGETARCH=amd64
+#   linux/arm64  -> TARGETARCH=arm64
+# We use it to tell tsrust to build ONLY the current container's arch. This
+# overrides the `@git.zone/tsrust.targets` list in .smartconfig.json, which is
+# right for local dev / CI (where you want both binaries) but wrong for per-
+# platform Docker stages (each stage would then also try to cross-compile to
+# the OTHER arch — which fails in the arm64 stage because no reverse cross-
+# toolchain is installed).
+#
+# With --target set, tsrust builds a single target natively within whichever
+# platform this stage is running under (native on amd64, QEMU-emulated on arm64).
+ARG TARGETARCH
+
+COPY ./ /app
+WORKDIR /app
+RUN pnpm config set store-dir .pnpm-store
+RUN rm -rf node_modules && pnpm install
+
+# tsrust --target takes precedence over .smartconfig.json's targets array.
+# Writes dist_rust/proxy-engine_linux_amd64 or dist_rust/proxy-engine_linux_arm64.
+# The TS layer (ts/proxybridge.ts buildLocalPaths) picks the right one at runtime
+# via process.arch.
+RUN pnpm exec tsrust --target linux_${TARGETARCH}
+
+# Web bundle (esbuild — pure JS, uses the platform's native esbuild binary
+# installed by pnpm above, so no cross-bundling concerns).
+RUN pnpm run bundle
+
+# Drop pnpm store to keep the image smaller. node_modules stays because the
+# runtime entrypoint is tsx and siprouter has no separate dist_ts/ to run from.
+RUN rm -rf .pnpm-store
+
+## STAGE 2 // PRODUCTION
+FROM code.foss.global/host.today/ht-docker-node:alpine-node AS production
+
+# gcompat + libstdc++ let the glibc-linked proxy-engine binary run on Alpine.
+RUN apk add --no-cache gcompat libstdc++
+
+WORKDIR /app
+COPY --from=build /app /app
+
+ENV SIPROUTER_MODE=OCI_CONTAINER
+ENV NODE_ENV=production
+
+LABEL org.opencontainers.image.title="siprouter" \
+      org.opencontainers.image.description="SIP proxy with Rust data plane and WebRTC bridge" \
+      org.opencontainers.image.source="https://code.foss.global/serve.zone/siprouter"
+
+# 5070  SIP signaling (UDP+TCP)
+# 5061  SIP-TLS (optional, UDP+TCP)
+# 3060  Web UI / WebSocket (HTTP or HTTPS, auto-detected from .nogit/cert.pem)
+# 20000-20200/udp  RTP media range (must match config.proxy.rtpPortRange)
+EXPOSE 5070/udp 5070/tcp 5061/udp 5061/tcp 3060/tcp 20000-20200/udp
+
+# exec replaces sh as PID 1 with tsx, so SIGINT/SIGTERM reach Node and
+# ts/sipproxy.ts' shutdown handler (which calls shutdownProxyEngine) runs cleanly.
+CMD ["sh", "-c", "exec ./node_modules/.bin/tsx ts/sipproxy.ts"]

changelog.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 2026-04-11 - 1.20.2 - fix(proxy-engine)
+fix inbound route browser ringing and provider-facing SDP advertisement while preventing RTP port exhaustion
+
+- Honor inbound routing `ringBrowsers` when emitting incoming call events so browser toast notifications can be suppressed per route.
+- Rewrite SDP and Record-Route using the destination leg's routable address, using `public_ip` for provider legs and LAN IP for device and internal legs.
+- Store provider leg public IP metadata on legs to support correct per-destination SIP message rewriting.
+- Change the RTP port pool to track sockets with `Weak<UdpSocket>` so ports are reclaimed automatically after calls end, avoiding leaked allocations and eventual 503 failures on new calls.
+- Remove unused dashboard/status, DTMF, relay, and transport helper code paths as part of engine cleanup. 
+
+## 2026-04-11 - 1.20.1 - fix(docker)
+install required native build tools for Rust dependencies in the build image
+
+- Add cmake and pkg-config to the Docker build stage so Rust native dependencies can compile successfully in the container
+- Document why these tools are needed for transitive Rust crates that build or detect native libraries
+
+## 2026-04-11 - 1.20.0 - feat(docker)
+add multi-arch Docker build and tagged release pipeline
+
+- Add a production Dockerfile for building and running the SIP router with the Rust proxy engine and web bundle
+- Configure tsdocker and tsrust for linux/amd64 and linux/arm64 image builds and registry mapping
+- Add a tag-triggered Gitea workflow to build and push Docker images
+- Update runtime binary resolution to load architecture-specific Rust artifacts in Docker and CI environments
+- Add Docker-related package scripts, dependency updates, and ignore rules for container builds
+
+## 2026-04-11 - 1.19.2 - fix(web-ui)
+normalize lucide icon names across SIP proxy views
+
+- Updates icon identifiers to the expected PascalCase lucide format in app navigation, calls, IVR, overview, providers, and voicemail views.
+- Fixes UI icon rendering for stats cards and action menus such as transfer, delete, status, and call direction indicators.
+
+## 2026-04-10 - 1.19.1 - fix(readme)
+refresh documentation for jitter buffering, voicemail, and WebSocket signaling details
+
+- Add adaptive jitter buffer and packet loss concealment details to the audio pipeline documentation
+- Document voicemail unheard count and heard-state API endpoints
+- Update WebSocket event and browser signaling examples to reflect current message types
+
 ## 2026-04-10 - 1.19.0 - feat(proxy-engine,codec-lib)
 add adaptive RTP jitter buffering with Opus packet loss concealment and stable 20ms resampling
 

package.json

@@ -1,11 +1,14 @@
 {
   "name": "siprouter",
-  "version": "1.19.0",
+  "version": "1.20.2",
   "private": true,
   "type": "module",
   "scripts": {
     "bundle": "node node_modules/.pnpm/esbuild@0.27.7/node_modules/esbuild/bin/esbuild ts_web/index.ts --bundle --format=esm --outfile=dist_ts_web/bundle.js --platform=browser --target=es2022 --minify",
     "buildRust": "tsrust",
+    "build": "pnpm run buildRust && pnpm run bundle",
+    "build:docker": "tsdocker build --verbose",
+    "release:docker": "tsdocker push --verbose",
     "start": "tsx ts/sipproxy.ts",
     "restartBackground": "pnpm run buildRust && pnpm run bundle; test -f .server.pid && kill $(cat .server.pid) 2>/dev/null; sleep 1; rm -f sip_trace.log proxy.out && nohup tsx ts/sipproxy.ts > proxy.out 2>&1 & echo $! > .server.pid; sleep 2; cat proxy.out"
   },
@@ -14,10 +17,12 @@
     "@design.estate/dees-element": "^2.2.4",
     "@push.rocks/smartrust": "^1.3.2",
     "@push.rocks/smartstate": "^2.3.0",
+    "tsx": "^4.21.0",
     "ws": "^8.20.0"
   },
   "devDependencies": {
     "@git.zone/tsbundle": "^2.10.0",
+    "@git.zone/tsdocker": "^2.2.4",
     "@git.zone/tsrust": "^1.3.2",
     "@git.zone/tswatch": "^3.3.2",
     "@types/ws": "^8.18.1"

readme.md

@@ -1,6 +1,6 @@
 # @serve.zone/siprouter
 
-A production-grade **SIP B2BUA + WebRTC bridge** built with TypeScript and Rust. Routes calls between SIP providers, SIP hardware devices, and browser softphones — with real-time codec transcoding, ML noise suppression, neural TTS, voicemail, IVR menus, and a slick web dashboard.
+A production-grade **SIP B2BUA + WebRTC bridge** built with TypeScript and Rust. Routes calls between SIP providers, SIP hardware devices, and browser softphones — with real-time codec transcoding, adaptive jitter buffering, ML noise suppression, neural TTS, voicemail, IVR menus, and a slick web dashboard.
 
