server: send granted traffic from the address the session actually used

fmr binds two IPv4 addresses. connFor picked whichever socket of the right
family came first in the bind list, so a downtrain for a session established on
.150 went out from .151 — and every packet was dropped by the client's NAT,
which has no mapping for that pair. tcpdump on the server showed all 50 leaving;
the client saw none. Read as "100% downstream loss", which is the worst kind of
wrong: a confident measurement of something that never happened.

Sessions now record which of our own bound addresses received their traffic, and
granted sends (and delayed echo) go back out through that socket. The fallback
to a family match is kept for the case where nothing has been received yet, and
the test pins both paths — a single-homed lab can never reproduce this.

Also: the client-side halves of the same work — anonymizer (core-privacy), local
run archive with retention (core-archive), upload client, and the app's settings
and history screens.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -40,3 +40,6 @@ keystore.properties
 
 # wrangler build/dev artifacts
 web/.wrangler/
+
+# Eclipse/JDT output from the VSCodium Java extension — not a build artifact we own
+echolot-app/*/bin/

echolot-app/app/build.gradle.kts

@@ -16,8 +16,8 @@ android {
         applicationId = "app.echo_lot.app"
         minSdk = 26
         targetSdk = 36
-        versionCode = 1
+        versionCode = 2
-        versionName = "0.1.0"
+        versionName = "0.2.0"
         // Automation: `adb shell am start -n app.echo_lot.app/.MainActivity --ez autorun true`
         // runs a measurement immediately and POSTs the report here (dev collection endpoint).
         buildConfigField("String", "REPORT_UPLOAD_URL", "\"http://89.185.109.150:443/report\"")
@@ -48,6 +48,8 @@ dependencies {
     implementation(project(":core-engine"))
     implementation(project(":core-probe"))
     implementation(project(":core-shizuku"))
+    implementation(project(":core-privacy"))
+    implementation(project(":core-archive"))
 
     implementation(libs.kotlinx.serialization.json)
     implementation(libs.kotlinx.coroutines.android)

echolot-app/app/src/main/kotlin/app/echo_lot/app/HistoryScreen.kt

@@ -0,0 +1,107 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.app
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.material3.Card
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.unit.dp
+import app.echo_lot.archive.ArchivedRun
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+
+/**
+ * Archived runs, newest first.
+ *
+ * Each row states plainly whether the run left the device, because "is this backed up / did I
+ * share this?" is the question a history list actually gets asked.
+ */
+@Composable
+fun HistoryScreen(
+    runs: List<ArchivedRun>,
+    status: String?,
+    onOpen: (String) -> Unit,
+    onUpload: (String) -> Unit,
+    onDelete: (String) -> Unit,
+    onBack: () -> Unit,
+) {
+    Column(Modifier.fillMaxWidth().padding(16.dp), verticalArrangement = Arrangement.spacedBy(10.dp)) {
+        Row(verticalAlignment = Alignment.CenterVertically) {
+            TextButton(onClick = onBack) { Text("‹ Back") }
+            Text("History", style = MaterialTheme.typography.titleLarge)
+        }
+        status?.let { Text(it, style = MaterialTheme.typography.bodySmall) }
+
+        if (runs.isEmpty()) {
+            Text(
+                "No archived runs yet. Finished runs are kept here automatically unless you turn " +
+                    "archiving off in settings.",
+                style = MaterialTheme.typography.bodyMedium,
+            )
+            return@Column
+        }
+
+        LazyColumn(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+            items(runs, key = { it.id }) { r ->
+                Card(Modifier.fillMaxWidth()) {
+                    Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                        Row(verticalAlignment = Alignment.CenterVertically) {
+                            Text(
+                                r.verdict?.uppercase() ?: "—",
+                                color = verdictTint(r.verdict),
+                                style = MaterialTheme.typography.titleMedium,
+                            )
+                            Text(
+                                "  " + humanTime(r.savedAtEpochMs),
+                                style = MaterialTheme.typography.bodyMedium,
+                            )
+                        }
+                        Text(
+                            "${r.findingCount} finding(s) · ${r.sizeBytes / 1024} kB · ${r.anonymization}",
+                            style = MaterialTheme.typography.bodySmall,
+                        )
+                        Text(
+                            if (r.uploaded) "uploaded to ${r.uploadedTo ?: "a server"}"
+                            else "on this device only",
+                            style = MaterialTheme.typography.bodySmall,
+                            color = if (r.uploaded) Color(0xFF7FD17F) else Color(0xFFBBBBBB),
+                        )
+                        Row(horizontalArrangement = Arrangement.spacedBy(4.dp)) {
+                            TextButton(onClick = { onOpen(r.id) }) { Text("Export") }
+                            TextButton(onClick = { onUpload(r.id) }) {
+                                Text(if (r.uploaded) "Upload again" else "Upload")
+                            }
+                            TextButton(onClick = { onDelete(r.id) }) { Text("Delete") }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+private fun verdictTint(v: String?): Color = when (v?.lowercase()) {
+    "green", "ok", "pass" -> Color(0xFF7FD17F)
+    "yellow", "warn" -> Color(0xFFE0C060)
+    "red", "fail" -> Color(0xFFE07070)
+    else -> Color(0xFFBBBBBB)
+}
+
+private val stamp: DateTimeFormatter =
+    DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm").withZone(ZoneId.systemDefault())
+
+private fun humanTime(epochMs: Long): String = stamp.format(Instant.ofEpochMilli(epochMs))

echolot-app/app/src/main/kotlin/app/echo_lot/app/MainActivity.kt

@@ -18,6 +18,10 @@ import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.*
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
@@ -26,9 +30,14 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import androidx.core.content.ContextCompat
+import androidx.lifecycle.lifecycleScope
+import kotlinx.coroutines.launch
 import androidx.lifecycle.viewmodel.compose.viewModel
 import app.echo_lot.measurement.*
 
+/** The app's three top-level screens. */
+private enum class Screen { RUN, HISTORY, SETTINGS }
+
 class MainActivity : ComponentActivity() {
 
     private val permissionLauncher =
@@ -41,13 +50,17 @@ class MainActivity : ComponentActivity() {
             MaterialTheme(colorScheme = darkColorScheme()) {
                 Surface(color = MaterialTheme.colorScheme.background) {
                     val vm: RunViewModel = viewModel()
+                    // Three flat screens, so a plain state variable beats a navigation library:
+                    // there is no back stack to model beyond "return to the run screen".
+                    var screen by remember { mutableStateOf(Screen.RUN) }
+                    var preview by remember { mutableStateOf<String?>(null) }
                     // Automation entry point:
                     //   adb shell am start -n app.echo_lot.app/.MainActivity --ez autorun true
                     // starts a run immediately and uploads the report, so an unattended
                     // measurement needs no UI tapping and no adb round-trip to collect.
                     val autorun = intent?.getBooleanExtra("autorun", false) == true
                     androidx.compose.runtime.LaunchedEffect(autorun) {
-                        if (autorun) vm.run(upload = true)
+                        if (autorun) vm.run(devUpload = true)
                     }
                     // In autorun the app is a batch job: once the run is done AND the upload
                     // succeeded, show the result briefly, then close so the device is left as it
@@ -61,7 +74,42 @@ class MainActivity : ComponentActivity() {
                             finish()
                         }
                     }
-                    EcholotScreen(
+                    when (screen) {
+                      Screen.SETTINGS -> SettingsScreen(
+                        settings = vm.settings,
+                        archivedRuns = vm.state.history.size,
+                        archivedBytes = vm.archivedBytes(),
+                        onApplyRetention = vm::applyRetention,
+                        onDeleteAll = vm::deleteAllRuns,
+                        onPreviewUpload = {
+                            // Preview the newest run, since that is the one the user just made
+                            // and the one they are deciding about.
+                            vm.state.history.firstOrNull()?.let { r ->
+                                lifecycleScope.launch { preview = vm.uploadPreview(r.id) }
+                            }
+                        },
+                        onBack = { screen = Screen.RUN },
+                      )
+                      Screen.HISTORY -> HistoryScreen(
+                        runs = vm.state.history,
+                        status = vm.state.archiveStatus,
+                        onOpen = { id ->
+                            lifecycleScope.launch {
+                                vm.readRun(id)?.let { text ->
+                                    startActivity(
+                                        Intent.createChooser(
+                                            Report.shareJson(this@MainActivity, id, text),
+                                            "Export Echolot run",
+                                        )
+                                    )
+                                }
+                            }
+                        },
+                        onUpload = vm::uploadRun,
+                        onDelete = vm::deleteRun,
+                        onBack = { screen = Screen.RUN },
+                      )
+                      Screen.RUN -> EcholotScreen(
                         state = vm.state,
                         onRun = { vm.run() },
                         onCancel = vm::cancel,
@@ -86,8 +134,14 @@ class MainActivity : ComponentActivity() {
                             }
                         },
                         onExport = { doc -> startActivity(Intent.createChooser(Report.share(this, doc), "Export Echolot run")) },
+                        onOpenSettings = { screen = Screen.SETTINGS },
+                        onOpenHistory = { vm.refreshHistory(); screen = Screen.HISTORY },
                       )
                     }
+                    preview?.let { text ->
+                        UploadPreviewDialog(text) { preview = null }
+                    }
+                }
             }
         }
     }
@@ -123,6 +177,8 @@ private fun EcholotScreen(
     onShizukuAction: () -> Unit,
     onDeveloperOptions: () -> Unit,
     onExport: (MeasurementDocument) -> Unit,
+    onOpenSettings: () -> Unit,
+    onOpenHistory: () -> Unit,
 ) {
     Column(
         Modifier
@@ -135,8 +191,15 @@ private fun EcholotScreen(
             .verticalScroll(rememberScrollState()),
         verticalArrangement = Arrangement.spacedBy(12.dp),
     ) {
+        Row(Modifier.fillMaxWidth(), verticalAlignment = Alignment.CenterVertically) {
+            Column(Modifier.weight(1f)) {
                 Text("Echolot", fontSize = 26.sp, fontWeight = FontWeight.SemiBold)
-        Text("measure, don't guess", color = MaterialTheme.colorScheme.onSurfaceVariant, fontSize = 13.sp)
+                Text("measure, don't guess",
+                    color = MaterialTheme.colorScheme.onSurfaceVariant, fontSize = 13.sp)
+            }
+            TextButton(onClick = onOpenHistory) { Text("History") }
+            TextButton(onClick = onOpenSettings) { Text("Settings") }
+        }
 
         // Shell-tier readiness, before the run. Nothing is shown when Shizuku isn't installed —
         // only users who actually use it get reminded that it must be running.
@@ -185,6 +248,10 @@ private fun EcholotScreen(
             }
         }
 
+        state.archiveStatus?.let {
+            Text(it, fontSize = 12.sp, color = MaterialTheme.colorScheme.onSurfaceVariant)
+        }
+
         state.uploadStatus?.let {
             Text(it, fontSize = 12.sp, color = MaterialTheme.colorScheme.onSurfaceVariant)
         }
@@ -338,3 +405,24 @@ private fun Dot(color: Color) {
 private fun SectionTitle(text: String) {
     Text(text, fontWeight = FontWeight.SemiBold, fontSize = 15.sp, modifier = Modifier.padding(top = 8.dp))
 }
+
+/**
+ * Shows the exact JSON an upload would send.
+ *
+ * This exists because an anonymizer the user cannot inspect is just a promise. Being able to
+ * read the outgoing document — and find their own SSID absent from it — is what makes the
+ * privacy setting checkable rather than merely stated.
+ */
+@Composable
+private fun UploadPreviewDialog(text: String, onDismiss: () -> Unit) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        confirmButton = { TextButton(onClick = onDismiss) { Text("Close") } },
+        title = { Text("This is what would be uploaded") },
+        text = {
+            Column(Modifier.heightIn(max = 420.dp).verticalScroll(rememberScrollState())) {
+                Text(text, fontSize = 10.sp, fontFamily = FontFamily.Monospace)
+            }
+        },
+    )
+}

echolot-app/app/src/main/kotlin/app/echo_lot/app/Report.kt

@@ -17,10 +17,18 @@ object Report {
     fun toJson(doc: MeasurementDocument): String =
         json.encodeToString(MeasurementDocument.serializer(), doc)
 
-    fun share(ctx: Context, doc: MeasurementDocument): Intent {
+    fun share(ctx: Context, doc: MeasurementDocument): Intent =
+        shareJson(ctx, doc.run.id, toJson(doc))
+
+    /**
+     * Shares an already-serialized run — an archived one, whose bytes must go out exactly as
+     * stored rather than being re-serialized through the model (which would silently drop
+     * anything a newer schema version added).
+     */
+    fun shareJson(ctx: Context, runId: String, json: String): Intent {
         val dir = File(ctx.cacheDir, "reports").apply { mkdirs() }
-        val file = File(dir, "echolot-run-${doc.run.id}.json")
+        val file = File(dir, "echolot-run-$runId.json")
-        file.writeText(toJson(doc))
+        file.writeText(json)
         val uri = FileProvider.getUriForFile(ctx, "${ctx.packageName}.fileprovider", file)
         return Intent(Intent.ACTION_SEND).apply {
             type = "application/json"