 ## Issue Reporting and Security
 
@@ -17,6 +17,7 @@ siprouter sits between your SIP trunk providers and your endpoints — hardware
 - 🎛️ **Multi-Provider Trunking** — Register with multiple SIP providers simultaneously (sipgate, easybell, etc.) with automatic failover
 - 🎧 **48kHz f32 Audio Engine** — High-fidelity internal audio bus at 48kHz/32-bit float with native Opus float encode/decode, FFT-based resampling, and per-leg ML noise suppression
 - 🔀 **N-Leg Mix-Minus Mixer** — Conference-grade mixing with dynamic leg add/remove, transfer, and per-source audio separation
+- 🎯 **Adaptive Jitter Buffer** — Per-leg jitter buffering with sequence-based reordering, adaptive depth (60–120ms), Opus PLC for lost packets, and hold/resume detection
 - 📧 **Voicemail** — Configurable voicemail boxes with TTS greetings, recording, and web playback
 - 🔢 **IVR Menus** — DTMF-navigable interactive voice response with nested menus, routing actions, and custom prompts
 - 🗣️ **Neural TTS** — Kokoro-powered announcements and greetings with 25+ voice presets, backed by espeak-ng fallback
@@ -49,7 +50,7 @@ siprouter sits between your SIP trunk providers and your endpoints — hardware
 │  │                                │  │
 │  │ SIP Stack · Dialog SM · Auth   │  │
 │  │ Call Manager · N-Leg Mixer     │  │
-│  │ 48kHz f32 Bus · RNNoise       │  │
+│  │ 48kHz f32 Bus · Jitter Buffer  │  │
 │  │ Codec Engine · RTP Port Pool   │  │
 │  │ WebRTC Engine · Kokoro TTS     │  │
 │  │ Voicemail · IVR · Recording    │  │
@@ -246,14 +247,15 @@ The `proxy-engine` binary handles all real-time audio processing with a **48kHz
 ### Audio Pipeline
 
 ```
-Inbound:   Wire RTP → Decode → Resample to 48kHz → Denoise (RNNoise) → Mix Bus
+Inbound:   Wire RTP → Jitter Buffer → Decode → Resample to 48kHz → Denoise (RNNoise) → Mix Bus
 Outbound:  Mix Bus → Mix-Minus → Resample to codec rate → Encode → Wire RTP
 ```
 
-- **FFT-based resampling** via `rubato` — high-quality sinc interpolation with cached resampler state for seamless inter-frame continuity
+- **Adaptive jitter buffer** — per-leg `BTreeMap`-based buffer keyed by RTP sequence number. Delivers exactly one frame per 20ms mixer tick in sequence order. Adaptive target depth starts at 3 frames (60ms) and adjusts between 2–6 frames based on observed network jitter. Handles hold/resume by detecting large forward sequence jumps and resetting cleanly.
+- **Packet loss concealment (PLC)** — on missing packets, Opus legs invoke the decoder's built-in PLC (`decode(None)`) to synthesize a smooth fill frame. Non-Opus legs (G.722, PCMU) apply exponential fade (0.85×) toward silence to avoid hard discontinuities.
+- **FFT-based resampling** via `rubato` — high-quality sinc interpolation with canonical 20ms chunk sizes to ensure consistent resampler state across frames, preventing filter discontinuities
 - **ML noise suppression** via `nnnoiseless` (RNNoise) — per-leg inbound denoising with SIMD acceleration (AVX/SSE). Skipped for WebRTC legs (browsers already denoise via getUserMedia)
 - **Mix-minus mixing** — each participant hears everyone except themselves, accumulated in f64 precision
-- **In-tick packet reorder** — inbound RTP packets are sorted by sequence number before decoding, protecting G.722 ADPCM state from out-of-order delivery
 - **RFC 3550 compliant header parsing** — properly handles CSRC lists and header extensions
 
 ---
@@ -272,9 +274,10 @@ Announcements and voicemail greetings are synthesized using [Kokoro TTS](https:/
 
 ## 📧 Voicemail
 
-- Configurable voicemail boxes with custom TTS greetings
-- Automatic routing on no-answer timeout
-- Recording with configurable max duration and message count
+- Configurable voicemail boxes with custom TTS greetings (text + voice) or uploaded WAV
+- Automatic routing on no-answer timeout (configurable, default 25s)
+- Recording with configurable max duration (default 120s) and message count limit (default 50)
+- Unheard message tracking for MWI (message waiting indication)
 - Web dashboard playback and management
 - WAV storage in `.nogit/voicemail/`
 
@@ -319,8 +322,10 @@ Announcements and voicemail greetings are synthesized using [Kokoro TTS](https:/
 | `/api/config` | GET | Read current configuration |
 | `/api/config` | POST | Update configuration (hot-reload) |
 | `/api/voicemail/:box` | GET | List voicemail messages |
-| `/api/voicemail/:box/:id` | DELETE | Delete a voicemail message |
+| `/api/voicemail/:box/unheard` | GET | Get unheard message count |
 | `/api/voicemail/:box/:id/audio` | GET | Stream voicemail audio |
+| `/api/voicemail/:box/:id/heard` | POST | Mark a voicemail message as heard |
+| `/api/voicemail/:box/:id` | DELETE | Delete a voicemail message |
 
 ### WebSocket Events
 
@@ -329,8 +334,18 @@ Connect to `/ws` for real-time push:
 ```jsonc
 { "type": "status", "data": { ... } }           // Full status snapshot (1s interval)
 { "type": "log", "data": { "message": "..." } } // Log lines in real-time
-{ "type": "incoming_call", "data": { ... } }     // Incoming call notification
-{ "type": "call_ended", "data": { ... } }        // Call ended notification
+{ "type": "call-update", "data": { ... } }      // Call state change notification
+{ "type": "webrtc-answer", "data": { ... } }    // WebRTC SDP answer for browser calls
+{ "type": "webrtc-error", "data": { ... } }     // WebRTC signaling error
+```
+
+Browser → server signaling:
+
+```jsonc
+{ "type": "webrtc-offer", "data": { ... } }     // Browser sends SDP offer
+{ "type": "webrtc-accept", "data": { ... } }    // Browser accepts incoming call
+{ "type": "webrtc-ice", "data": { ... } }       // ICE candidate exchange
+{ "type": "webrtc-hangup", "data": { ... } }    // Browser hangs up
 ```
 
 ---
@@ -365,7 +380,7 @@ pnpm run restartBackground
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

rust/crates/proxy-engine/src/call.rs

@@ -27,6 +27,10 @@ pub enum CallState {
 }
 
 impl CallState {
+    /// Wire-format string for events/dashboards. Not currently emitted —
+    /// call state changes flow as typed events (`call_answered`, etc.) —
+    /// but kept for future status-snapshot work.
+    #[allow(dead_code)]
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::SettingUp => "setting-up",
@@ -45,6 +49,8 @@ pub enum CallDirection {
 }
 
 impl CallDirection {
+    /// Wire-format string. See CallState::as_str.
+    #[allow(dead_code)]
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::Inbound => "inbound",
@@ -59,8 +65,13 @@ pub enum LegKind {
     SipProvider,
     SipDevice,
     WebRtc,
-    Media, // voicemail playback, IVR, recording
-    Tool,  // observer leg for recording, transcription, etc.
+    /// Voicemail playback, IVR prompt playback, recording — not yet wired up
+    /// as a distinct leg kind (those paths currently use the mixer's role
+    /// system instead). Kept behind allow so adding a real media leg later
+    /// doesn't require re-introducing the variant.
+    #[allow(dead_code)]
+    Media,
+    Tool, // observer leg for recording, transcription, etc.
 }
 
 impl LegKind {
@@ -107,11 +118,22 @@ pub struct LegInfo {
     /// For SIP legs: the SIP Call-ID for message routing.
     pub sip_call_id: Option<String>,
     /// For WebRTC legs: the session ID in WebRtcEngine.
+    ///
+    /// Populated at leg creation but not yet consumed by the hub —
+    /// WebRTC session lookup currently goes through the session registry
+    /// directly. Kept for introspection/debugging.
+    #[allow(dead_code)]
     pub webrtc_session_id: Option<String>,
     /// The RTP socket allocated for this leg.
     pub rtp_socket: Option<Arc<UdpSocket>>,
     /// The RTP port number.
     pub rtp_port: u16,
+    /// Public IP to advertise in SDP/Record-Route when THIS leg is the
+    /// destination of a rewrite. Populated only for provider legs; `None`
+    /// for LAN SIP devices, WebRTC browsers, media, and tool legs (which
+    /// are reachable via `lan_ip`). See `route_passthrough_message` for
+    /// the per-destination advertise-IP logic.
+    pub public_ip: Option<String>,
     /// The remote media endpoint (learned from SDP or address learning).
     pub remote_media: Option<SocketAddr>,
     /// SIP signaling address (provider or device).
@@ -124,14 +146,21 @@ pub struct LegInfo {
 