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunStore.kt

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.app
+
+import android.content.Context
+import app.echo_lot.archive.ArchivedRun
+import app.echo_lot.archive.RunArchive
+import app.echo_lot.measurement.MeasurementDocument
+import app.echo_lot.privacy.Anonymizer
+import app.echo_lot.privacy.PrivacyLevel
+import app.echo_lot.privacy.Salt
+import app.echo_lot.protocol.ControlClient
+import app.echo_lot.protocol.UploadRefused
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.jsonObject
+import java.io.File
+import java.security.SecureRandom
+
+/**
+ * Ties together the three things that happen to a finished run: it gets archived, it may get
+ * anonymized, and it may get uploaded — in that order, and with the archive always holding the
+ * *unredacted* document.
+ *
+ * That ordering is the important decision. The local archive is the user's own data on their own
+ * device, and redacting it would destroy exactly the detail that makes a week-old run worth
+ * keeping; the anonymizer exists for the moment data crosses to someone else's machine. So
+ * redaction happens on the way out, per upload, and the archive is never the lossy copy.
+ */
+class RunStore(context: Context, private val settings: Settings) {
+
+    private val archive = RunArchive(File(context.filesDir, "runs"))
+    private val json = Json { encodeDefaults = true; explicitNulls = true }
+
+    fun list(): List<ArchivedRun> = archive.list()
+    fun read(id: String): String? = archive.read(id)
+    fun delete(id: String) = archive.delete(id)
+    fun deleteAll(): Int = archive.deleteAll()
+    fun totalBytes(): Long = archive.totalBytes()
+
+    /** Archives a finished run under the user's retention policy. Null when archiving is off. */
+    fun archive(doc: MeasurementDocument): ArchivedRun? =
+        archive.save(Report.toJson(doc), settings.retention())
+
+    /** Applies retention now — e.g. after the user tightens the limits in settings. */
+    fun purgeNow() = archive.purge(settings.retention())
+
+    /**
+     * Produces exactly the bytes an upload would send, so the UI can show the user their own
+     * document as the server will see it *before* it goes. "Preview what you're about to share"
+     * is the only honest way to present an anonymizer: its correctness is not something a user
+     * should have to take on faith.
+     */
+    fun redactedForUpload(docJson: String, level: PrivacyLevel = settings.privacyLevel): String {
+        val parsed = runCatching { json.parseToJsonElement(docJson).jsonObject }.getOrNull()
+            ?: return docJson
+        return json.encodeToString(JsonObject.serializer(), Anonymizer(level, salt()).anonymize(parsed))
+    }
+
+    private fun salt(): Salt =
+        if (settings.stableSalt) Salt.stable(settings.saltSecret())
+        else Salt.perRun(ByteArray(32).also { SecureRandom().nextBytes(it) })
+
+    sealed interface UploadOutcome {
+        data class Sent(val serverName: String, val detail: String) : UploadOutcome
+        /** The operator's policy says no. Not retryable, and not the user's fault. */
+        data class Refused(val reason: String) : UploadOutcome
+        data class Failed(val detail: String) : UploadOutcome
+        data object NotConfigured : UploadOutcome
+    }
+
+    /**
+     * Uploads one archived run to the configured server, redacting first.
+     *
+     * The server's advertised minimum wins over the user's preference when it is stricter — a
+     * server may demand more anonymization than the user chose, never less. Blocking; callers
+     * run it off the main thread.
+     */
+    fun upload(runId: String): UploadOutcome {
+        if (!settings.serverConfigured) return UploadOutcome.NotConfigured
+        val docJson = read(runId) ?: return UploadOutcome.Failed("run $runId is not in the archive")
+        return try {
+            val client = ControlClient(settings.serverUrl, setOf(settings.serverPin))
+            val profile = client.profile(settings.serverCredential)
+            profile.uploads.refusalReason()?.let { return UploadOutcome.Refused(it) }
+
+            val level = PrivacyLevel.max(
+                settings.privacyLevel,
+                PrivacyLevel.fromWire(profile.uploads.minAnonymization),
+            )
+            val body = redactedForUpload(docJson, level)
+            val reply = client.uploadRun(settings.serverCredential, body)
+            archive.markUploaded(runId, profile.name)
+            UploadOutcome.Sent(profile.name, "as $level, ${body.toByteArray().size} bytes: ${reply.take(120)}")
+        } catch (e: UploadRefused) {
+            UploadOutcome.Refused(e.message ?: "refused by the server")
+        } catch (t: Throwable) {
+            UploadOutcome.Failed(t.message ?: t.javaClass.simpleName)
+        }
+    }
+}

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt

@@ -38,6 +38,10 @@ data class UiState(
     val stepsDone: Int = 0,
     val stepsTotal: Int = 0,
     val etaSeconds: Int = 0,
+    /** Where the finished run went: archived locally, uploaded, or neither (and why). */
+    val archiveStatus: String? = null,
+    /** History, newest first. Refreshed after every run and whenever the history screen opens. */
+    val history: List<app.echo_lot.archive.ArchivedRun> = emptyList(),
     /** Shell-tier readiness, shown before a run; null message = say nothing (Shizuku not installed). */
     val shizukuNotice: String? = null,
     val shizukuReady: Boolean = false,
@@ -56,6 +60,9 @@ class RunViewModel(app: Application) : AndroidViewModel(app) {
     var state by mutableStateOf(UiState())
         private set
 
+    val settings = Settings(app)
+    private val store = RunStore(app, settings)
+
     private var runJob: kotlinx.coroutines.Job? = null
     private val stopShizukuObserver: () -> Unit
 
@@ -92,22 +99,111 @@ class RunViewModel(app: Application) : AndroidViewModel(app) {
     }
 
     /**
-     * Runs one measurement. With [upload] (autorun mode) the finished document is POSTed to the
+     * Runs one measurement, then archives it and — if the user has turned that on — uploads it.
-     * collection endpoint so an unattended run can be retrieved without adb.
+     *
+     * [devUpload] is the separate autorun/adb path (BuildConfig collection endpoint), kept apart
+     * from the user-facing upload so a debugging convenience can never be mistaken for, or
+     * silently satisfy, the consent-gated one.
      */
-    fun run(upload: Boolean = false) {
+    fun run(devUpload: Boolean = false) {
         if (state.running) return
         collected.clear()
-        state = state.copy(running = true, currentStep = "starting", document = null, uploadStatus = null)
+        state = state.copy(running = true, currentStep = "starting", document = null,
+            uploadStatus = null, archiveStatus = null)
         runJob = viewModelScope.launch {
             val doc = withContext(Dispatchers.IO) { measure() }
+
+            step("archiving")
+            val archived = withContext(Dispatchers.IO) { store.archive(doc) }
+            var archiveStatus = if (archived != null) {
+                "archived locally (${store.list().size} runs kept)"
+            } else {
+                "not archived — archiving is off in settings"
+            }
+
             var status: String? = null
-            if (upload) {
+            if (devUpload) {
                 state = state.copy(currentStep = "uploading report")
                 val r = withContext(Dispatchers.IO) { ReportUploader.upload(doc) }
                 status = if (r.ok) "uploaded ✓ ${r.detail}" else "upload failed: ${r.detail}"
             }
-            state = UiState(running = false, currentStep = null, document = doc, uploadStatus = status)
+            if (archived != null && settings.autoUpload) {
+                state = state.copy(currentStep = "uploading to server")
+                val outcome = withContext(Dispatchers.IO) { store.upload(archived.id) }
+                archiveStatus += " · " + describe(outcome)
+            }
+
+            state = UiState(
+                running = false, currentStep = null, document = doc,
+                uploadStatus = status, archiveStatus = archiveStatus,
+                history = withContext(Dispatchers.IO) { store.list() },
+            )
+        }
+    }
+
+    private fun describe(o: RunStore.UploadOutcome): String = when (o) {
+        is RunStore.UploadOutcome.Sent -> "uploaded to ${o.serverName} (${o.detail})"
+        is RunStore.UploadOutcome.Refused -> "server refused the upload: ${o.reason}"
+        is RunStore.UploadOutcome.Failed -> "upload failed: ${o.detail}"
+        RunStore.UploadOutcome.NotConfigured -> "no server configured, so nothing was uploaded"
+    }
+
+    // ---- history ---------------------------------------------------------------------
+
+    fun refreshHistory() {
+        viewModelScope.launch {
+            state = state.copy(history = withContext(Dispatchers.IO) { store.list() })
+        }
+    }
+
+    fun deleteRun(id: String) {
+        viewModelScope.launch {
+            withContext(Dispatchers.IO) { store.delete(id) }
+            state = state.copy(history = withContext(Dispatchers.IO) { store.list() })
+        }
+    }
+
+    fun deleteAllRuns() {
+        viewModelScope.launch {
+            val n = withContext(Dispatchers.IO) { store.deleteAll() }
+            state = state.copy(
+                history = emptyList(),
+                archiveStatus = "deleted $n archived run(s)",
+            )
+        }
+    }
+
+    /** Uploads one already-archived run on demand, regardless of the auto-upload setting. */
+    fun uploadRun(id: String) {
+        viewModelScope.launch {
+            state = state.copy(archiveStatus = "uploading …")
+            val outcome = withContext(Dispatchers.IO) { store.upload(id) }
+            state = state.copy(
+                archiveStatus = describe(outcome),
+                history = withContext(Dispatchers.IO) { store.list() },
+            )
+        }
+    }
+
+    /** The archived document as stored, for export. */
+    suspend fun readRun(id: String): String? = withContext(Dispatchers.IO) { store.read(id) }
+
+    /** The exact bytes an upload would send, for the settings screen's preview. */
+    suspend fun uploadPreview(id: String): String? = withContext(Dispatchers.IO) {
+        store.read(id)?.let { store.redactedForUpload(it) }
+    }
+
+    fun archivedBytes(): Long = store.totalBytes()
+
+    /** Re-applies retention after the user changes the limits. */
+    fun applyRetention() {
+        viewModelScope.launch {
+            val result = withContext(Dispatchers.IO) { store.purgeNow() }
+            state = state.copy(
+                history = withContext(Dispatchers.IO) { store.list() },
+                archiveStatus = if (result.isEmpty) "nothing to purge"
+                else "purged ${result.removed.size} run(s), freed ${result.freedBytes / 1024} kB",
+            )
         }
     }
 
@@ -122,6 +218,8 @@ class RunViewModel(app: Application) : AndroidViewModel(app) {
         state = UiState(
             running = false, currentStep = null, document = doc,
             uploadStatus = "cancelled after ${collected.size} test(s) — shown locally, not uploaded",
+            archiveStatus = "partial run — not archived",
+            history = state.history,
         )
     }
 

echolot-app/app/src/main/kotlin/app/echo_lot/app/Settings.kt

@@ -0,0 +1,124 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.app
+
+import android.content.Context
+import android.content.SharedPreferences
+import app.echo_lot.archive.RetentionPolicy
+import app.echo_lot.privacy.PrivacyLevel
+import java.security.SecureRandom
+
+/**
+ * User settings for archiving, uploading and anonymization.
+ *
+ * Defaults are the conservative reading of "an engineer's tool that still respects the person
+ * holding it": keep history (that is the point of the archive), never upload without being asked,
+ * and when uploading, strip identifiers unless the user says this is their own server.
+ *
+ * SharedPreferences rather than DataStore because these are a dozen scalars read synchronously at
+ * the start of a run; a coroutine-flow store would add a dependency and a lifecycle for nothing.
+ */
+class Settings(context: Context) {
+
+    private val prefs: SharedPreferences =
+        context.getSharedPreferences("echolot-settings", Context.MODE_PRIVATE)
+
+    // ---- archive ---------------------------------------------------------------------
+
+    var archiveEnabled: Boolean
+        get() = prefs.getBoolean(ARCHIVE_ENABLED, true)
+        set(v) = prefs.edit().putBoolean(ARCHIVE_ENABLED, v).apply()
+
+    /** 0 = no ceiling. */
+    var maxRuns: Int
+        get() = prefs.getInt(MAX_RUNS, 100)
+        set(v) = prefs.edit().putInt(MAX_RUNS, v.coerceAtLeast(0)).apply()
+
+    var maxAgeDays: Int
+        get() = prefs.getInt(MAX_AGE_DAYS, 90)
+        set(v) = prefs.edit().putInt(MAX_AGE_DAYS, v.coerceAtLeast(0)).apply()
+
+    var maxTotalMb: Int
+        get() = prefs.getInt(MAX_TOTAL_MB, 64)
+        set(v) = prefs.edit().putInt(MAX_TOTAL_MB, v.coerceAtLeast(0)).apply()
+
+    fun retention(): RetentionPolicy = RetentionPolicy(
+        enabled = archiveEnabled,
+        maxRuns = maxRuns,
+        maxAgeDays = maxAgeDays,
+        maxTotalBytes = maxTotalMb.toLong() * 1024 * 1024,
+    )
+
+    // ---- upload ----------------------------------------------------------------------
+
+    /**
+     * Off by default. Measurement data describes the network the user is standing in; sending it
+     * anywhere is a decision they make, not one they discover after the fact.
+     */
+    var autoUpload: Boolean
+        get() = prefs.getBoolean(AUTO_UPLOAD, false)
+        set(v) = prefs.edit().putBoolean(AUTO_UPLOAD, v).apply()
+
+    /** Anonymization applied before a run leaves the device. Never applied to the local archive. */
+    var privacyLevel: PrivacyLevel
+        get() = PrivacyLevel.fromWire(prefs.getString(PRIVACY_LEVEL, PrivacyLevel.BALANCED.wire))
+        set(v) = prefs.edit().putString(PRIVACY_LEVEL, v.wire).apply()
+
+    /**
+     * Whether pseudonyms stay stable across runs. That makes history diffable ("same SSID as
+     * last week") and is what someone wants on their own server — but it also produces an
+     * identifier that links a device's uploads, so it is off unless chosen.
+     */
+    var stableSalt: Boolean
+        get() = prefs.getBoolean(STABLE_SALT, false)
+        set(v) = prefs.edit().putBoolean(STABLE_SALT, v).apply()
+
+    /**
+     * The device-local secret behind stable pseudonyms. Generated once, never leaves the device,
+     * and clearing it (via [resetSalt]) breaks the link to everything uploaded before.
+     */
+    fun saltSecret(): ByteArray {
+        prefs.getString(SALT_SECRET, null)?.let { return hex(it) }
+        val fresh = ByteArray(32).also { SecureRandom().nextBytes(it) }
+        prefs.edit().putString(SALT_SECRET, fresh.joinToString("") { "%02x".format(it) }).apply()
+        return fresh
+    }
+
+    fun resetSalt() = prefs.edit().remove(SALT_SECRET).apply()
+
+    // ---- server ----------------------------------------------------------------------
+
+    var serverUrl: String
+        get() = prefs.getString(SERVER_URL, "") ?: ""
+        set(v) = prefs.edit().putString(SERVER_URL, v.trim()).apply()
+
+    var serverPin: String
+        get() = prefs.getString(SERVER_PIN, "") ?: ""
+        set(v) = prefs.edit().putString(SERVER_PIN, v.trim()).apply()
+
+    var serverCredential: String
+        get() = prefs.getString(SERVER_CRED, "") ?: ""
+        set(v) = prefs.edit().putString(SERVER_CRED, v.trim()).apply()
+
+    val serverConfigured: Boolean
+        get() = serverUrl.isNotBlank() && serverPin.isNotBlank() && serverCredential.isNotBlank()
+
+    private fun hex(s: String) = ByteArray(s.length / 2) {
+        ((Character.digit(s[it * 2], 16) shl 4) or Character.digit(s[it * 2 + 1], 16)).toByte()
+    }
+
+    private companion object {
+        const val ARCHIVE_ENABLED = "archive_enabled"
+        const val MAX_RUNS = "archive_max_runs"
+        const val MAX_AGE_DAYS = "archive_max_age_days"
+        const val MAX_TOTAL_MB = "archive_max_total_mb"
+        const val AUTO_UPLOAD = "auto_upload"
+        const val PRIVACY_LEVEL = "privacy_level"
+        const val STABLE_SALT = "stable_salt"
+        const val SALT_SECRET = "salt_secret"
+        const val SERVER_URL = "server_url"
+        const val SERVER_PIN = "server_pin"
+        const val SERVER_CRED = "server_credential"
+    }
+}

echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt

@@ -0,0 +1,214 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.app
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.Card
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Switch
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.unit.dp
+import app.echo_lot.privacy.PrivacyLevel
+
+/**
+ * Archiving, upload and anonymization settings.
+ *
+ * The screen is written to make the consequences legible rather than to look tidy: every toggle
+ * says what it means for the user's data in a sentence, and the privacy levels are described by
+ * what survives them, because "balanced" on its own tells nobody anything.
+ */
+@Composable
+fun SettingsScreen(
+    settings: Settings,
+    archivedRuns: Int,
+    archivedBytes: Long,
+    onApplyRetention: () -> Unit,
+    onDeleteAll: () -> Unit,
+    onPreviewUpload: () -> Unit,
+    onBack: () -> Unit,
+) {
+    // SharedPreferences is not observable, so mirror each value into Compose state and write
+    // through on change. A dozen scalars; a store with flows would be ceremony for nothing.
+    var archiveEnabled by remember { mutableStateOf(settings.archiveEnabled) }
+    var maxRuns by remember { mutableStateOf(settings.maxRuns.toString()) }
+    var maxAgeDays by remember { mutableStateOf(settings.maxAgeDays.toString()) }
+    var maxTotalMb by remember { mutableStateOf(settings.maxTotalMb.toString()) }
+    var autoUpload by remember { mutableStateOf(settings.autoUpload) }
+    var privacy by remember { mutableStateOf(settings.privacyLevel) }
+    var stableSalt by remember { mutableStateOf(settings.stableSalt) }
+    var serverUrl by remember { mutableStateOf(settings.serverUrl) }
+    var serverPin by remember { mutableStateOf(settings.serverPin) }
+    var serverCred by remember { mutableStateOf(settings.serverCredential) }
+
+    Column(
+        Modifier.fillMaxWidth().verticalScroll(rememberScrollState()).padding(16.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Row(verticalAlignment = Alignment.CenterVertically) {
+            TextButton(onClick = onBack) { Text("‹ Back") }
+            Text("Settings", style = MaterialTheme.typography.titleLarge)
+        }
+
+        // ---- archive ----
+        Card(Modifier.fillMaxWidth()) {
+            Column(Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text("Archive", style = MaterialTheme.typography.titleMedium)
+                Toggle(
+                    label = "Keep finished runs on this device",
+                    detail = "History is what makes a run comparable later. Archived runs are " +
+                        "stored complete and unredacted — anonymization only applies to uploads.",
+                    checked = archiveEnabled,
+                ) { archiveEnabled = it; settings.archiveEnabled = it }
+
+                Text(
+                    "Purge automatically when a run exceeds any of these. 0 turns that limit off.",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+                NumberField("Keep at most (runs)", maxRuns) {
+                    maxRuns = it; settings.maxRuns = it.toIntOrNull() ?: 0
+                }
+                NumberField("Delete older than (days)", maxAgeDays) {
+                    maxAgeDays = it; settings.maxAgeDays = it.toIntOrNull() ?: 0
+                }
+                NumberField("Keep at most (MB)", maxTotalMb) {
+                    maxTotalMb = it; settings.maxTotalMb = it.toIntOrNull() ?: 0
+                }
+                Text(
+                    "$archivedRuns run(s), ${archivedBytes / 1024} kB stored",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    Button(onClick = onApplyRetention) { Text("Apply now") }
+                    TextButton(onClick = onDeleteAll) { Text("Delete all runs") }
+                }
+            }
+        }
+
+        // ---- privacy ----
+        Card(Modifier.fillMaxWidth()) {
+            Column(Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text("What leaves the device", style = MaterialTheme.typography.titleMedium)
+                Text(
+                    "Applied to uploads only. Measurements, verdicts and finding codes survive " +
+                        "every level — only the parts that identify you or your network change.",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    for (level in PrivacyLevel.entries) {
+                        FilterChip(
+                            selected = privacy == level,
+                            onClick = { privacy = level; settings.privacyLevel = level },
+                            label = { Text(level.wire) },
+                        )
+                    }
+                }
+                Text(privacyExplanation(privacy), style = MaterialTheme.typography.bodySmall)
+
+                Toggle(
+                    label = "Stable pseudonyms across runs",
+                    detail = "Lets you compare uploaded runs over time (same SSID reads the same " +
+                        "each time). It also links your uploads together, so leave it off on a " +
+                        "server you don't run yourself.",
+                    checked = stableSalt,
+                ) { stableSalt = it; settings.stableSalt = it }
+
+                TextButton(onClick = onPreviewUpload) { Text("Preview what an upload would send") }
+            }
+        }
+
+        // ---- upload ----
+        Card(Modifier.fillMaxWidth()) {
+            Column(Modifier.padding(14.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text("Upload", style = MaterialTheme.typography.titleMedium)
+                Toggle(
+                    label = "Upload finished runs automatically",
+                    detail = "Sends each completed run to the server below, anonymized to the " +
+                        "level above. The server may require more anonymization than you chose; " +
+                        "it can never require less.",
+                    checked = autoUpload,
+                ) { autoUpload = it; settings.autoUpload = it }
+
+                OutlinedTextField(
+                    value = serverUrl, onValueChange = { serverUrl = it; settings.serverUrl = it },
+                    label = { Text("Server URL") }, singleLine = true, modifier = Modifier.fillMaxWidth(),
+                )
+                OutlinedTextField(
+                    value = serverPin, onValueChange = { serverPin = it; settings.serverPin = it },
+                    label = { Text("Certificate pin (SPKI, base64)") }, singleLine = true,
+                    textStyle = MaterialTheme.typography.bodySmall.copy(fontFamily = FontFamily.Monospace),
+                    modifier = Modifier.fillMaxWidth(),
+                )
+                OutlinedTextField(
+                    value = serverCred,
+                    onValueChange = { serverCred = it; settings.serverCredential = it },
+                    label = { Text("Device credential") }, singleLine = true,
+                    textStyle = MaterialTheme.typography.bodySmall.copy(fontFamily = FontFamily.Monospace),
+                    modifier = Modifier.fillMaxWidth(),
+                )
+                Text(
+                    if (settings.serverConfigured) "Server configured."
+                    else "Uploads stay off until all three fields are set.",
+                    style = MaterialTheme.typography.bodySmall,
+                )
+            }
+        }
+        Spacer(Modifier.height(24.dp))
+    }
+}
+
+private fun privacyExplanation(level: PrivacyLevel): String = when (level) {
+    PrivacyLevel.FULL ->
+        "Nothing is removed: SSIDs, MAC addresses, hostnames and discovered neighbours are sent " +
+            "as measured. Appropriate for a server you run yourself."
+    PrivacyLevel.BALANCED ->
+        "Network names and hostnames become pseudonyms, MAC addresses keep only their vendor " +
+            "prefix, public IP addresses keep only their /16, and discovered neighbours (SSDP, " +
+            "ARP, nearby networks) are dropped entirely. Private addresses stay readable, since " +
+            "192.168.1.1 describes the topology and not the person."
+    PrivacyLevel.STRICT ->
+        "Only numbers: test results, metrics and finding codes. No network description, no raw " +
+            "evidence, no finding text. Nothing left can identify a network."
+}
+
+@Composable
+private fun Toggle(label: String, detail: String, checked: Boolean, onChange: (Boolean) -> Unit) {
+    Row(Modifier.fillMaxWidth(), verticalAlignment = Alignment.Top) {
+        Column(Modifier.weight(1f)) {
+            Text(label, style = MaterialTheme.typography.bodyMedium)
+            Text(detail, style = MaterialTheme.typography.bodySmall)
+        }
+        Switch(checked = checked, onCheckedChange = onChange)
+    }
+}
+
+@Composable
+private fun NumberField(label: String, value: String, onChange: (String) -> Unit) {
+    OutlinedTextField(
+        value = value,
+        onValueChange = { s -> onChange(s.filter { it.isDigit() }.take(7)) },
+        label = { Text(label) },
+        singleLine = true,
+        modifier = Modifier.fillMaxWidth(),
+    )
+}

echolot-app/core-archive/build.gradle.kts

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+plugins {
+    alias(libs.plugins.kotlin.jvm)
+    alias(libs.plugins.kotlin.serialization)
+}
+
+// The on-device run archive: measurement documents on disk, with retention.
+// Pure Kotlin/JVM (it takes a directory, not a Context) so the retention rules
+// — the part with edge cases — are unit-testable without a device.
+dependencies {
+    implementation(libs.kotlinx.serialization.json)
+    testImplementation(kotlin("test"))
+}
+
+kotlin {
+    jvmToolchain(21)
+    compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) }
+}
+java { sourceCompatibility = JavaVersion.VERSION_17; targetCompatibility = JavaVersion.VERSION_17 }
+
+tasks.test { useJUnitPlatform() }