 /// A multiparty call with N legs and a central mixer.
 pub struct Call {
+    // Duplicated from the HashMap key in CallManager. Kept for future
+    // status-snapshot work.
+    #[allow(dead_code)]
     pub id: String,
     pub state: CallState,
+    // Populated at call creation but not currently consumed — dashboard
+    // pull snapshots are gone (push events only).
+    #[allow(dead_code)]
     pub direction: CallDirection,
     pub created_at: Instant,
 
     // Metadata.
     pub caller_number: Option<String>,
     pub callee_number: Option<String>,
+    #[allow(dead_code)]
     pub provider_id: String,
 
     /// Original INVITE from the device (for device-originated outbound calls).
@@ -211,42 +240,4 @@ impl Call {
             handle.abort();
         }
     }
-
-    /// Produce a JSON status snapshot for the dashboard.
-    pub fn to_status_json(&self) -> serde_json::Value {
-        let legs: Vec<serde_json::Value> = self
-            .legs
-            .values()
-            .filter(|l| l.state != LegState::Terminated)
-            .map(|l| {
-                let metadata: serde_json::Value = if l.metadata.is_empty() {
-                    serde_json::json!({})
-                } else {
-                    serde_json::Value::Object(
-                        l.metadata.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),
-                    )
-                };
-                serde_json::json!({
-                    "id": l.id,
-                    "type": l.kind.as_str(),
-                    "state": l.state.as_str(),
-                    "codec": sip_proto::helpers::codec_name(l.codec_pt),
-                    "rtpPort": l.rtp_port,
-                    "remoteMedia": l.remote_media.map(|a| format!("{}:{}", a.ip(), a.port())),
-                    "metadata": metadata,
-                })
-            })
-            .collect();
-
-        serde_json::json!({
-            "id": self.id,
-            "state": self.state.as_str(),
-            "direction": self.direction.as_str(),
-            "callerNumber": self.caller_number,
-            "calleeNumber": self.callee_number,
-            "providerUsed": self.provider_id,
-            "duration": self.duration_secs(),
-            "legs": legs,
-        })
-    }
 }

rust/crates/proxy-engine/src/call_manager.rs

@@ -20,6 +20,14 @@ use std::net::SocketAddr;
 use std::sync::Arc;
 use tokio::net::UdpSocket;
 
+/// Result of creating an inbound call — carries both the call id and
+/// whether browsers should be notified (flows from the matched inbound
+/// route's `ring_browsers` flag, or the fallback default).
+pub struct InboundCallCreated {
+    pub call_id: String,
+    pub ring_browsers: bool,
+}
+
 /// Emit a `leg_added` event with full leg information.
 /// Free function (not a method) to avoid `&self` borrow conflicts when `self.calls` is borrowed.
 fn emit_leg_added_event(tx: &OutTx, call_id: &str, leg: &LegInfo) {
@@ -94,26 +102,6 @@ impl CallManager {
         self.sip_index.contains_key(sip_call_id)
     }
 
-    /// Get an RTP socket for a call's provider leg (used by webrtc_link).
-    pub fn get_call_provider_rtp_socket(&self, call_id: &str) -> Option<Arc<UdpSocket>> {
-        let call = self.calls.get(call_id)?;
-        for leg in call.legs.values() {
-            if leg.kind == LegKind::SipProvider {
-                return leg.rtp_socket.clone();
-            }
-        }
-        None
-    }
-
-    /// Get all active call statuses for the dashboard.
-    pub fn get_all_statuses(&self) -> Vec<serde_json::Value> {
-        self.calls
-            .values()
-            .filter(|c| c.state != CallState::Terminated)
-            .map(|c| c.to_status_json())
-            .collect()
-    }
-
     // -----------------------------------------------------------------------
     // SIP message routing
     // -----------------------------------------------------------------------
@@ -426,8 +414,8 @@ impl CallManager {
 
         // Find the counterpart leg.
         let other_leg = call.legs.values().find(|l| l.id != this_leg_id && l.state != LegState::Terminated);
-        let (other_addr, other_rtp_port, other_leg_id) = match other_leg {
-            Some(l) => (l.signaling_addr, l.rtp_port, l.id.clone()),
+        let (other_addr, other_rtp_port, other_leg_id, other_kind, other_public_ip) = match other_leg {
+            Some(l) => (l.signaling_addr, l.rtp_port, l.id.clone(), l.kind, l.public_ip.clone()),
             None => return false,
         };
         let forward_to = match other_addr {
@@ -438,8 +426,14 @@ impl CallManager {
         let lan_ip = config.proxy.lan_ip.clone();
         let lan_port = config.proxy.lan_port;
 
-        // Get this leg's RTP port (for SDP rewriting — tell the other side to send RTP here).
-        let this_rtp_port = call.legs.get(this_leg_id).map(|l| l.rtp_port).unwrap_or(0);
+        // Pick the IP to advertise to the destination leg. Provider legs face
+        // the public internet and need `public_ip`; every other leg kind is
+        // on-LAN (or proxy-internal) and takes `lan_ip`. This rule is applied
+        // both to the SDP `c=` line and the Record-Route header below.
+        let advertise_ip: String = match other_kind {
+            LegKind::SipProvider => other_public_ip.unwrap_or_else(|| lan_ip.clone()),
+            _ => lan_ip.clone(),
+        };
 
         // Check if the other leg is a B2BUA leg (has SipLeg for proper dialog mgmt).
         let other_has_sip_leg = call.legs.get(&other_leg_id)
@@ -533,10 +527,11 @@ impl CallManager {
 
             // Forward other requests with SDP rewriting.
             let mut fwd = msg.clone();
-            // Rewrite SDP to point the other side to this leg's RTP port
-            // (so we receive their audio on our socket).
+            // Rewrite SDP so the destination leg sends RTP to our proxy port
+            // at an address that is routable from its vantage point
+            // (public IP for provider legs, LAN IP for everything else).
             if fwd.has_sdp_body() {
-                let (new_body, _) = rewrite_sdp(&fwd.body, &lan_ip, other_rtp_port);
+                let (new_body, _) = rewrite_sdp(&fwd.body, &advertise_ip, other_rtp_port);
                 fwd.body = new_body;
                 fwd.update_content_length();
             }
@@ -548,7 +543,8 @@ impl CallManager {
                 }
             }
             if fwd.is_dialog_establishing() {
-                fwd.prepend_header("Record-Route", &format!("<sip:{lan_ip}:{lan_port};lr>"));
+                // Record-Route must also be routable from the destination leg.
+                fwd.prepend_header("Record-Route", &format!("<sip:{advertise_ip}:{lan_port};lr>"));
             }
             let _ = socket.send_to(&fwd.serialize(), forward_to).await;
             return true;
@@ -560,15 +556,10 @@ impl CallManager {
             let cseq_method = msg.cseq_method().unwrap_or("").to_uppercase();
 
             let mut fwd = msg.clone();
-            // Rewrite SDP so the forward-to side sends RTP to the correct leg port.
+            // Rewrite SDP so the forward-to side sends RTP to the correct
+            // leg port at a routable address (see `advertise_ip` above).
             if fwd.has_sdp_body() {
-                let rewrite_ip = if this_kind == LegKind::SipDevice {
-                    // Response from device → send to provider: use LAN/public IP.
-                    &lan_ip
-                } else {
-                    &lan_ip
-                };
-                let (new_body, _) = rewrite_sdp(&fwd.body, rewrite_ip, other_rtp_port);
+                let (new_body, _) = rewrite_sdp(&fwd.body, &advertise_ip, other_rtp_port);
                 fwd.body = new_body;
                 fwd.update_content_length();
             }
@@ -690,7 +681,7 @@ impl CallManager {
         rtp_pool: &mut RtpPortPool,
         socket: &UdpSocket,
         public_ip: Option<&str>,
-    ) -> Option<String> {
+    ) -> Option<InboundCallCreated> {
         let call_id = self.next_call_id();
         let lan_ip = &config.proxy.lan_ip;
         let lan_port = config.proxy.lan_port;
@@ -707,17 +698,41 @@ impl CallManager {
             .unwrap_or("")
             .to_string();
 