echolot-app/core-archive/src/main/kotlin/app/echo_lot/archive/RunArchive.kt

@@ -0,0 +1,209 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package archive keeps completed measurement runs on the device.
+//
+// The point of an archive is the second run: "this network was fine on Tuesday" is only
+// answerable if Tuesday was kept. But an app that silently accumulates network dumps forever is
+// its own privacy problem, so retention is a first-class part of the type rather than a cleanup
+// job somebody remembers to write — every save enforces it.
+//
+// Storage is one JSON file per run plus a small index entry, in a plain directory. Nothing here
+// needs a database, and a plain directory is something a user can inspect, copy off, or delete
+// with a file manager. Files are written to a temp name and renamed, so a run interrupted mid-
+// write never leaves a half-document that reads as real.
+package app.echo_lot.archive
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import java.io.File
+
+/** Index entry for one archived run — enough for a history list without opening the documents. */
+@Serializable
+data class ArchivedRun(
+    val id: String,
+    @SerialName("saved_at_epoch_ms") val savedAtEpochMs: Long,
+    @SerialName("started_at") val startedAt: String? = null,
+    val verdict: String? = null,
+    @SerialName("finding_count") val findingCount: Int = 0,
+    @SerialName("size_bytes") val sizeBytes: Long = 0,
+    val anonymization: String = "full",
+    /** Whether this run has been accepted by a server, so history can show what is backed up. */
+    val uploaded: Boolean = false,
+    @SerialName("uploaded_to") val uploadedTo: String? = null,
+)
+
+/**
+ * Retention limits. All three are independent ceilings; a run is dropped when it violates any of
+ * them. Zero disables that limit.
+ *
+ * The default keeps a hundred runs or three months, whichever comes first. That is enough to see
+ * a pattern ("it degrades every evening") without turning the phone into an archive of every
+ * network its owner ever walked past.
+ */
+@Serializable
+data class RetentionPolicy(
+    /**
+     * Whether to archive at all. Separate from the limits because "no limits" (every limit zero)
+     * and "keep nothing" are opposite intentions, and collapsing them onto the same value is how
+     * a user who turns all the caps off ends up with an empty history.
+     */
+    val enabled: Boolean = true,
+    @SerialName("max_runs") val maxRuns: Int = 100,
+    @SerialName("max_age_days") val maxAgeDays: Int = 90,
+    @SerialName("max_total_bytes") val maxTotalBytes: Long = 64L * 1024 * 1024,
+) {
+    companion object {
+        /** Archiving off: runs are shown once and never written. */
+        val KeepNothing = RetentionPolicy(enabled = false)
+
+        /** Archiving on with no ceilings. Every run is kept until the user deletes it. */
+        val Unlimited = RetentionPolicy(maxRuns = 0, maxAgeDays = 0, maxTotalBytes = 0)
+
+        val Default = RetentionPolicy()
+    }
+
+    val keepsAnything: Boolean get() = enabled
+}
+
+/** What a purge removed, so the UI can say "dropped 3 old runs" instead of silently deleting. */
+data class PurgeResult(val removed: List<String>, val freedBytes: Long) {
+    val isEmpty: Boolean get() = removed.isEmpty()
+}
+
+class RunArchive(private val dir: File, private val now: () -> Long = System::currentTimeMillis) {
+
+    private val json = Json { ignoreUnknownKeys = true; encodeDefaults = true }
+
+    init {
+        dir.mkdirs()
+    }
+
+    /**
+     * Writes one run and applies retention. Returns the index entry, or null when the policy
+     * keeps nothing at all — in which case nothing is written, rather than written and instantly
+     * deleted (the difference matters on flash storage and to anyone watching the filesystem).
+     */
+    fun save(runJson: String, policy: RetentionPolicy = RetentionPolicy.Default): ArchivedRun? {
+        if (!policy.keepsAnything) return null
+        val doc = runCatching { json.parseToJsonElement(runJson).jsonObject }.getOrNull() ?: return null
+        val meta = indexOf(doc, runJson.toByteArray().size.toLong()) ?: return null
+
+        writeAtomically(File(dir, meta.id + EXT), runJson)
+        writeAtomically(File(dir, meta.id + META_EXT), json.encodeToString(ArchivedRun.serializer(), meta))
+        purge(policy)
+        return meta
+    }
+
+    /** History, newest first. */
+    fun list(): List<ArchivedRun> =
+        (dir.listFiles { f -> f.name.endsWith(META_EXT) } ?: emptyArray())
+            .mapNotNull { f ->
+                runCatching { json.decodeFromString(ArchivedRun.serializer(), f.readText()) }.getOrNull()
+            }
+            .sortedByDescending { it.savedAtEpochMs }
+
+    fun read(id: String): String? = File(dir, safe(id) + EXT).takeIf { it.isFile }?.readText()
+
+    fun delete(id: String): Boolean {
+        val s = safe(id)
+        val doc = File(dir, s + EXT).delete()
+        File(dir, s + META_EXT).delete()
+        return doc
+    }
+
+    fun deleteAll(): Int = list().count { delete(it.id) }
+
+    /** Records that a server accepted this run, so history can distinguish backed-up from local. */
+    fun markUploaded(id: String, serverName: String) {
+        val f = File(dir, safe(id) + META_EXT)
+        val meta = runCatching { json.decodeFromString(ArchivedRun.serializer(), f.readText()) }.getOrNull()
+            ?: return
+        writeAtomically(
+            f,
+            json.encodeToString(
+                ArchivedRun.serializer(),
+                meta.copy(uploaded = true, uploadedTo = serverName),
+            ),
+        )
+    }
+
+    fun totalBytes(): Long = list().sumOf { it.sizeBytes }
+
+    /**
+     * Enforces the policy. Age first, then total size, then count: dropping stale runs may already
+     * satisfy the other two, and it is the limit a user reasons about ("keep three months"), so it
+     * should not be pre-empted by a size sweep deleting last week instead.
+     */
+    fun purge(policy: RetentionPolicy): PurgeResult {
+        val removed = ArrayList<String>()
+        var freed = 0L
+        fun drop(r: ArchivedRun) {
+            if (delete(r.id)) {
+                removed.add(r.id)
+                freed += r.sizeBytes
+            }
+        }
+
+        var kept = list()
+        if (policy.maxAgeDays > 0) {
+            val cutoff = now() - policy.maxAgeDays * 24L * 60 * 60 * 1000
+            val (fresh, stale) = kept.partition { it.savedAtEpochMs >= cutoff }
+            stale.forEach(::drop)
+            kept = fresh
+        }
+        if (policy.maxTotalBytes > 0) {
+            var total = kept.sumOf { it.sizeBytes }
+            // Oldest first until we are under the ceiling.
+            for (r in kept.reversed()) {
+                if (total <= policy.maxTotalBytes) break
+                drop(r)
+                total -= r.sizeBytes
+            }
+            kept = kept.filter { it.id !in removed }
+        }
+        if (policy.maxRuns > 0 && kept.size > policy.maxRuns) {
+            kept.drop(policy.maxRuns).forEach(::drop) // list() is newest-first
+        }
+        return PurgeResult(removed, freed)
+    }
+
+    // ---- internals ---------------------------------------------------------------------
+
+    private fun indexOf(doc: JsonObject, size: Long): ArchivedRun? {
+        val run = doc["run"]?.jsonObject ?: return null
+        val id = run["id"]?.jsonPrimitive?.content?.let(::safe)?.takeIf { it.isNotEmpty() } ?: return null
+        return ArchivedRun(
+            id = id,
+            savedAtEpochMs = now(),
+            startedAt = run["started_at"]?.jsonPrimitive?.content,
+            verdict = doc["summary"]?.jsonObject?.get("verdict")?.jsonPrimitive?.content,
+            findingCount = (doc["findings"] as? kotlinx.serialization.json.JsonArray)?.size ?: 0,
+            sizeBytes = size,
+            anonymization = run["privacy"]?.jsonObject?.get("anonymization")?.jsonPrimitive?.content ?: "full",
+        )
+    }
+
+    private fun writeAtomically(target: File, content: String) {
+        val tmp = File(target.parentFile, target.name + ".tmp")
+        tmp.writeText(content)
+        if (!tmp.renameTo(target)) {
+            target.delete()
+            tmp.renameTo(target)
+        }
+    }
+
+    /** Run ids reach the filesystem; keep them to characters that cannot climb out of [dir]. */
+    private fun safe(id: String): String = buildString {
+        for (c in id) if (c.isLetterOrDigit() || c == '-' || c == '_') append(c)
+    }.take(64)
+
+    private companion object {
+        const val EXT = ".json"
+        const val META_EXT = ".meta.json"
+    }
+}

echolot-app/core-archive/src/test/kotlin/app/echo_lot/archive/RunArchiveTest.kt

@@ -0,0 +1,170 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.archive
+
+import java.io.File
+import java.nio.file.Files
+import kotlin.test.AfterTest
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertNotNull
+import kotlin.test.assertNull
+import kotlin.test.assertTrue
+
+class RunArchiveTest {
+
+    private val dir: File = Files.createTempDirectory("echolot-archive").toFile()
+    private var clock = 1_000_000_000_000L // fixed: retention is time arithmetic, not wall time
+
+    private fun archive() = RunArchive(dir) { clock }
+
+    @AfterTest fun cleanup() { dir.deleteRecursively() }
+
+    private fun doc(id: String, findings: Int = 1, pad: Int = 0): String {
+        val f = (1..findings).joinToString(",") { """{"id":"f$it"}""" }
+        return """{"run":{"id":"$id","started_at":"2026-08-01T10:00:00Z","privacy":{"anonymization":"balanced"}},""" +
+            """"findings":[$f],"summary":{"verdict":"warn"},"pad":"${"x".repeat(pad)}"}"""
+    }
+
+    @Test
+    fun savedRunsComeBackNewestFirst() {
+        val a = archive()
+        for (i in 1..3) {
+            a.save(doc("run-$i"))
+            clock += 60_000
+        }
+        assertEquals(listOf("run-3", "run-2", "run-1"), a.list().map { it.id })
+    }
+
+    @Test
+    fun theIndexSummarisesTheDocument() {
+        val meta = assertNotNull(archive().save(doc("run-1", findings = 4)))
+        assertEquals("warn", meta.verdict)
+        assertEquals(4, meta.findingCount)
+        assertEquals("balanced", meta.anonymization)
+        assertEquals("2026-08-01T10:00:00Z", meta.startedAt)
+        assertFalse(meta.uploaded)
+    }
+
+    @Test
+    fun theDocumentComesBackByteForByte() {
+        val a = archive()
+        val original = doc("run-1")
+        a.save(original)
+        assertEquals(original, a.read("run-1"))
+    }
+
+    @Test
+    fun countLimitKeepsTheNewest() {
+        val a = archive()
+        val policy = RetentionPolicy(maxRuns = 3, maxAgeDays = 0, maxTotalBytes = 0)
+        for (i in 1..7) {
+            a.save(doc("run-$i"), policy)
+            clock += 60_000
+        }
+        assertEquals(listOf("run-7", "run-6", "run-5"), a.list().map { it.id })
+        assertNull(a.read("run-1"), "purged run's document should be gone, not just its index entry")
+    }
+
+    @Test
+    fun ageLimitDropsRunsPastTheWindow() {
+        val a = archive()
+        val policy = RetentionPolicy(maxRuns = 0, maxAgeDays = 7, maxTotalBytes = 0)
+        a.save(doc("old"), policy)
+        clock += 30L * 24 * 60 * 60 * 1000 // a month later
+        a.save(doc("new"), policy)
+        assertEquals(listOf("new"), a.list().map { it.id })
+    }
+
+    @Test
+    fun sizeLimitDropsOldestUntilUnderTheCeiling() {
+        val a = archive()
+        val one = doc("x", pad = 900).toByteArray().size.toLong()
+        val policy = RetentionPolicy(maxRuns = 0, maxAgeDays = 0, maxTotalBytes = one * 2 + 10)
+        for (i in 1..5) {
+            a.save(doc("run-$i", pad = 900), policy)
+            clock += 60_000
+        }
+        val kept = a.list()
+        assertTrue(kept.size <= 2, "size ceiling not enforced: kept ${kept.size}")
+        assertEquals("run-5", kept.first().id, "the newest run must always survive")
+        assertTrue(a.totalBytes() <= policy.maxTotalBytes)
+    }
+
+    // A policy that keeps nothing must not write-then-delete: the run should never touch storage.
+    @Test
+    fun keepNothingWritesNothing() {
+        val a = archive()
+        assertNull(a.save(doc("run-1"), RetentionPolicy.KeepNothing))
+        assertTrue(a.list().isEmpty())
+        assertEquals(0, dir.listFiles()?.size ?: 0, "files were written for a keep-nothing policy")
+    }
+
+    // "no ceilings" and "keep nothing" must not be the same policy, however a user arrives at
+    // one: turning every limit off should keep everything, not wipe the history.
+    @Test
+    fun unlimitedKeepsEverythingWhileKeepNothingKeepsNone() {
+        val a = archive()
+        for (i in 1..5) {
+            a.save(doc("run-$i"), RetentionPolicy.Unlimited)
+            clock += 60_000
+        }
+        assertEquals(5, a.list().size)
+        assertNull(a.save(doc("run-6"), RetentionPolicy.KeepNothing))
+        assertEquals(5, a.list().size, "keep-nothing must not touch what is already archived")
+    }
+
+    @Test
+    fun uploadStateIsRecorded() {
+        val a = archive()
+        a.save(doc("run-1"))
+        a.markUploaded("run-1", "fmr")
+        val meta = a.list().single()
+        assertTrue(meta.uploaded)
+        assertEquals("fmr", meta.uploadedTo)
+        assertEquals("run-1", meta.id, "marking upload must not disturb the rest of the entry")
+    }
+
+    @Test
+    fun deleteRemovesBothFiles() {
+        val a = archive()
+        a.save(doc("run-1"))
+        assertTrue(a.delete("run-1"))
+        assertTrue(a.list().isEmpty())
+        assertNull(a.read("run-1"))
+        assertEquals(0, dir.listFiles()?.size ?: 0)
+    }
+
+    @Test
+    fun malformedInputIsRejectedRatherThanArchived() {
+        val a = archive()
+        assertNull(a.save("not json"))
+        assertNull(a.save("""{"summary":{"verdict":"ok"}}"""), "a document with no run id has no identity")
+        assertTrue(a.list().isEmpty())
+    }
+
+    // Run ids come from a document that may have been produced elsewhere; they must not be able
+    // to write outside the archive directory.
+    @Test
+    fun runIdsCannotEscapeTheArchiveDirectory() {
+        val a = archive()
+        a.save(doc("../../evil"))
+        val strays = dir.parentFile.listFiles { f -> f.name.contains("evil") } ?: emptyArray()
+        assertTrue(strays.isEmpty(), "wrote outside the archive: ${strays.toList()}")
+    }
+
+    @Test
+    fun purgeReportsWhatItRemoved() {
+        val a = archive()
+        for (i in 1..5) {
+            a.save(doc("run-$i"), RetentionPolicy.Unlimited)
+            clock += 60_000
+        }
+        val result = a.purge(RetentionPolicy(maxRuns = 2, maxAgeDays = 0, maxTotalBytes = 0))
+        assertEquals(3, result.removed.size)
+        assertTrue(result.freedBytes > 0)
+        assertEquals(2, a.list().size)
+    }
+}