-        // Resolve target device.
-        let device_addr = match self.resolve_first_device(config, registrar) {
+        // Resolve via the configured inbound routing table. This honors
+        // user-defined routes from the UI (numberPattern, callerPattern,
+        // sourceProvider, targets, ringBrowsers). If no route matches, the
+        // fallback returns an empty `device_ids` and `ring_browsers: true`,
+        // which preserves pre-routing behavior via the `resolve_first_device`
+        // fallback below.
+        //
+        // TODO: Multi-target inbound fork is not yet implemented.
+        //   - `route.device_ids` beyond the first registered target are ignored.
+        //   - `ring_browsers` is informational only — browsers see a toast but
+        //     do not race the SIP device. First-to-answer-wins requires a
+        //     multi-leg fork + per-leg CANCEL, which is not built yet.
+        //   - `voicemail_box`, `ivr_menu_id`, `no_answer_timeout` are not honored.
+        let route = config.resolve_inbound_route(provider_id, &called_number, &caller_number);
+        let ring_browsers = route.ring_browsers;
+
+        // Pick the first registered device from the matched targets, or fall
+        // back to any-registered-device if the route has no resolved targets.
+        let device_addr = route
+            .device_ids
+            .iter()
+            .find_map(|id| registrar.get_device_contact(id))
+            .or_else(|| self.resolve_first_device(config, registrar));
+
+        let device_addr = match device_addr {
             Some(addr) => addr,
             None => {
                 // No device registered → voicemail.
-                return self
+                let call_id = self
                     .route_to_voicemail(
                         &call_id, invite, from_addr, &caller_number,
                         provider_id, provider_config, config, rtp_pool, socket, public_ip,
                     )
-                    .await;
+                    .await?;
+                return Some(InboundCallCreated { call_id, ring_browsers });
             }
         };
 
@@ -781,6 +796,7 @@ impl CallManager {
                 webrtc_session_id: None,
                 rtp_socket: Some(provider_rtp.socket.clone()),
                 rtp_port: provider_rtp.port,
+                public_ip: public_ip.map(|s| s.to_string()),
                 remote_media: provider_media,
                 signaling_addr: Some(from_addr),
                 metadata: HashMap::new(),
@@ -801,6 +817,7 @@ impl CallManager {
                 webrtc_session_id: None,
                 rtp_socket: Some(device_rtp.socket.clone()),
                 rtp_port: device_rtp.port,
+                public_ip: None,
                 remote_media: None, // Learned from device's 200 OK.
                 signaling_addr: Some(device_addr),
                 metadata: HashMap::new(),
@@ -844,7 +861,7 @@ impl CallManager {
             }
         }
 
-        Some(call_id)
+        Some(InboundCallCreated { call_id, ring_browsers })
     }
 
     /// Initiate an outbound B2BUA call from the dashboard.
@@ -920,6 +937,7 @@ impl CallManager {
                 webrtc_session_id: None,
                 rtp_socket: Some(rtp_alloc.socket.clone()),
                 rtp_port: rtp_alloc.port,
+                public_ip: public_ip.map(|s| s.to_string()),
                 remote_media: None,
                 signaling_addr: Some(provider_dest),
                 metadata: HashMap::new(),
@@ -1030,6 +1048,7 @@ impl CallManager {
                 sip_leg: None,
                 sip_call_id: Some(device_sip_call_id.clone()),
                 webrtc_session_id: None,
+                public_ip: None,
                 rtp_socket: Some(device_rtp.socket.clone()),
                 rtp_port: device_rtp.port,
                 remote_media: device_media,
@@ -1076,6 +1095,7 @@ impl CallManager {
                 webrtc_session_id: None,
                 rtp_socket: Some(provider_rtp.socket.clone()),
                 rtp_port: provider_rtp.port,
+                public_ip: public_ip.map(|s| s.to_string()),
                 remote_media: None,
                 signaling_addr: Some(provider_dest),
                 metadata: HashMap::new(),
@@ -1114,7 +1134,7 @@ impl CallManager {
         public_ip: Option<&str>,
         registered_aor: &str,
     ) -> Option<String> {
-        let call = self.calls.get(call_id)?;
+        self.calls.get(call_id)?; // existence check; the call is re-fetched via get_mut below
         let lan_ip = &config.proxy.lan_ip;
         let lan_port = config.proxy.lan_port;
 
@@ -1151,6 +1171,7 @@ impl CallManager {
             webrtc_session_id: None,
             rtp_socket: Some(rtp_alloc.socket.clone()),
             rtp_port: rtp_alloc.port,
+            public_ip: public_ip.map(|s| s.to_string()),
             remote_media: None,
             signaling_addr: Some(provider_dest),
             metadata: HashMap::new(),
@@ -1182,7 +1203,7 @@ impl CallManager {
         socket: &UdpSocket,
     ) -> Option<String> {
         let device_addr = registrar.get_device_contact(device_id)?;
-        let call = self.calls.get(call_id)?;
+        self.calls.get(call_id)?; // existence check; the call is re-fetched via get_mut below
         let lan_ip = &config.proxy.lan_ip;
         let lan_port = config.proxy.lan_port;
 
@@ -1221,6 +1242,7 @@ impl CallManager {
             webrtc_session_id: None,
             rtp_socket: Some(rtp_alloc.socket.clone()),
             rtp_port: rtp_alloc.port,
+            public_ip: None,
             remote_media: None,
             signaling_addr: Some(device_addr),
             metadata: HashMap::new(),
@@ -1581,6 +1603,7 @@ impl CallManager {
                 webrtc_session_id: None,
                 rtp_socket: Some(rtp_alloc.socket.clone()),
                 rtp_port: rtp_alloc.port,
+                public_ip: public_ip.map(|s| s.to_string()),
                 remote_media: Some(provider_media),
                 signaling_addr: Some(from_addr),
                 metadata: HashMap::new(),

rust/crates/proxy-engine/src/config.rs

@@ -30,6 +30,11 @@ impl Endpoint {
 }
 
 /// Provider quirks for codec/protocol workarounds.
+//
+// Deserialized from provider config for TS parity. Early-media silence
+// injection and related workarounds are not yet ported to the Rust engine,
+// so every field is populated by serde but not yet consumed.
+#[allow(dead_code)]
 #[derive(Debug, Clone, Deserialize)]
 pub struct Quirks {
     #[serde(rename = "earlyMediaSilence")]
@@ -44,6 +49,9 @@ pub struct Quirks {
 #[derive(Debug, Clone, Deserialize)]
 pub struct ProviderConfig {
     pub id: String,
+    // UI label — populated by serde for parity with the TS config, not
+    // consumed at runtime.
+    #[allow(dead_code)]
     #[serde(rename = "displayName")]
     pub display_name: String,
     pub domain: String,
@@ -54,6 +62,8 @@ pub struct ProviderConfig {
     #[serde(rename = "registerIntervalSec")]
     pub register_interval_sec: u32,
     pub codecs: Vec<u8>,
+    // Workaround knobs populated by serde but not yet acted upon — see Quirks.
+    #[allow(dead_code)]
     pub quirks: Quirks,
 }
 
@@ -84,6 +94,10 @@ pub struct RouteMatch {
 
 /// Route action.
 #[derive(Debug, Clone, Deserialize)]
+// Several fields (voicemail_box, ivr_menu_id, no_answer_timeout) are read
+// by resolve_inbound_route but not yet honored downstream — see the
+// multi-target TODO in CallManager::create_inbound_call.
+#[allow(dead_code)]
 pub struct RouteAction {
     pub targets: Option<Vec<String>>,
     #[serde(rename = "ringBrowsers")]
@@ -106,7 +120,11 @@ pub struct RouteAction {
 /// A routing rule.
 #[derive(Debug, Clone, Deserialize)]
 pub struct Route {
+    // `id` and `name` are UI identifiers, populated by serde but not
+    // consumed by the resolvers.
+    #[allow(dead_code)]
     pub id: String,
+    #[allow(dead_code)]
     pub name: String,
     pub priority: i32,
     pub enabled: bool,
@@ -192,10 +210,18 @@ pub fn matches_pattern(pattern: Option<&str>, value: &str) -> bool {
 /// Result of resolving an outbound route.
 pub struct OutboundRouteResult {
     pub provider: ProviderConfig,
+    // TODO: prefix rewriting is unfinished — this is computed but the
+    // caller ignores it and uses the raw dialed number.
+    #[allow(dead_code)]
     pub transformed_number: String,
 }
 
 /// Result of resolving an inbound route.
+//
+// `device_ids` and `ring_browsers` are consumed by create_inbound_call.
+// The remaining fields (voicemail_box, ivr_menu_id, no_answer_timeout)
+// are resolved but not yet acted upon — see the multi-target TODO.
+#[allow(dead_code)]
 pub struct InboundRouteResult {
     pub device_ids: Vec<String>,
     pub ring_browsers: bool,

rust/crates/proxy-engine/src/dtmf.rs

@@ -1,200 +0,0 @@
-//! DTMF detection — parses RFC 2833 telephone-event RTP packets.
-//!
-//! Deduplicates repeated packets (same digit sent multiple times with
-//! increasing duration) and fires once per detected digit.
-//!
-//! Ported from ts/call/dtmf-detector.ts.
-
-use crate::ipc::{emit_event, OutTx};
-
-/// RFC 2833 event ID → character mapping.
-const EVENT_CHARS: &[char] = &[
-    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '*', '#', 'A', 'B', 'C', 'D',
-];
-
-/// Safety timeout: report digit if no End packet arrives within this many ms.
-const SAFETY_TIMEOUT_MS: u64 = 200;
-
-/// DTMF detector for a single RTP stream.
-pub struct DtmfDetector {
-    /// Negotiated telephone-event payload type (default 101).
-    telephone_event_pt: u8,
-    /// Clock rate for duration calculation (default 8000 Hz).
-    clock_rate: u32,
-    /// Call ID for event emission.
-    call_id: String,
-
-    // Deduplication state.
-    current_event_id: Option<u8>,
-    current_event_ts: Option<u32>,
-    current_event_reported: bool,
-    current_event_duration: u16,
-
-    out_tx: OutTx,
-}
-
-impl DtmfDetector {
-    pub fn new(call_id: String, out_tx: OutTx) -> Self {
-        Self {
-            telephone_event_pt: 101,
-            clock_rate: 8000,
-            call_id,
-            current_event_id: None,
-            current_event_ts: None,
-            current_event_reported: false,
-            current_event_duration: 0,
-            out_tx,
-        }
-    }
-
-    /// Feed an RTP packet. Checks PT; ignores non-DTMF packets.
-    /// Returns Some(digit_char) if a digit was detected.
-    pub fn process_rtp(&mut self, data: &[u8]) -> Option<char> {
-        if data.len() < 16 {
-            return None; // 12-byte header + 4-byte telephone-event minimum
-        }
-
-        let pt = data[1] & 0x7F;
-        if pt != self.telephone_event_pt {
-            return None;
-        }
-
-        let marker = (data[1] & 0x80) != 0;
-        let rtp_timestamp = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
-
-        // Parse telephone-event payload.
-        let event_id = data[12];
-        let end_bit = (data[13] & 0x80) != 0;
-        let duration = u16::from_be_bytes([data[14], data[15]]);
-
-        if event_id as usize >= EVENT_CHARS.len() {
-            return None;
-        }
-
-        // Detect new event.
-        let is_new = marker
-            || self.current_event_id != Some(event_id)
-            || self.current_event_ts != Some(rtp_timestamp);
-
-        if is_new {
-            // Report pending unreported event.
-            let pending = self.report_pending();
-
-            self.current_event_id = Some(event_id);
-            self.current_event_ts = Some(rtp_timestamp);
-            self.current_event_reported = false;
-            self.current_event_duration = duration;
-
-            if pending.is_some() {
-                return pending;
-            }
-        }
-
-        if duration > self.current_event_duration {
-            self.current_event_duration = duration;
-        }
-
-        // Report on End bit (first time only).
-        if end_bit && !self.current_event_reported {
-            self.current_event_reported = true;
-            let digit = EVENT_CHARS[event_id as usize];
-            let duration_ms = (self.current_event_duration as f64 / self.clock_rate as f64) * 1000.0;
-
-            emit_event(
-                &self.out_tx,
-                "dtmf_digit",
-                serde_json::json!({
-                    "call_id": self.call_id,
-                    "digit": digit.to_string(),
-                    "duration_ms": duration_ms.round() as u32,
-                    "source": "rfc2833",
-                }),
-            );
-
-            return Some(digit);
-        }
-
-        None
-    }
-
-    /// Report a pending unreported event.
-    fn report_pending(&mut self) -> Option<char> {
-        if let Some(event_id) = self.current_event_id {
-            if !self.current_event_reported && (event_id as usize) < EVENT_CHARS.len() {
-                self.current_event_reported = true;
-                let digit = EVENT_CHARS[event_id as usize];
-                let duration_ms =
-                    (self.current_event_duration as f64 / self.clock_rate as f64) * 1000.0;
-
-                emit_event(
-                    &self.out_tx,
-                    "dtmf_digit",
-                    serde_json::json!({
-                        "call_id": self.call_id,
-                        "digit": digit.to_string(),
-                        "duration_ms": duration_ms.round() as u32,
-                        "source": "rfc2833",
-                    }),
-                );
-
-                return Some(digit);
-            }
-        }
-        None
-    }
-
-    /// Process a SIP INFO message body for DTMF.
-    pub fn process_sip_info(&mut self, content_type: &str, body: &str) -> Option<char> {
-        let ct = content_type.to_ascii_lowercase();
-
-        if ct.contains("application/dtmf-relay") {
-            // Format: "Signal= 5\r\nDuration= 160\r\n"
-            let signal = body
-                .lines()
-                .find(|l| l.to_ascii_lowercase().starts_with("signal"))
-                .and_then(|l| l.split('=').nth(1))
-                .map(|s| s.trim().to_string())?;
-
-            if signal.len() != 1 {
-                return None;
-            }
-            let digit = signal.chars().next()?.to_ascii_uppercase();
-            if !"0123456789*#ABCD".contains(digit) {
-                return None;
-            }
-
-            emit_event(
-                &self.out_tx,
-                "dtmf_digit",
-                serde_json::json!({
-                    "call_id": self.call_id,
-                    "digit": digit.to_string(),
-                    "source": "sip-info",
-                }),
-            );
-
-            return Some(digit);
-        }
-
-        if ct.contains("application/dtmf") {
-            let digit = body.trim().chars().next()?.to_ascii_uppercase();
-            if !"0123456789*#ABCD".contains(digit) {
-                return None;
-            }
-
-            emit_event(
-                &self.out_tx,
-                "dtmf_digit",
-                serde_json::json!({
-                    "call_id": self.call_id,
-                    "digit": digit.to_string(),
-                    "source": "sip-info",
-                }),
-            );
-
-            return Some(digit);
-        }
-
-        None
-    }
-}

rust/crates/proxy-engine/src/main.rs

@@ -10,7 +10,6 @@ mod audio_player;
 mod call;
 mod call_manager;
 mod config;
-mod dtmf;
 mod ipc;
 mod jitter_buffer;
 mod leg_io;
@@ -140,7 +139,6 @@ async fn handle_command(
         "configure" => handle_configure(engine, out_tx, &cmd).await,
         "hangup" => handle_hangup(engine, out_tx, &cmd).await,
         "make_call" => handle_make_call(engine, out_tx, &cmd).await,
-        "get_status" => handle_get_status(engine, out_tx, &cmd).await,
         "add_leg" => handle_add_leg(engine, out_tx, &cmd).await,
         "remove_leg" => handle_remove_leg(engine, out_tx, &cmd).await,
         // WebRTC commands — lock webrtc only (no engine contention).
@@ -330,7 +328,7 @@ async fn handle_sip_packet(
             ..
         } = *eng;
         let rtp_pool = rtp_pool.as_mut().unwrap();
-        let call_id = call_mgr
+        let inbound = call_mgr
             .create_inbound_call(
                 &msg,
                 from_addr,
@@ -344,7 +342,7 @@ async fn handle_sip_packet(
             )
             .await;
 
-        if let Some(call_id) = call_id {
+        if let Some(inbound) = inbound {
             // Emit event so TypeScript knows about the call (for dashboard, IVR routing, etc).
             let from_header = msg.get_header("From").unwrap_or("");
             let from_uri = SipMessage::extract_uri(from_header).unwrap_or("Unknown");
@@ -357,10 +355,11 @@ async fn handle_sip_packet(
                 &eng.out_tx,
                 "incoming_call",
                 serde_json::json!({
-                    "call_id": call_id,
+                    "call_id": inbound.call_id,
                     "from_uri": from_uri,
                     "to_number": called_number,
                     "provider_id": provider_id,
+                    "ring_browsers": inbound.ring_browsers,
                 }),
             );
         }
@@ -383,7 +382,7 @@ async fn handle_sip_packet(
         let route_result = config_ref.resolve_outbound_route(
             &dialed_number,
             device_id.as_deref(),
-            &|pid: &str| {
+            &|_pid: &str| {
                 // Can't call async here — use a sync check.
                 // For now, assume all configured providers are available.
                 true
@@ -454,13 +453,6 @@ async fn handle_sip_packet(
     );
 }
 