echolot-app/core-engine/bin/main/app/echo_lot/engine/ServerMeasurement.kt

@@ -1,166 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-// Package engine composes core-protocol probes into core-measurement documents — the run engine
-// the app drives. This file covers the server-facing vertical (control plane + UDP data plane);
-// device-tier probes (link snapshot, Shizuku, local discovery) plug in from the Android modules.
-package app.echo_lot.engine
-
-import app.echo_lot.measurement.*
-import app.echo_lot.protocol.ControlClient
-import app.echo_lot.protocol.ProbeSession
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.encodeToJsonElement
-
-/**
- * Runs the server-facing measurements against one target and assembles a [MeasurementDocument]:
- * an ECHO train (RTT distribution, loss, and NAT-rebinding detection from the server's observed
- * source port) as `train.udp_updown`. Everything is real evidence with recomputable metrics, and
- * findings are derived deterministically. IDs/timestamps are injected so the engine stays pure
- * (no clocks/UUIDs of its own) and unit-testable.
- */
-class ServerMeasurement(
-    private val ids: IdSource,
-    private val app: AppInfo,
-    private val device: DeviceInfo,
-) {
-    private val json = Json { encodeDefaults = true; explicitNulls = true }
-
-    data class Config(
-        val controlUrl: String,
-        val pins: Set<String>,
-        val credential: String,
-        val target: String,
-        val udpHost: String,
-        val udpPort: Int,
-        val echoCount: Int = 20,
-        val echoPaddingBytes: Int = 64,
-    )
-
-    fun run(cfg: Config): MeasurementDocument {
-        val runId = ids.uuid()
-        val startWall = ids.nowWall()
-        val startMono = ids.monoNs()
-
-        val control = ControlClient(cfg.controlUrl, cfg.pins)
-        val profile = control.profile(cfg.credential)
-        val session = control.createSession(cfg.credential, cfg.target)
-
-        val serverSession = ServerSession(
-            id = "sess-1",
-            profileName = profile.name,
-            controlUrl = cfg.controlUrl,
-            serverVersion = profile.serverVersion,
-            capabilities = profile.capabilities,
-            sessionId = session.sessionId,
-            target = SessionTarget(ip4 = cfg.udpHost, udpPort = cfg.udpPort),
-        )
-
-        val (test, findings) = echoTrain(cfg, control, session, startMono)
-
-        control.deleteSession(cfg.credential, session.sessionId)
-
-        val summary = Verdicts.derive(listOf(test), findings)
-        return MeasurementDocument(
-            run = Run(
-                id = runId, trigger = Trigger.MANUAL, startedAt = startWall, endedAt = ids.nowWall(),
-                clock = Clock(monoOriginWall = startWall),
-                app = app, device = device,
-                tiers = Tiers(app = true),
-            ),
-            serverSessions = listOf(serverSession),
-            tests = listOf(test),
-            findings = findings,
-            summary = summary,
-        )
-    }
-
-    private fun echoTrain(
-        cfg: Config, control: ControlClient, session: app.echo_lot.protocol.SessionResponse, startMono: Long,
-    ): Pair<Test, List<Finding>> {
-        val testId = ids.uuid()
-        val seqs = ArrayList<Int>()
-        val tTx = ArrayList<Long?>()
-        val tRx = ArrayList<Long?>()
-        val sizes = ArrayList<Int>()
-        val rtts = ArrayList<Double>()
-        val observedPorts = LinkedHashSet<Int>()
-
-        ProbeSession(cfg.credential, session, cfg.udpHost, cfg.udpPort).use { ps ->
-            for (i in 0 until cfg.echoCount) {
-                val txMono = ids.monoNs() - startMono
-                val r = ps.echo(cfg.echoPaddingBytes)
-                seqs.add(i)
-                tTx.add(txMono)
-                sizes.add(Wire_HEADER + cfg.echoPaddingBytes)
-                if (r != null) {
-                    tRx.add(ids.monoNs() - startMono)
-                    rtts.add(r.rttMs)
-                    r.observation?.observedPort?.let { observedPorts.add(it) }
-                } else {
-                    tRx.add(null)
-                }
-            }
-        }
-
-        val sent = cfg.echoCount
-        val received = rtts.size
-        val lossPct = if (sent == 0) 0.0 else (sent - received) * 100.0 / sent
-        val natRebinding = observedPorts.size > 1
-
-        val evidence: JsonObject = TrainEvidence(
-            epochMonoNs = startMono, seq = seqs, tTxNs = tTx, tRxNs = tRx, sizeBytes = sizes,
-        ).toEvidence()
-
-        val metrics: JsonObject = json.encodeToJsonElement(
-            EchoMetrics(
-                sent = sent, received = received, lossPct = round1(lossPct),
-                rttMsMin = rtts.minOrNull()?.let(::round1),
-                rttMsAvg = rtts.average().takeIf { received > 0 }?.let(::round1),
-                rttMsMax = rtts.maxOrNull()?.let(::round1),
-                observedPorts = observedPorts.toList(),
-                natRebindingDetected = natRebinding,
-            )
-        ) as JsonObject
-
-        val status = when {
-            received == 0 -> TestStatus.FAILED
-            received < sent -> TestStatus.PARTIAL
-            else -> TestStatus.OK
-        }
-        val test = Test(
-            id = testId, type = TestType.TRAIN_UDP_UPDOWN, sessionRef = "sess-1", tier = Tier.APP,
-            startedMonoNs = startMono, endedMonoNs = ids.monoNs(), status = status,
-            evidence = evidence, metrics = metrics,
-        )
-
-        val findings = ArrayList<Finding>()
-        if (received == 0) {
-            findings.add(finding("nat.udp_unreachable", Category.CONNECTIVITY, Severity.HIGH, testId,
-                "No UDP echo replies from the server",
-                "Every ECHO probe to the server's UDP data plane was lost — the path blocks or drops the session's UDP traffic."))
-        } else if (lossPct >= 20.0) {
-            findings.add(finding("connectivity.udp_loss", Category.CONNECTIVITY, Severity.MEDIUM, testId,
-                "High UDP loss to the server (${round1(lossPct)}%)",
-                "A large fraction of ECHO probes were lost, indicating an unreliable UDP path."))
-        }
-        if (natRebinding) {
-            findings.add(finding("nat.udp_rebinding", Category.NAT, Severity.MEDIUM, testId,
-                "NAT remapped the UDP source port mid-flow",
-                "The server observed more than one source port for this session (${observedPorts.joinToString()}), i.e. a NAT with a short UDP mapping or per-packet remapping."))
-        }
-        return test to findings
-    }
-
-    private fun finding(code: String, cat: Category, sev: Severity, testId: String, title: String, desc: String) =
-        Finding(
-            id = ids.uuid(), code = code, category = cat, severity = sev, confidence = Confidence.HIGH,
-            title = title, description = desc, evidenceRefs = listOf(EvidenceRef(testId)),
-        )
-
-    private companion object {
-        const val Wire_HEADER = 32
-        fun round1(v: Double) = Math.round(v * 10.0) / 10.0
-    }
-}

echolot-app/core-engine/bin/main/app/echo_lot/engine/Support.kt

@@ -1,38 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.engine
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-import java.time.Instant
-import java.util.UUID
-
-/**
- * Clock/ID source, injected so the engine has no hidden nondeterminism and stays unit-testable.
- * The default uses wall + monotonic clocks and random UUIDs; tests supply deterministic ones.
- */
-interface IdSource {
-    fun uuid(): String
-    fun monoNs(): Long
-    fun nowWall(): String
-}
-
-class SystemIdSource : IdSource {
-    override fun uuid(): String = UUID.randomUUID().toString()
-    override fun monoNs(): Long = System.nanoTime()
-    override fun nowWall(): String = Instant.now().toString()
-}
-
-/** Metrics for train.udp_updown; recomputable from the columnar evidence. */
-@Serializable
-data class EchoMetrics(
-    val sent: Int,
-    val received: Int,
-    @SerialName("loss_pct") val lossPct: Double,
-    @SerialName("rtt_ms_min") val rttMsMin: Double? = null,
-    @SerialName("rtt_ms_avg") val rttMsAvg: Double? = null,
-    @SerialName("rtt_ms_max") val rttMsMax: Double? = null,
-    @SerialName("observed_ports") val observedPorts: List<Int> = emptyList(),
-    @SerialName("nat_rebinding_detected") val natRebindingDetected: Boolean = false,
-)

echolot-app/core-engine/bin/test/app/echo_lot/engine/LiveMeasurementTest.kt

@@ -1,63 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.engine
-
-import app.echo_lot.measurement.*
-import kotlinx.serialization.json.Json
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
-
-/**
- * Runs the full server-facing engine against a live server and validates the produced
- * MeasurementDocument. Self-skips without ECHOLOT_LIVE_* (same contract as core-protocol's live
- * test). This is the whole vertical: protocol client → engine → schema document → verdict.
- */
-class LiveMeasurementTest {
-
-    private val url = System.getenv("ECHOLOT_LIVE_URL")
-    private val pin = System.getenv("ECHOLOT_LIVE_PIN")
-    private val cred = System.getenv("ECHOLOT_LIVE_CRED")
-    private val udp = System.getenv("ECHOLOT_LIVE_UDP")
-    private val target = System.getenv("ECHOLOT_LIVE_TARGET") ?: "fmr"
-
-    @Test
-    fun producesValidDocumentFromLiveServer() {
-        if (url == null || pin == null || cred == null || udp == null) {
-            println("LiveMeasurementTest skipped (no ECHOLOT_LIVE_* env)")
-            return
-        }
-        val (host, port) = udp.split(":").let { it[0] to it[1].toInt() }
-        val engine = ServerMeasurement(
-            ids = SystemIdSource(),
-            app = AppInfo(version = "0.1.0", build = 1, flavor = "test"),
-            device = DeviceInfo("test", "jvm", 0, "n/a"),
-        )
-        val doc = engine.run(
-            ServerMeasurement.Config(
-                controlUrl = url, pins = setOf(pin), credential = cred,
-                target = target, udpHost = host, udpPort = port, echoCount = 20,
-            )
-        )
-
-        // The document must round-trip and carry the expected structure.
-        val encoded = Json { encodeDefaults = true }.encodeToString(MeasurementDocument.serializer(), doc)
-        println("document (${encoded.length} bytes): overall=${doc.summary?.overall}")
-
-        assertEquals(1, doc.serverSessions.size)
-        assertTrue(doc.serverSessions[0].capabilities.contains("udp-probe"))
-        val test = doc.tests.single()
-        assertEquals(TestType.TRAIN_UDP_UPDOWN, test.type)
-        assertTrue(test.status == TestStatus.OK || test.status == TestStatus.PARTIAL,
-            "expected replies from live server, got ${test.status}")
-
-        val metrics = Json.parseToJsonElement(test.metrics.toString())
-        println("metrics: $metrics")
-        assertTrue(metrics.toString().contains("rtt_ms_avg"))
-
-        assertTrue(doc.summary != null)
-        // A healthy local->fmr path should be green (no loss, no rebinding) or yellow.
-        println("summary: ${doc.summary}")
-    }
-}

echolot-app/core-engine/build.gradle.kts

@@ -12,6 +12,7 @@ plugins {
 dependencies {
     implementation(project(":core-protocol"))
     implementation(project(":core-measurement"))
+    implementation(project(":core-privacy"))
     implementation(libs.kotlinx.serialization.json)
     testImplementation(kotlin("test"))
 }