-/// Handle `get_status` — return active call statuses from Rust.
-async fn handle_get_status(engine: Arc<Mutex<ProxyEngine>>, out_tx: &OutTx, cmd: &Command) {
-    let eng = engine.lock().await;
-    let calls = eng.call_mgr.get_all_statuses();
-    respond_ok(out_tx, &cmd.id, serde_json::json!({ "calls": calls }));
-}
-
 /// Handle `make_call` — initiate an outbound call to a number via a provider.
 async fn handle_make_call(engine: Arc<Mutex<ProxyEngine>>, out_tx: &OutTx, cmd: &Command) {
     let number = match cmd.params.get("number").and_then(|v| v.as_str()) {
@@ -665,6 +657,7 @@ async fn handle_webrtc_link(
                         webrtc_session_id: Some(session_id.clone()),
                         rtp_socket: None,
                         rtp_port: 0,
+                        public_ip: None,
                         remote_media: None,
                         signaling_addr: None,
                         metadata: std::collections::HashMap::new(),
@@ -1116,6 +1109,7 @@ async fn handle_add_tool_leg(
                 webrtc_session_id: None,
                 rtp_socket: None,
                 rtp_port: 0,
+                public_ip: None,
                 remote_media: None,
                 signaling_addr: None,
                 metadata,

rust/crates/proxy-engine/src/mixer.rs

@@ -39,6 +39,10 @@ pub struct RtpPacket {
     /// RTP sequence number for reordering.
     pub seq: u16,
     /// RTP timestamp from the original packet header.
+    ///
+    /// Set on inbound RTP but not yet consumed downstream — reserved for
+    /// future jitter/sync work in the mixer.
+    #[allow(dead_code)]
     pub timestamp: u32,
 }
 
@@ -136,8 +140,6 @@ pub enum MixerCommand {
         timeout_ms: u32,
         result_tx: oneshot::Sender<InteractionResult>,
     },
-    /// Cancel an in-progress interaction (e.g., leg being removed).
-    CancelInteraction { leg_id: String },
 
     /// Add a tool leg that receives per-source unmerged audio.
     AddToolLeg {
@@ -295,16 +297,6 @@ async fn mixer_loop(
                         let _ = result_tx.send(InteractionResult::Cancelled);
                     }
                 }
-                Ok(MixerCommand::CancelInteraction { leg_id }) => {
-                    if let Some(slot) = legs.get_mut(&leg_id) {
-                        if let LegRole::Isolated(ref mut state) = slot.role {
-                            if let Some(tx) = state.result_tx.take() {
-                                let _ = tx.send(InteractionResult::Cancelled);
-                            }
-                        }
-                        slot.role = LegRole::Participant;
-                    }
-                }
                 Ok(MixerCommand::AddToolLeg {
                     leg_id,
                     tool_type,

rust/crates/proxy-engine/src/provider.rs

@@ -331,17 +331,6 @@ impl ProviderManager {
         }
         None
     }
-
-    /// Check if a provider is currently registered.
-    pub async fn is_registered(&self, provider_id: &str) -> bool {
-        for ps_arc in &self.providers {
-            let ps = ps_arc.lock().await;
-            if ps.config.id == provider_id {
-                return ps.is_registered;
-            }
-        }
-        false
-    }
 }
 
 /// Registration loop for a single provider.

rust/crates/proxy-engine/src/recorder.rs

@@ -178,5 +178,8 @@ impl Recorder {
 pub struct RecordingResult {
     pub file_path: String,
     pub duration_ms: u64,
+    // Running-sample total kept for parity with the TS recorder; not yet
+    // surfaced through any event or dashboard field.
+    #[allow(dead_code)]
     pub total_samples: u64,
 }

rust/crates/proxy-engine/src/registrar.rs

@@ -19,11 +19,19 @@ const MAX_EXPIRES: u32 = 300;
 #[derive(Debug, Clone)]
 pub struct RegisteredDevice {
     pub device_id: String,
+    // These fields are populated at REGISTER time for logging/debugging but are
+    // not read back — device identity flows via the `device_registered` push
+    // event, not via struct queries. Kept behind allow(dead_code) because
+    // removing them would churn handle_register for no runtime benefit.
+    #[allow(dead_code)]
     pub display_name: String,
+    #[allow(dead_code)]
     pub extension: String,
     pub contact_addr: SocketAddr,
+    #[allow(dead_code)]
     pub registered_at: Instant,
     pub expires_at: Instant,
+    #[allow(dead_code)]
     pub aor: String,
 }
 
@@ -134,11 +142,6 @@ impl Registrar {
         Some(entry.contact_addr)
     }
 
-    /// Check if a source address belongs to a known device.
-    pub fn is_known_device_address(&self, addr: &str) -> bool {
-        self.devices.iter().any(|d| d.expected_address == addr)
-    }
-
     /// Find a registered device by its source IP address.
     pub fn find_by_address(&self, addr: &SocketAddr) -> Option<&RegisteredDevice> {
         let ip = addr.ip().to_string();
@@ -146,26 +149,4 @@ impl Registrar {
             e.contact_addr.ip().to_string() == ip && Instant::now() <= e.expires_at
         })
     }
-
-    /// Get all device statuses for the dashboard.
-    pub fn get_all_statuses(&self) -> Vec<serde_json::Value> {
-        let now = Instant::now();
-        let mut result = Vec::new();
-
-        for dc in &self.devices {
-            let reg = self.registered.get(&dc.id);
-            let connected = reg.map(|r| now <= r.expires_at).unwrap_or(false);
-            result.push(serde_json::json!({
-                "id": dc.id,
-                "displayName": dc.display_name,
-                "address": reg.filter(|_| connected).map(|r| r.contact_addr.ip().to_string()),
-                "port": reg.filter(|_| connected).map(|r| r.contact_addr.port()),
-                "aor": reg.map(|r| r.aor.as_str()).unwrap_or(""),
-                "connected": connected,
-                "isBrowser": false,
-            }));
-        }
-
-        result
-    }
 }

rust/crates/proxy-engine/src/rtp.rs

@@ -1,17 +1,19 @@
-//! RTP port pool and media forwarding.
+//! RTP port pool for media sockets.
 //!
-//! Manages a pool of even-numbered UDP ports for RTP media.
-//! Each port gets a bound tokio UdpSocket. Supports:
-//! - Direct forwarding (SIP-to-SIP, no transcoding)
-//! - Transcoding forwarding (via codec-lib, e.g. G.722 ↔ Opus)
-//! - Silence generation
-//! - NAT priming
+//! Manages a pool of even-numbered UDP ports for RTP media. `allocate()`
+//! hands back an `Arc<UdpSocket>` to the caller (stored on the owning
+//! `LegInfo`), while the pool itself keeps only a `Weak<UdpSocket>`. When
+//! the call terminates and `LegInfo` is dropped, the strong refcount
+//! reaches zero, the socket is closed, and `allocate()` prunes the dead
+//! weak ref the next time it scans that slot — so the port automatically
+//! becomes available for reuse without any explicit `release()` plumbing.
 //!
-//! Ported from ts/call/rtp-port-pool.ts + sip-leg.ts RTP handling.
+//! This fixes the previous leak where the pool held `Arc<UdpSocket>` and
+//! `release()` was never called, eventually exhausting the port range and
+//! causing "503 Service Unavailable" on new calls.
 
 use std::collections::HashMap;
-use std::net::SocketAddr;
-use std::sync::Arc;
+use std::sync::{Arc, Weak};
 use tokio::net::UdpSocket;
 