echolot-app/core-engine/src/test/kotlin/app/echo_lot/engine/LiveGrantedTest.kt

@@ -0,0 +1,89 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.engine
+
+import app.echo_lot.protocol.ControlClient
+import app.echo_lot.protocol.ProbeSession
+import app.echo_lot.protocol.Wire
+import kotlin.test.Test
+import kotlin.test.assertTrue
+
+/**
+ * Exercises the server's §5 granted sends against a LIVE server: downtrain (downstream loss /
+ * ordering) and big_send (downstream MTU). Self-skips without ECHOLOT_LIVE_*.
+ *
+ * This is the direction a client cannot measure alone — only the far end can push large or
+ * numerous packets toward it — so it is also the direction that needs the anti-amplification
+ * grant, and this test is the proof that the grant path works end to end.
+ */
+class LiveGrantedTest {
+
+    private val url = System.getenv("ECHOLOT_LIVE_URL")
+    private val pin = System.getenv("ECHOLOT_LIVE_PIN")
+    private val cred = System.getenv("ECHOLOT_LIVE_CRED")
+    private val udp = System.getenv("ECHOLOT_LIVE_UDP")
+    private val target = System.getenv("ECHOLOT_LIVE_TARGET") ?: "fmr"
+
+    @Test
+    fun downstreamTrainAndBigSend() {
+        if (url == null || pin == null || cred == null || udp == null) {
+            println("LiveGrantedTest skipped (no ECHOLOT_LIVE_* env)"); return
+        }
+        val control = ControlClient(url, setOf(pin))
+        val profile = control.profile(cred)
+        println("capabilities: ${profile.capabilities}")
+        val session = control.createSession(cred, target)
+        val (host, port) = udp.split(":").let { it[0] to it[1].toInt() }
+
+        ProbeSession(cred, session, host, port).use { ps ->
+            // The grant is bound to the OBSERVED data-plane source, so we must be seen first.
+            val echo = ps.echo()
+            println("primed with echo rtt=${echo?.rttMs}")
+
+            // --- downtrain: 50 packets of 300 bytes, 5ms apart ---
+            val dtResp = control.action(
+                cred, session.sessionId,
+                """{"action":"downtrain","count":50,"size_bytes":300,"interval_us":5000}""",
+            )
+            println("downtrain accepted: ${dtResp.take(160)}")
+            val down = ps.collectGranted(windowMs = 4000)
+                .filter { it.type == Wire.TYPE_DOWNTRAIN_DATA }
+            val seqs = down.map { it.seq }.toSet()
+            println("downtrain received ${down.size}/50 packets, distinct seqs=${seqs.size}, " +
+                "sizes=${down.map { it.sizeBytes }.distinct()}")
+            assertTrue(down.isNotEmpty(), "no DOWNTRAIN_DATA arrived — granted send path is broken")
+
+            // --- big_send with DF: the largest size that arrives is the downstream path MTU ---
+            val sizes = listOf(600, 1200, 1400, 1472, 1500, 2000, 4000)
+            val dfResp = control.action(
+                cred, session.sessionId,
+                """{"action":"big_send","df":true,"sizes_bytes":${sizes}}""",
+            )
+            println("big_send(df) accepted: ${dfResp.take(200)}")
+            val dfArrived = ps.collectGranted(windowMs = 4000)
+                .filter { it.type == Wire.TYPE_BIG_SEND }.map { it.sizeBytes }.sorted()
+            println("big_send(df) arrived: $dfArrived")
+            assertTrue(dfArrived.isNotEmpty(), "no unfragmented BIG_SEND packets arrived")
+            val pathMtu = dfArrived.max()
+
+            // --- and without DF, to see whether fragments get through above that ---
+            val fragResp = control.action(
+                cred, session.sessionId,
+                """{"action":"big_send","df":false,"sizes_bytes":${sizes}}""",
+            )
+            println("big_send(frag) accepted: ${fragResp.take(200)}")
+            val fragArrived = ps.collectGranted(windowMs = 4000)
+                .filter { it.type == Wire.TYPE_BIG_SEND }.map { it.sizeBytes }.sorted()
+            println("big_send(frag) arrived: $fragArrived")
+
+            // The distinction the DF flag exists for: fragmented delivery may exceed the
+            // unfragmented path MTU, and reporting the former as the latter would be a lie.
+            println("downstream path MTU (payload bytes) = $pathMtu; " +
+                "largest fragmented delivery = ${fragArrived.maxOrNull()}")
+            assertTrue((fragArrived.maxOrNull() ?: 0) >= pathMtu,
+                "fragmented delivery should reach at least as far as unfragmented")
+        }
+        control.deleteSession(cred, session.sessionId)
+    }
+}

echolot-app/core-engine/src/test/kotlin/app/echo_lot/engine/LiveUploadTest.kt

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.engine
+
+import app.echo_lot.privacy.Anonymizer
+import app.echo_lot.privacy.PrivacyLevel
+import app.echo_lot.privacy.Salt
+import app.echo_lot.protocol.ControlClient
+import app.echo_lot.protocol.UploadRefused
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.jsonObject
+import kotlin.test.Test
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+/**
+ * Drives the upload path against a LIVE server: anonymize, upload, list, fetch back, delete.
+ *
+ * The point is not that the HTTP works — it is that what comes *back off the server* has been
+ * stripped. Uploading and then re-reading the stored document is the only check that proves the
+ * anonymizer ran on the bytes that actually left, rather than on a copy. Self-skips without
+ * ECHOLOT_LIVE_*.
+ */
+class LiveUploadTest {
+
+    private val url = System.getenv("ECHOLOT_LIVE_URL")
+    private val pin = System.getenv("ECHOLOT_LIVE_PIN")
+    private val cred = System.getenv("ECHOLOT_LIVE_CRED")
+    private val json = Json { prettyPrint = false }
+
+    private fun sampleRun(id: String) = """
+        {
+          "schema": "echolot/measurement",
+          "run": {
+            "id": "$id", "trigger": "manual", "started_at": "2026-08-01T10:00:00Z",
+            "notes": "kitchen table",
+            "device": {"manufacturer": "OnePlus", "model": "CPH2747"}
+          },
+          "networks": [{
+            "id": "net-1", "ssid": "Rambossek WLAN", "bssid": "78:9a:18:aa:bb:cc",
+            "gateway_ip4": "192.168.1.1", "public_ip4": "203.0.113.77",
+            "ssdp_responders": [{"friendly_name": "Living Room TV"}]
+          }],
+          "tests": [{"id": "t1", "type": "train.udp_updown", "status": "ok",
+                     "metrics": {"rtt_ms_avg": 12.4, "loss_pct": 0.0}}],
+          "findings": [{"id": "f1", "code": "nat.udp_rebinding", "severity": "medium"}],
+          "summary": {"verdict": "warn"}
+        }
+    """.trimIndent()
+
+    @Test
+    fun uploadRoundTrip() {
+        if (url == null || pin == null || cred == null) {
+            println("LiveUploadTest skipped (no ECHOLOT_LIVE_* env)"); return
+        }
+        val control = ControlClient(url, setOf(pin))
+        val profile = control.profile(cred)
+        val policy = profile.uploads
+        println("upload policy: mode=${policy.mode} min_anon=${policy.minAnonymization} " +
+            "max_bytes=${policy.maxBytes} retention_days=${policy.retentionDays}")
+
+        val runId = "livetest-" + System.nanoTime().toString().takeLast(10)
+        val level = PrivacyLevel.max(PrivacyLevel.BALANCED, PrivacyLevel.fromWire(policy.minAnonymization))
+        val redacted = json.encodeToString(
+            JsonObject.serializer(),
+            Anonymizer(level, Salt.perRun(ByteArray(32) { 9 }))
+                .anonymize(json.parseToJsonElement(sampleRun(runId)).jsonObject),
+        )
+        assertFalse(redacted.contains("Rambossek"), "the anonymizer did not strip the SSID before upload")
+
+        if (!policy.accepted) {
+            // A server configured to refuse must refuse — that is the behaviour worth asserting.
+            try {
+                control.uploadRun(cred, redacted)
+                throw AssertionError("server advertises mode=${policy.mode} but accepted an upload")
+            } catch (e: UploadRefused) {
+                println("upload correctly refused: ${e.message?.take(140)}")
+                return
+            }
+        }
+
+        val created = control.uploadRun(cred, redacted)
+        println("stored: ${created.take(200)}")
+
+        val listed = control.listRuns(cred)
+        assertTrue(listed.contains(runId), "uploaded run is missing from the server's list")
+
+        val fetched = control.getRun(cred, runId)
+        assertFalse(fetched.contains("Rambossek"), "the SSID is sitting on the server")
+        assertFalse(fetched.contains("Living Room TV"), "an SSDP neighbour name is sitting on the server")
+        assertFalse(fetched.contains("kitchen table"), "a free-text note is sitting on the server")
+        assertTrue(fetched.contains("nat.udp_rebinding"), "the finding code should survive — it is the point")
+        assertTrue(fetched.contains("12.4"), "metrics should survive anonymization")
+        println("round trip verified: identifiers stripped, measurements intact")
+
+        control.deleteRun(cred, runId)
+        assertFalse(control.listRuns(cred).contains(runId), "delete did not remove the run")
+        println("deleted")
+    }
+}

echolot-app/core-privacy/build.gradle.kts

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+plugins {
+    alias(libs.plugins.kotlin.jvm)
+    alias(libs.plugins.kotlin.serialization)
+}
+
+// The anonymizer (measurement-schema.md §8). Pure Kotlin/JVM and deliberately
+// dependency-free beyond JSON: it must be trivially auditable, because a bug
+// here leaks a user's network onto someone else's server.
+dependencies {
+    implementation(libs.kotlinx.serialization.json)
+    testImplementation(kotlin("test"))
+}
+
+kotlin {
+    jvmToolchain(21)
+    compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) }
+}
+java { sourceCompatibility = JavaVersion.VERSION_17; targetCompatibility = JavaVersion.VERSION_17 }
+
+tasks.test { useJUnitPlatform() }

echolot-app/core-privacy/src/main/kotlin/app/echo_lot/privacy/Anonymizer.kt

@@ -0,0 +1,237 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package privacy implements the anonymization contract of measurement-schema.md §8.
+//
+// The threat model is specific. An engineer running their own server wants the full document —
+// SSIDs and MACs are what make a run useful a week later. Someone measuring against a stranger's
+// server wants the numbers to survive and the identifiers not to. So this is a *transform*, not a
+// filter: the output is still a valid measurement document with the same tests, metrics and
+// findings; only the identifying scalars change, and consistently, so "same SSID as last run" is
+// still answerable from pseudonyms alone.
+//
+// Two properties are load-bearing and are what the tests pin:
+//   - Consistency within a document: one input value always maps to one pseudonym, so
+//     correlations inside a run survive.
+//   - No consistency *across* documents unless the user asks for it: the salt is per-run by
+//     default, so pseudonyms cannot be used to track a device between uploads. A stable salt is
+//     opt-in (`Salt.stable`) for people diffing their own history on their own server.
+package app.echo_lot.privacy
+
+import kotlinx.serialization.json.*
+import java.security.MessageDigest
+import java.util.Locale
+
+/** How much to strip. Ordered: FULL < BALANCED < STRICT. Wire values match the server's. */
+enum class PrivacyLevel(val wire: String) {
+    /** Nothing removed. The right choice for your own server. */
+    FULL("full"),
+
+    /**
+     * Identifiers pseudonymized, neighbour inventory dropped. Topology and timing survive:
+     * you can still see that the gateway is a MikroTik at a /24 boundary with 3 % loss, but not
+     * which MikroTik, on which SSID, next to whose Chromecast.
+     */
+    BALANCED("balanced"),
+
+    /**
+     * Numbers only: tests keep their metrics and status, evidence is dropped, findings keep their
+     * codes and severities but lose descriptions (which quote real names). What is left cannot
+     * identify a network, and is still enough for aggregate "how common is this fault" work.
+     */
+    STRICT("strict");
+
+    companion object {
+        fun fromWire(s: String?): PrivacyLevel =
+            entries.firstOrNull { it.wire == s?.lowercase(Locale.ROOT) } ?: FULL
+
+        /** The stricter of two levels — used to honour a server's minimum. */
+        fun max(a: PrivacyLevel, b: PrivacyLevel): PrivacyLevel = if (a.ordinal >= b.ordinal) a else b
+    }
+}
+
+/**
+ * The pseudonymization salt. Per-run by default: a fresh random salt means the same SSID uploaded
+ * twice yields two different pseudonyms, so an upload endpoint cannot link runs to a device.
+ * A stable salt trades that away for cross-run diffing and is only appropriate on a server you
+ * own — the app makes that an explicit choice, not a default.
+ */
+class Salt private constructor(internal val bytes: ByteArray, val stable: Boolean) {
+    companion object {
+        fun perRun(random: ByteArray): Salt = Salt(random.copyOf(), stable = false)
+        fun stable(secret: ByteArray): Salt = Salt(secret.copyOf(), stable = true)
+    }
+}
+
+/**
+ * Transforms a measurement document to [level].
+ *
+ * Field classification is by JSON key name, because the schema names things consistently
+ * (`ssid`, `bssid`, `mac`, `ip4`, `ip6`, `fqdn`, …) and a name-driven pass is auditable by
+ * reading one table. Anything unrecognized is treated as identifying when it is a string inside
+ * a known-sensitive container, and left alone otherwise — see [Classification].
+ */
+class Anonymizer(private val level: PrivacyLevel, private val salt: Salt) {
+
+    private val cache = HashMap<String, String>()
+
+    fun anonymize(doc: JsonObject): JsonObject {
+        if (level == PrivacyLevel.FULL) return stamp(doc)
+        val walked = walkObject(doc, path = emptyList())
+        val out = if (level == PrivacyLevel.STRICT) strip(walked) else walked
+        return stamp(out)
+    }
+
+    /** Records what was done, so a reader of the archived/uploaded document is never guessing. */
+    private fun stamp(doc: JsonObject): JsonObject {
+        val run = doc["run"]?.jsonObject ?: return doc
+        val privacy = buildJsonObject {
+            put("anonymization", level.wire)
+            put("salt", if (salt.stable) "stable" else "per_run")
+        }
+        return JsonObject(doc + ("run" to JsonObject(run + ("privacy" to privacy))))
+    }
+
+    // ---- the tree walk -------------------------------------------------------------------
+
+    private fun walkObject(obj: JsonObject, path: List<String>): JsonObject = buildJsonObject {
+        for ((k, v) in obj) {
+            val childPath = path + k
+            when {
+                Classification.dropAtBalanced(childPath) -> Unit // omit entirely
+                else -> put(k, walk(k, v, childPath))
+            }
+        }
+    }
+
+    private fun walk(key: String, v: JsonElement, path: List<String>): JsonElement = when (v) {
+        is JsonObject -> walkObject(v, path)
+        is JsonArray -> JsonArray(v.map { walk(key, it, path) })
+        is JsonPrimitive ->
+            if (v.isString) transform(Classification.typeOf(key, path), v.content).let(::JsonPrimitive)
+            else v
+    }
+
+    private fun transform(type: LogicalType?, value: String): String = when (type) {
+        null -> value
+        LogicalType.SSID -> pseudo("ssid", value) { "net-" + it.take(6) }
+        LogicalType.MAC, LogicalType.BSSID -> macPreservingOui(value)
+        LogicalType.IP4 -> ip4(value)
+        LogicalType.IP6 -> ip6(value)
+        LogicalType.FQDN -> fqdn(value)
+        LogicalType.OPAQUE_ID -> "redacted"
+        LogicalType.FREETEXT -> "[removed: may contain identifying text]"
+    }
+
+    // ---- per-type transforms -------------------------------------------------------------
+
+    /**
+     * Keeps the OUI (which vendor) and pseudonymizes the NIC part (which unit). Vendor is the
+     * diagnostically valuable half — "the RA comes from a MikroTik" survives, "…from THAT
+     * MikroTik" does not.
+     */
+    private fun macPreservingOui(value: String): String {
+        val sep = if (value.contains('-')) '-' else ':'
+        val parts = value.split(sep)
+        if (parts.size != 6 || parts.any { it.length != 2 }) return pseudo("mac", value) { "mac-" + it.take(8) }
+        val nic = pseudo("mac", value) { it }
+        return (parts.take(3) + listOf(nic.substring(0, 2), nic.substring(2, 4), nic.substring(4, 6)))
+            .joinToString(sep.toString())
+            .lowercase(Locale.ROOT)
+    }
+
+    /**
+     * Prefix-preserving within the same class, with reserved ranges kept verbatim: RFC1918 and
+     * CGNAT addresses say something about the topology and nothing about the person, and a run
+     * where 192.168.1.1 became a random public address would be actively misleading to read.
+     * Public addresses keep only their /16 so the network is still locatable at ISP granularity.
+     */
+    private fun ip4(value: String): String {
+        val o = value.split(".")
+        if (o.size != 4 || o.any { it.toIntOrNull() == null }) return value
+        val n = o.map { it.toInt() }
+        val reserved = n[0] == 10 ||
+            (n[0] == 172 && n[1] in 16..31) ||
+            (n[0] == 192 && n[1] == 168) ||
+            (n[0] == 169 && n[1] == 254) ||
+            (n[0] == 100 && n[1] in 64..127) ||
+            n[0] == 127 || n[0] == 0 || n[0] >= 224
+        if (reserved) return value
+        val h = pseudo("ip4", value) { it }
+        return "${n[0]}.${n[1]}.${h.substring(0, 2).toInt(16)}.${h.substring(2, 4).toInt(16)}"
+    }
+
+    /**
+     * IPv6 keeps the scope and the first 32 bits (so 2001:db8:… still reads as global unicast in
+     * the same allocation) and pseudonymizes the rest — the interface identifier is the part that
+     * is a device fingerprint, especially with EUI-64.
+     */
+    private fun ip6(value: String): String {
+        val v = value.lowercase(Locale.ROOT)
+        if (v == "::1" || v == "::" || v.startsWith("fe80:") || v.startsWith("ff")) return v
+        val groups = v.substringBefore('%').split(":")
+        if (groups.size < 3) return v
+        val h = pseudo("ip6", value) { it }
+        return "${groups[0]}:${groups[1]}:${h.substring(0, 4)}:${h.substring(4, 8)}::${h.substring(8, 12)}"
+    }
+
+    /**
+     * Per-label pseudonyms with the public suffix kept, so "it resolved somewhere under .local"
+     * or "…under example.com" survives without naming the host. The suffix list is deliberately
+     * short: guessing wrong keeps *more* pseudonymized, never less.
+     */
+    private fun fqdn(value: String): String {
+        if (value.isEmpty()) return value
+        val trailing = value.endsWith(".")
+        val labels = value.trimEnd('.').split(".")
+        if (labels.size == 1) return pseudo("fqdn", value) { "host-" + it.take(6) }
+        val keep = if (labels.last() in publicSuffixes) 1 else 0
+        val head = labels.dropLast(keep).map { l -> pseudo("label", l) { "l-" + it.take(6) } }
+        return (head + labels.takeLast(keep)).joinToString(".") + if (trailing) "." else ""
+    }
+
+    // ---- STRICT ---------------------------------------------------------------------------
+
+    /**
+     * STRICT keeps the shape of the document and the numbers, and nothing that quotes the
+     * network back. Evidence goes (trains carry addresses and hostnames), finding prose goes
+     * (it interpolates real names), networks go entirely.
+     */
+    private fun strip(doc: JsonObject): JsonObject = buildJsonObject {
+        for ((k, v) in doc) {
+            when (k) {
+                "networks", "server_sessions" -> Unit
+                "tests" -> put(k, JsonArray((v as? JsonArray ?: JsonArray(emptyList())).map { t ->
+                    val o = t.jsonObject
+                    JsonObject(o.filterKeys { it != "evidence" && it != "params" })
+                }))
+                "findings" -> put(k, JsonArray((v as? JsonArray ?: JsonArray(emptyList())).map { f ->
+                    val o = f.jsonObject
+                    JsonObject(o.filterKeys { it != "description" && it != "title" && it != "evidence_refs" })
+                }))
+                "run" -> put(k, JsonObject(v.jsonObject.filterKeys { it != "notes" }))
+                else -> put(k, v)
+            }
+        }
+    }
+
+    // ---- pseudonym machinery ---------------------------------------------------------------
+
+    /** Deterministic per (domain, value, salt); memoized so one value maps to one pseudonym. */
+    private fun pseudo(domain: String, value: String, shape: (String) -> String): String =
+        cache.getOrPut("$domain$value") {
+            val md = MessageDigest.getInstance("SHA-256")
+            md.update(salt.bytes)
+            md.update(domain.toByteArray())
+            md.update(0)
+            md.update(value.lowercase(Locale.ROOT).toByteArray())
+            shape(md.digest().joinToString("") { "%02x".format(it) })
+        }
+
+    private companion object {
+        val publicSuffixes = setOf(
+            "local", "lan", "home", "internal", "arpa",
+            "com", "net", "org", "io", "app", "dev", "at", "de", "eu", "uk",
+        )
+    }
+}

echolot-app/core-privacy/src/main/kotlin/app/echo_lot/privacy/Classification.kt

@@ -0,0 +1,85 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.privacy
+
+/** The logical types of measurement-schema.md §8. */
+enum class LogicalType { IP4, IP6, MAC, BSSID, SSID, FQDN, OPAQUE_ID, FREETEXT }
+
+/**
+ * Which fields hold which logical type, and which whole subtrees are dropped below FULL.
+ *
+ * This is a table on purpose. The alternative — annotating the Kotlin models and reflecting over
+ * them — spreads the answer across every module and makes "what exactly gets uploaded?" a
+ * question you answer by reading the whole app. Here it is one file a reviewer can check against
+ * the spec in a sitting, and a new field that nobody classified stays visible in the output
+ * rather than being silently mangled.
+ *
+ * The bias is toward over-classifying: a metric wrongly pseudonymized is a bug someone reports;
+ * an SSID wrongly kept is a leak nobody notices.
+ */
+object Classification {
+
+    private val byKey: Map<String, LogicalType> = buildMap {
+        listOf(
+            "ip4", "ipv4", "gateway_ip4", "dns_ip4", "src_ip4", "dst_ip4", "public_ip4",
+            "observed_ip4", "hop_ip4", "answer_ip4", "address_ip4", "server_ip4",
+        ).forEach { put(it, LogicalType.IP4) }
+
+        listOf(
+            "ip6", "ipv6", "gateway_ip6", "dns_ip6", "src_ip6", "dst_ip6", "public_ip6",
+            "observed_ip6", "hop_ip6", "answer_ip6", "address_ip6", "server_ip6",
+            "link_local", "ra_source", "prefix",
+        ).forEach { put(it, LogicalType.IP6) }
+
+        listOf("mac", "hw_addr", "gateway_mac", "router_mac", "sender_mac", "peer_mac")
+            .forEach { put(it, LogicalType.MAC) }
+        listOf("bssid", "ap_mac").forEach { put(it, LogicalType.BSSID) }
+        listOf("ssid", "network_name", "wifi_ssid").forEach { put(it, LogicalType.SSID) }
+
+        listOf(
+            "fqdn", "hostname", "host", "name", "reverse_dns", "ptr", "domain", "query_name",
+            "friendly_name", "server_name", "sni", "cname", "search_domain", "device_name",
+        ).forEach { put(it, LogicalType.FQDN) }
+
+        listOf("session_id", "credential", "token", "device_id", "android_id", "serial", "imsi", "iccid")
+            .forEach { put(it, LogicalType.OPAQUE_ID) }
+
+        listOf("notes", "detail", "raw", "excerpt", "location", "model_description")
+            .forEach { put(it, LogicalType.FREETEXT) }
+    }
+
+    /**
+     * Whole subtrees that BALANCED removes rather than pseudonymizes.
+     *
+     * Neighbour inventories (SSDP/UPnP responders, ARP tables, discovered peers) are the clearest
+     * case: they describe other people's devices, they are a household fingerprint even with the
+     * names hashed, and no metric depends on them. Dropping beats mangling.
+     */
+    private val droppedPaths: List<List<String>> = listOf(
+        listOf("networks", "neighbors"),
+        listOf("networks", "arp"),
+        listOf("networks", "wifi", "scan_results"),
+        listOf("run", "device", "security_patch"),
+    )
+
+    /** Key suffixes whose whole value is a neighbour inventory wherever they appear. */
+    private val droppedKeys = setOf(
+        "ssdp_responders", "upnp", "neighbors", "arp_table", "scan_results",
+        "nearby_networks", "peers", "raw_dump", "dumpsys",
+    )
+
+    fun typeOf(key: String, path: List<String>): LogicalType? {
+        byKey[key]?.let { return it }
+        // Inside a discovery/neighbour container every string is someone's device name until
+        // proven otherwise, so classify unknown strings there as free text rather than passing
+        // them through.
+        if (path.any { it in droppedKeys }) return LogicalType.FREETEXT
+        return null
+    }
+
+    fun dropAtBalanced(path: List<String>): Boolean {
+        if (path.isNotEmpty() && path.last() in droppedKeys) return true
+        return droppedPaths.any { dropped -> dropped.all { path.contains(it) } }
+    }
+}