 /// A single RTP port allocation.
@@ -24,7 +26,7 @@ pub struct RtpAllocation {
 pub struct RtpPortPool {
     min: u16,
     max: u16,
-    allocated: HashMap<u16, Arc<UdpSocket>>,
+    allocated: HashMap<u16, Weak<UdpSocket>>,
 }
 
 impl RtpPortPool {
@@ -41,11 +43,19 @@ impl RtpPortPool {
     pub async fn allocate(&mut self) -> Option<RtpAllocation> {
         let mut port = self.min;
         while port < self.max {
+            // Prune a dead weak ref at this slot: if the last strong Arc
+            // (held by the owning LegInfo) was dropped when the call ended,
+            // the socket is already closed and the slot is free again.
+            if let Some(weak) = self.allocated.get(&port) {
+                if weak.strong_count() == 0 {
+                    self.allocated.remove(&port);
+                }
+            }
             if !self.allocated.contains_key(&port) {
                 match UdpSocket::bind(format!("0.0.0.0:{port}")).await {
                     Ok(sock) => {
                         let sock = Arc::new(sock);
-                        self.allocated.insert(port, sock.clone());
+                        self.allocated.insert(port, Arc::downgrade(&sock));
                         return Some(RtpAllocation { port, socket: sock });
                     }
                     Err(_) => {
@@ -57,83 +67,6 @@ impl RtpPortPool {
         }
         None // Pool exhausted.
     }
-
-    /// Release a port back to the pool.
-    pub fn release(&mut self, port: u16) {
-        self.allocated.remove(&port);
-        // Socket is dropped when the last Arc reference goes away.
-    }
-
-    pub fn size(&self) -> usize {
-        self.allocated.len()
-    }
-
-    pub fn capacity(&self) -> usize {
-        ((self.max - self.min) / 2) as usize
-    }
-}
-
-/// An active RTP relay between two endpoints.
-/// Receives on `local_socket` and forwards to `remote_addr`.
-pub struct RtpRelay {
-    pub local_port: u16,
-    pub local_socket: Arc<UdpSocket>,
-    pub remote_addr: Option<SocketAddr>,
-    /// If set, transcode packets using this codec session before forwarding.
-    pub transcode: Option<TranscodeConfig>,
-    /// Packets received counter.
-    pub pkt_received: u64,
-    /// Packets sent counter.
-    pub pkt_sent: u64,
-}
-
-pub struct TranscodeConfig {
-    pub from_pt: u8,
-    pub to_pt: u8,
-    pub session_id: String,
-}
-
-impl RtpRelay {
-    pub fn new(port: u16, socket: Arc<UdpSocket>) -> Self {
-        Self {
-            local_port: port,
-            local_socket: socket,
-            remote_addr: None,
-            transcode: None,
-            pkt_received: 0,
-            pkt_sent: 0,
-        }
-    }
-
-    pub fn set_remote(&mut self, addr: SocketAddr) {
-        self.remote_addr = Some(addr);
-    }
-}
-
-/// Send a 1-byte NAT priming packet to open a pinhole.
-pub async fn prime_nat(socket: &UdpSocket, remote: SocketAddr) {
-    let _ = socket.send_to(&[0u8], remote).await;
-}
-
-/// Build an RTP silence frame for PCMU (payload type 0).
-pub fn silence_frame_pcmu() -> Vec<u8> {
-    // 12-byte RTP header + 160 bytes of µ-law silence (0xFF)
-    let mut frame = vec![0u8; 172];
-    frame[0] = 0x80; // V=2
-    frame[1] = 0; // PT=0 (PCMU)
-    // seq, timestamp, ssrc left as 0 — caller should set these
-    frame[12..].fill(0xFF); // µ-law silence
-    frame
-}
-
-/// Build an RTP silence frame for G.722 (payload type 9).
-pub fn silence_frame_g722() -> Vec<u8> {
-    // 12-byte RTP header + 160 bytes of G.722 silence
-    let mut frame = vec![0u8; 172];
-    frame[0] = 0x80; // V=2
-    frame[1] = 9; // PT=9 (G.722)
-    // G.722 silence: all zeros is valid silence
-    frame
 }
 
 /// Build an RTP header with the given parameters.

rust/crates/proxy-engine/src/sip_leg.rs

@@ -16,7 +16,6 @@ use sip_proto::helpers::{
 };
 use sip_proto::message::{RequestOptions, SipMessage};
 use std::net::SocketAddr;
-use std::sync::Arc;
 use tokio::net::UdpSocket;
 
 /// State of a SIP leg.
@@ -40,6 +39,9 @@ pub struct SipLegConfig {
     /// SIP target endpoint (provider outbound proxy or device address).
     pub sip_target: SocketAddr,
     /// Provider credentials (for 407 auth).
+    // username is carried for parity with the provider config but digest auth
+    // rebuilds the username from the registered AOR, so this slot is never read.
+    #[allow(dead_code)]
     pub username: Option<String>,
     pub password: Option<String>,
     pub registered_aor: Option<String>,
@@ -51,6 +53,10 @@ pub struct SipLegConfig {
 
 /// A SIP leg with full dialog management.
 pub struct SipLeg {
+    // Leg identity is tracked via the enclosing LegInfo's key in the call's
+    // leg map; SipLeg itself never reads this field back. Kept to preserve
+    // the (id, config) constructor shape used by the call manager.
+    #[allow(dead_code)]
     pub id: String,
     pub state: LegState,
     pub config: SipLegConfig,
@@ -411,11 +417,6 @@ impl SipLeg {
         dialog.terminate();
         Some(msg.serialize())
     }
-
-    /// Get the SIP Call-ID for routing.
-    pub fn sip_call_id(&self) -> Option<&str> {
-        self.dialog.as_ref().map(|d| d.call_id.as_str())
-    }
 }
 
 /// Actions produced by the SipLeg message handler.

rust/crates/proxy-engine/src/sip_transport.rs

@@ -27,22 +27,6 @@ impl SipTransport {
         self.socket.clone()
     }
 
-    /// Send a raw SIP message to a destination.
-    pub async fn send_to(&self, data: &[u8], dest: SocketAddr) -> Result<usize, String> {
-        self.socket
-            .send_to(data, dest)
-            .await
-            .map_err(|e| format!("send to {dest}: {e}"))
-    }
-
-    /// Send a raw SIP message to an address:port pair.
-    pub async fn send_to_addr(&self, data: &[u8], addr: &str, port: u16) -> Result<usize, String> {
-        let dest: SocketAddr = format!("{addr}:{port}")
-            .parse()
-            .map_err(|e| format!("bad address {addr}:{port}: {e}"))?;
-        self.send_to(data, dest).await
-    }
-
     /// Spawn the UDP receive loop. Calls the handler for every received packet.
     pub fn spawn_receiver<F>(
         &self,

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: 'siprouter',
-  version: '1.19.0',
+  version: '1.20.2',
   description: 'undefined'
 }

ts/proxybridge.ts

@@ -94,6 +94,11 @@ export interface IIncomingCallEvent {
   from_uri: string;
   to_number: string;
   provider_id: string;
+  /** Whether registered browsers should see a `webrtc-incoming` toast for
+   *  this call. Set by the Rust engine from the matched inbound route's
+   *  `ringBrowsers` flag (defaults to `true` when no route matches, so
+   *  deployments without explicit routes preserve pre-routing behavior). */
+  ring_browsers?: boolean;
 }
 
 export interface IOutboundCallEvent {
@@ -134,8 +139,22 @@ let logFn: ((msg: string) => void) | undefined;
 
 function buildLocalPaths(): string[] {
   const root = process.cwd();
+  // Map Node's process.arch to tsrust's friendly target name.
+  // tsrust writes multi-target binaries as <bin>_<os>_<arch>,
+  // e.g. proxy-engine_linux_amd64 / proxy-engine_linux_arm64.
+  const archSuffix =
+    process.arch === 'arm64' ? 'linux_arm64' :
+    process.arch === 'x64'   ? 'linux_amd64' :
+    null;
+  const multiTarget = archSuffix
+    ? [path.join(root, 'dist_rust', `proxy-engine_${archSuffix}`)]
+    : [];
   return [
+    // 1. Multi-target output matching the running host arch (Docker image, CI, multi-target dev).
+    ...multiTarget,
+    // 2. Single-target (unsuffixed) output — legacy/fallback when tsrust runs without targets.
     path.join(root, 'dist_rust', 'proxy-engine'),
+    // 3. Direct cargo builds for dev iteration.
     path.join(root, 'rust', 'target', 'release', 'proxy-engine'),
     path.join(root, 'rust', 'target', 'debug', 'proxy-engine'),
   ];

ts/sipproxy.ts

@@ -273,15 +273,23 @@ async function startProxyEngine(): Promise<void> {
       legs: new Map(),
     });
 
-    // Notify browsers of incoming call.
-    const browserIds = getAllBrowserDeviceIds();
-    for (const bid of browserIds) {
-      sendToBrowserDevice(bid, {
-        type: 'webrtc-incoming',
-        callId: data.call_id,
-        from: data.from_uri,
-        deviceId: bid,
-      });
+    // Notify browsers of the incoming call, but only if the matched inbound
+    // route asked for it. `ring_browsers !== false` preserves today's
+    // ring-by-default behavior for any Rust release that predates this
+    // field or for the fallback "no route matched" case (where Rust still
+    // sends `true`). Note: this is an informational toast — browsers do
+    // NOT race the SIP device to answer. First-to-answer-wins requires
+    // a multi-leg fork which is not yet implemented.
+    if (data.ring_browsers !== false) {
+      const browserIds = getAllBrowserDeviceIds();
+      for (const bid of browserIds) {
+        sendToBrowserDevice(bid, {
+          type: 'webrtc-incoming',
+          callId: data.call_id,
+          from: data.from_uri,
+          deviceId: bid,
+        });
+      }
     }
   });
 

ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: 'siprouter',
-  version: '1.19.0',
+  version: '1.20.2',
   description: 'undefined'
 }

ts_web/elements/sipproxy-app.ts

@@ -18,7 +18,7 @@ const VIEW_TABS = [
   { name: 'Phone', iconName: 'lucide:headset', element: SipproxyViewPhone },
   { name: 'Routes', iconName: 'lucide:route', element: SipproxyViewRoutes },
   { name: 'Voicemail', iconName: 'lucide:voicemail', element: SipproxyViewVoicemail },
-  { name: 'IVR', iconName: 'lucide:list-tree', element: SipproxyViewIvr },
+  { name: 'IVR', iconName: 'lucide:ListTree', element: SipproxyViewIvr },
   { name: 'Contacts', iconName: 'lucide:contactRound', element: SipproxyViewContacts },
   { name: 'Providers', iconName: 'lucide:server', element: SipproxyViewProviders },
   { name: 'Log', iconName: 'lucide:scrollText', element: SipproxyViewLog },

ts_web/elements/sipproxy-view-calls.ts

@@ -422,7 +422,7 @@ export class SipproxyViewCalls extends DeesElement {
       menuOptions: [
         {
           name: 'Transfer',
-          iconName: 'lucide:arrow-right-left',
+          iconName: 'lucide:ArrowRightLeft',
           action: async (modalRef: any) => {
             if (!targetCallId || !targetLegId) {
               deesCatalog.DeesToast.error('Please select both a target call and a leg');
@@ -620,7 +620,7 @@ export class SipproxyViewCalls extends DeesElement {
         title: 'Inbound',
         value: inboundCount,
         type: 'number',
-        icon: 'lucide:phone-incoming',
+        icon: 'lucide:PhoneIncoming',
         description: 'Incoming calls',
       },
       {
@@ -628,7 +628,7 @@ export class SipproxyViewCalls extends DeesElement {
         title: 'Outbound',
         value: outboundCount,
         type: 'number',
-        icon: 'lucide:phone-outgoing',
+        icon: 'lucide:PhoneOutgoing',
         description: 'Outgoing calls',
       },
     ];

ts_web/elements/sipproxy-view-ivr.ts

@@ -140,7 +140,7 @@ export class SipproxyViewIvr extends DeesElement {
         title: 'Total Menus',
         value: ivr.menus.length,
         type: 'number',
-        icon: 'lucide:list-tree',
+        icon: 'lucide:ListTree',
         description: 'IVR menu definitions',
       },
       {
@@ -148,7 +148,7 @@ export class SipproxyViewIvr extends DeesElement {
         title: 'Entry Menu',
         value: entryMenu?.name || '(none)',
         type: 'text' as any,
-        icon: 'lucide:door-open',
+        icon: 'lucide:DoorOpen',
         description: entryMenu ? `ID: ${entryMenu.id}` : 'No entry menu set',
       },
       {
@@ -156,7 +156,7 @@ export class SipproxyViewIvr extends DeesElement {
         title: 'Status',
         value: ivr.enabled ? 'Enabled' : 'Disabled',
         type: 'text' as any,
-        icon: ivr.enabled ? 'lucide:check-circle' : 'lucide:x-circle',
+        icon: ivr.enabled ? 'lucide:CheckCircle' : 'lucide:XCircle',
         color: ivr.enabled ? 'hsl(142.1 76.2% 36.3%)' : 'hsl(0 84.2% 60.2%)',
         description: ivr.enabled ? 'IVR is active' : 'IVR is inactive',
       },
@@ -228,7 +228,7 @@ export class SipproxyViewIvr extends DeesElement {
       },
       {
         name: 'Set as Entry',
-        iconName: 'lucide:door-open' as any,
+        iconName: 'lucide:DoorOpen' as any,
         type: ['inRow'] as any,
         actionFunc: async ({ item }: { item: IIvrMenu }) => {
           await this.setEntryMenu(item.id);
@@ -236,7 +236,7 @@ export class SipproxyViewIvr extends DeesElement {
       },
       {
         name: 'Delete',
-        iconName: 'lucide:trash-2' as any,
+        iconName: 'lucide:Trash2' as any,
         type: ['inRow'] as any,
         actionFunc: async ({ item }: { item: IIvrMenu }) => {
           await this.confirmDeleteMenu(item);
@@ -295,7 +295,7 @@ export class SipproxyViewIvr extends DeesElement {
         },
         {
           name: 'Delete',
-          iconName: 'lucide:trash-2',
+          iconName: 'lucide:Trash2',
           action: async (modalRef: any) => {
             const ivr = this.getIvrConfig();
             const menus = ivr.menus.filter((m) => m.id !== menu.id);

ts_web/elements/sipproxy-view-overview.ts

@@ -107,7 +107,7 @@ export class SipproxyViewOverview extends DeesElement {
         title: 'Inbound Calls',
         value: inboundCalls,
         type: 'number',
-        icon: 'lucide:phone-incoming',
+        icon: 'lucide:PhoneIncoming',
         description: 'Currently active',
       },
       {
@@ -115,7 +115,7 @@ export class SipproxyViewOverview extends DeesElement {
         title: 'Outbound Calls',
         value: outboundCalls,
         type: 'number',
-        icon: 'lucide:phone-outgoing',
+        icon: 'lucide:PhoneOutgoing',
         description: 'Currently active',
       },
       {

ts_web/elements/sipproxy-view-providers.ts

@@ -86,7 +86,7 @@ export class SipproxyViewProviders extends DeesElement {
         title: 'Registered',
         value: registered,
         type: 'number',
-        icon: 'lucide:check-circle',
+        icon: 'lucide:CheckCircle',
         color: 'hsl(142.1 76.2% 36.3%)',
         description: 'Active registrations',
       },
@@ -95,7 +95,7 @@ export class SipproxyViewProviders extends DeesElement {
         title: 'Unregistered',
         value: unregistered,
         type: 'number',
-        icon: 'lucide:alert-circle',
+        icon: 'lucide:AlertCircle',
         color: unregistered > 0 ? 'hsl(0 84.2% 60.2%)' : undefined,
         description: unregistered > 0 ? 'Needs attention' : 'All healthy',
       },
@@ -153,7 +153,7 @@ export class SipproxyViewProviders extends DeesElement {
       },
       {
         name: 'Delete',
-        iconName: 'lucide:trash-2',
+        iconName: 'lucide:Trash2',
         type: ['inRow'] as any,
         actionFunc: async (actionData: any) => {
           await this.confirmDelete(actionData.item);
@@ -579,7 +579,7 @@ export class SipproxyViewProviders extends DeesElement {
         },
         {
           name: 'Delete',
-          iconName: 'lucide:trash-2',
+          iconName: 'lucide:Trash2',
           action: async (modalRef: any) => {
             try {
               const result = await appState.apiSaveConfig({

ts_web/elements/sipproxy-view-voicemail.ts

@@ -239,7 +239,7 @@ export class SipproxyViewVoicemail extends DeesElement {
         },
         {
           name: 'Delete',
-          iconName: 'lucide:trash-2',
+          iconName: 'lucide:Trash2',
           action: async (modalRef: any) => {
             try {
               await fetch(
@@ -281,7 +281,7 @@ export class SipproxyViewVoicemail extends DeesElement {
         title: 'Unheard Messages',
         value: unheard,
         type: 'number',
-        icon: 'lucide:bell-ring',
+        icon: 'lucide:BellRing',
         color: unheard > 0 ? 'hsl(0 84.2% 60.2%)' : 'hsl(142.1 76.2% 36.3%)',
         description: unheard > 0 ? 'Needs attention' : 'All caught up',
       },
@@ -372,7 +372,7 @@ export class SipproxyViewVoicemail extends DeesElement {
       },
       {
         name: 'Delete',
-        iconName: 'lucide:trash-2',
+        iconName: 'lucide:Trash2',
         type: ['inRow'] as any,
         actionFunc: async (actionData: any) => {
           await this.deleteMessage(actionData.item as IVoicemailMessage);