echolot-app/core-privacy/src/test/kotlin/app/echo_lot/privacy/AnonymizerTest.kt

@@ -0,0 +1,185 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.privacy
+
+import kotlinx.serialization.json.*
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertNotEquals
+import kotlin.test.assertNull
+import kotlin.test.assertTrue
+
+/**
+ * These tests are the audit of the anonymizer: each one states a property someone's privacy
+ * depends on, so a regression here fails loudly rather than quietly leaking.
+ */
+class AnonymizerTest {
+
+    private val json = Json { prettyPrint = false }
+    private val salt = Salt.perRun(ByteArray(32) { it.toByte() })
+
+    private fun sample(): JsonObject = json.parseToJsonElement(
+        """
+        {
+          "schema": "echolot/measurement",
+          "run": {
+            "id": "0190-run", "trigger": "manual", "notes": "at Anna's flat",
+            "device": {"manufacturer": "OnePlus", "model": "CPH2747", "security_patch": "2026-06-05"}
+          },
+          "networks": [{
+            "id": "net-1", "ssid": "Rambossek WLAN", "bssid": "78:9a:18:aa:bb:cc",
+            "gateway_ip4": "192.168.1.1", "public_ip4": "89.185.109.150",
+            "gateway_ip6": "2001:1ad0:c4fe:6767::1", "link_local": "fe80::7a9a:18ff:feaa:bbcc",
+            "neighbors": [{"name": "Anna's Chromecast", "mac": "aa:bb:cc:dd:ee:ff"}],
+            "ssdp_responders": [{"friendly_name": "Living Room TV", "location": "http://192.168.1.44:8060/"}]
+          }],
+          "tests": [{
+            "id": "t1", "type": "train.udp_updown", "status": "ok",
+            "metrics": {"rtt_ms_avg": 12.4, "loss_pct": 0.0},
+            "evidence": {"seq": [0,1,2], "t_rx_ns": [1,2,3]}
+          }],
+          "findings": [{
+            "id": "f1", "code": "nat.udp_rebinding", "severity": "medium",
+            "title": "NAT remapped the port", "description": "server saw 89.185.109.150:41000"
+          }],
+          "summary": {"verdict": "warn"}
+        }
+        """.trimIndent(),
+    ).jsonObject
+
+    private fun anon(level: PrivacyLevel, doc: JsonObject = sample()) = Anonymizer(level, salt).anonymize(doc)
+
+    private fun flat(e: JsonElement): String = e.toString()
+
+    @Test
+    fun fullLeavesTheDocumentAloneButRecordsThat() {
+        val out = anon(PrivacyLevel.FULL)
+        assertEquals("Rambossek WLAN", out["networks"]!!.jsonArray[0].jsonObject["ssid"]!!.jsonPrimitive.content)
+        assertEquals("full", out["run"]!!.jsonObject["privacy"]!!.jsonObject["anonymization"]!!.jsonPrimitive.content)
+    }
+
+    @Test
+    fun balancedRemovesTheSsidAndTheNotes() {
+        val text = flat(anon(PrivacyLevel.BALANCED))
+        assertFalse(text.contains("Rambossek"), "SSID survived: $text")
+        assertFalse(text.contains("Anna"), "free-text note or neighbour name survived: $text")
+    }
+
+    @Test
+    fun balancedDropsNeighbourInventoriesEntirely() {
+        val net = anon(PrivacyLevel.BALANCED)["networks"]!!.jsonArray[0].jsonObject
+        assertNull(net["neighbors"], "neighbour list should be dropped, not pseudonymized")
+        assertNull(net["ssdp_responders"], "SSDP responders should be dropped, not pseudonymized")
+    }
+
+    @Test
+    fun balancedKeepsTheVendorHalfOfAMac() {
+        val bssid = anon(PrivacyLevel.BALANCED)["networks"]!!.jsonArray[0].jsonObject["bssid"]!!.jsonPrimitive.content
+        assertTrue(bssid.startsWith("78:9a:18"), "OUI should survive so the vendor is still known: $bssid")
+        assertFalse(bssid.endsWith("aa:bb:cc"), "NIC part should be pseudonymized: $bssid")
+    }
+
+    @Test
+    fun privateAddressesAreKeptVerbatimAndPublicOnesAreNot() {
+        val net = anon(PrivacyLevel.BALANCED)["networks"]!!.jsonArray[0].jsonObject
+        assertEquals("192.168.1.1", net["gateway_ip4"]!!.jsonPrimitive.content,
+            "RFC1918 says nothing about the user and everything about the topology")
+        assertNotEquals("89.185.109.150", net["public_ip4"]!!.jsonPrimitive.content)
+        assertTrue(net["public_ip4"]!!.jsonPrimitive.content.startsWith("89.185."),
+            "the /16 should survive for ISP-level context")
+    }
+
+    @Test
+    fun linkLocalIsKeptButGlobalV6IsNot() {
+        val net = anon(PrivacyLevel.BALANCED)["networks"]!!.jsonArray[0].jsonObject
+        assertEquals("fe80::7a9a:18ff:feaa:bbcc", net["link_local"]!!.jsonPrimitive.content)
+        assertNotEquals("2001:1ad0:c4fe:6767::1", net["gateway_ip6"]!!.jsonPrimitive.content)
+    }
+
+    @Test
+    fun metricsAndVerdictsAreNeverTouched() {
+        for (level in PrivacyLevel.entries) {
+            val out = anon(level)
+            val t = out["tests"]!!.jsonArray[0].jsonObject
+            assertEquals(12.4, t["metrics"]!!.jsonObject["rtt_ms_avg"]!!.jsonPrimitive.double, 1e-9,
+                "$level changed a metric")
+            assertEquals("ok", t["status"]!!.jsonPrimitive.content)
+            assertEquals("warn", out["summary"]!!.jsonObject["verdict"]!!.jsonPrimitive.content)
+        }
+    }
+
+    @Test
+    fun findingCodesSurviveEveryLevelSoAggregationStillWorks() {
+        for (level in PrivacyLevel.entries) {
+            val f = anon(level)["findings"]!!.jsonArray[0].jsonObject
+            assertEquals("nat.udp_rebinding", f["code"]!!.jsonPrimitive.content, "$level lost the finding code")
+            assertEquals("medium", f["severity"]!!.jsonPrimitive.content)
+        }
+    }
+
+    @Test
+    fun strictDropsEvidenceAndProse() {
+        val out = anon(PrivacyLevel.STRICT)
+        assertNull(out["networks"], "STRICT should not describe the network at all")
+        assertNull(out["tests"]!!.jsonArray[0].jsonObject["evidence"])
+        assertNull(out["findings"]!!.jsonArray[0].jsonObject["description"])
+        assertFalse(flat(out).contains("89.185.109.150"), "an address leaked through finding prose")
+    }
+
+    @Test
+    fun pseudonymsAreConsistentWithinADocument() {
+        val doc = json.parseToJsonElement(
+            """{"run":{"id":"r"},"networks":[{"ssid":"Home"},{"ssid":"Home"},{"ssid":"Other"}]}"""
+        ).jsonObject
+        val nets = anon(PrivacyLevel.BALANCED, doc)["networks"]!!.jsonArray
+        val a = nets[0].jsonObject["ssid"]!!.jsonPrimitive.content
+        val b = nets[1].jsonObject["ssid"]!!.jsonPrimitive.content
+        val c = nets[2].jsonObject["ssid"]!!.jsonPrimitive.content
+        assertEquals(a, b, "the same SSID must map to the same pseudonym inside one run")
+        assertNotEquals(a, c, "different SSIDs must not collide")
+    }
+
+    @Test
+    fun perRunSaltsDoNotLinkTwoUploadsOfTheSameNetwork() {
+        val doc = json.parseToJsonElement("""{"run":{"id":"r"},"networks":[{"ssid":"Home"}]}""").jsonObject
+        val one = Anonymizer(PrivacyLevel.BALANCED, Salt.perRun(ByteArray(32) { 1 })).anonymize(doc)
+        val two = Anonymizer(PrivacyLevel.BALANCED, Salt.perRun(ByteArray(32) { 2 })).anonymize(doc)
+        assertNotEquals(
+            one["networks"]!!.jsonArray[0].jsonObject["ssid"],
+            two["networks"]!!.jsonArray[0].jsonObject["ssid"],
+            "a per-run salt must not produce a cross-run tracking identifier",
+        )
+    }
+
+    @Test
+    fun aStableSaltDoesLinkThemBecauseThatIsWhatItIsFor() {
+        val doc = json.parseToJsonElement("""{"run":{"id":"r"},"networks":[{"ssid":"Home"}]}""").jsonObject
+        val secret = ByteArray(32) { 7 }
+        val one = Anonymizer(PrivacyLevel.BALANCED, Salt.stable(secret)).anonymize(doc)
+        val two = Anonymizer(PrivacyLevel.BALANCED, Salt.stable(secret)).anonymize(doc)
+        assertEquals(
+            one["networks"]!!.jsonArray[0].jsonObject["ssid"],
+            two["networks"]!!.jsonArray[0].jsonObject["ssid"],
+        )
+        assertEquals("stable", one["run"]!!.jsonObject["privacy"]!!.jsonObject["salt"]!!.jsonPrimitive.content)
+    }
+
+    @Test
+    fun theDeclaredLevelMatchesWhatWasApplied() {
+        for (level in PrivacyLevel.entries) {
+            assertEquals(
+                level.wire,
+                anon(level)["run"]!!.jsonObject["privacy"]!!.jsonObject["anonymization"]!!.jsonPrimitive.content,
+            )
+        }
+    }
+
+    @Test
+    fun serverMinimumWins() {
+        assertEquals(PrivacyLevel.STRICT, PrivacyLevel.max(PrivacyLevel.FULL, PrivacyLevel.STRICT))
+        assertEquals(PrivacyLevel.BALANCED, PrivacyLevel.max(PrivacyLevel.BALANCED, PrivacyLevel.FULL))
+        assertEquals(PrivacyLevel.FULL, PrivacyLevel.fromWire("nonsense"))
+    }
+}

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/ControlClient.kt

@@ -1,92 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import kotlinx.serialization.json.Json
-import java.net.URL
-import javax.net.ssl.HttpsURLConnection
-
-/**
- * The control-plane client (probe-protocol.md §2): enrollment, profile, sessions — over
- * SPKI-pinned HTTPS. Uses HttpsURLConnection (available since Android API 1, unlike
- * java.net.http.HttpClient which needs API 34) with a pin-based SSLSocketFactory and hostname
- * verification DISABLED: trust is the SPKI pin, never the certificate name (self-signed servers
- * with no SAN are first-class). Blocking; the Android layer wraps calls in coroutines.
- *
- * @param controlUrl e.g. "https://fmr-1.echo-lot.app:8443"
- * @param pins       the `pin-sha256` value(s) from the enrollment QR (base64, no prefix)
- */
-class ControlClient(private val controlUrl: String, pins: Set<String>) {
-
-    private val json = Json { ignoreUnknownKeys = true }
-    private val socketFactory = Pinning.sslContext(pins).socketFactory
-
-    private fun open(path: String, method: String, credential: String?): HttpsURLConnection {
-        val conn = URL(controlUrl.trimEnd('/') + path).openConnection() as HttpsURLConnection
-        conn.sslSocketFactory = socketFactory
-        conn.setHostnameVerifier { _, _ -> true } // pin is the trust, not the name
-        conn.requestMethod = method
-        conn.connectTimeout = 10_000
-        conn.readTimeout = 10_000
-        credential?.let { conn.setRequestProperty("Authorization", "Bearer $it") }
-        return conn
-    }
-
-    private fun body(conn: HttpsURLConnection): String {
-        val stream = if (conn.responseCode in 200..299) conn.inputStream else conn.errorStream
-        return stream?.bufferedReader()?.use { it.readText() } ?: ""
-    }
-
-    private fun writeJson(conn: HttpsURLConnection, payload: String) {
-        conn.doOutput = true
-        conn.setRequestProperty("Content-Type", "application/json")
-        conn.outputStream.use { it.write(payload.toByteArray()) }
-    }
-
-    // Minimal JSON string literal (the only bodies we send are one short field).
-    private fun jstr(s: String): String {
-        val sb = StringBuilder("\"")
-        for (c in s) when (c) {
-            '"' -> sb.append("\\\"")
-            '\\' -> sb.append("\\\\")
-            '\n' -> sb.append("\\n")
-            '\r' -> sb.append("\\r")
-            '\t' -> sb.append("\\t")
-            else -> sb.append(c)
-        }
-        return sb.append('"').toString()
-    }
-
-    /** Redeem a single-use enrollment token for a device credential (§2.1). */
-    fun enroll(token: String, name: String? = null): EnrollResponse {
-        val conn = open("/v1/enroll", "POST", null)
-        conn.setRequestProperty("Authorization", "Bearer $token")
-        writeJson(conn, if (name != null) """{"name":${jstr(name)}}""" else "{}")
-        check(conn.responseCode == 201) { "enroll failed: ${conn.responseCode} ${body(conn)}" }
-        return json.decodeFromString(EnrollResponse.serializer(), body(conn))
-    }
-
-    fun profile(credential: String): Profile {
-        val conn = open("/v1/profile", "GET", credential)
-        check(conn.responseCode == 200) { "profile failed: ${conn.responseCode} ${body(conn)}" }
-        return json.decodeFromString(Profile.serializer(), body(conn))
-    }
-
-    fun createSession(credential: String, target: String): SessionResponse {
-        val conn = open("/v1/sessions", "POST", credential)
-        writeJson(conn, """{"target":${jstr(target)}}""")
-        check(conn.responseCode == 201) { "session failed: ${conn.responseCode} ${body(conn)}" }
-        return json.decodeFromString(SessionResponse.serializer(), body(conn))
-    }
-
-    fun observations(credential: String, sessionId: String): String {
-        val conn = open("/v1/sessions/$sessionId/observations", "GET", credential)
-        check(conn.responseCode == 200) { "observations failed: ${conn.responseCode}" }
-        return body(conn)
-    }
-
-    fun deleteSession(credential: String, sessionId: String) {
-        open("/v1/sessions/$sessionId", "DELETE", credential).responseCode
-    }
-}

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/Crypto.kt

@@ -1,53 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import javax.crypto.Mac
-import javax.crypto.spec.SecretKeySpec
-
-/**
- * The protocol crypto primitives, matching the server exactly (probe-protocol.md §2.4/§3.1):
- * HMAC-SHA256 for the data-plane gate, and HKDF-SHA256 for the session key
- * `HKDF(ikm = device_credential, salt = key_salt, info = "echolot-v1/" + session_id)`.
- * JDK-only (javax.crypto) — no third-party crypto.
- */
-object Crypto {
-
-    fun hmacSha256(key: ByteArray, data: ByteArray): ByteArray =
-        Mac.getInstance("HmacSHA256").run {
-            init(SecretKeySpec(key, "HmacSHA256"))
-            doFinal(data)
-        }
-
-    /** First 4 bytes of HMAC-SHA256 — the wire anti-abuse gate (spec §3.1). */
-    fun hmac32(key: ByteArray, data: ByteArray): ByteArray = hmacSha256(key, data).copyOf(4)
-
-    /**
-     * HKDF-SHA256 (RFC 5869) extract-then-expand. The JDK exposes no HKDF, so it is built from
-     * HMAC — small and standard.
-     */
-    fun hkdfSha256(ikm: ByteArray, salt: ByteArray, info: ByteArray, length: Int): ByteArray {
-        val prk = hmacSha256(if (salt.isEmpty()) ByteArray(32) else salt, ikm) // extract
-        val out = ByteArray(length)
-        var t = ByteArray(0)
-        var pos = 0
-        var counter = 1
-        while (pos < length) {
-            val mac = Mac.getInstance("HmacSHA256").apply { init(SecretKeySpec(prk, "HmacSHA256")) }
-            mac.update(t)
-            mac.update(info)
-            mac.update(counter.toByte())
-            t = mac.doFinal()
-            val n = minOf(t.size, length - pos)
-            t.copyInto(out, pos, 0, n)
-            pos += n
-            counter++
-        }
-        return out
-    }
-
-    /** Derives the 32-byte session key for a session (spec §2.4). */
-    fun sessionKey(credential: String, keySalt: ByteArray, sessionId: String): ByteArray =
-        hkdfSha256(credential.toByteArray(), keySalt, "echolot-v1/$sessionId".toByteArray(), 32)
-}

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/Model.kt

@@ -1,64 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-import kotlinx.serialization.json.JsonElement
-
-/** Control-plane JSON shapes (probe-protocol.md §2). Only fields the client uses are modeled;
- *  unknown fields are ignored by the lenient Json in [ControlClient]. */
-
-@Serializable
-data class EnrollResponse(
-    @SerialName("device_id") val deviceId: String,
-    val credential: String,
-)
-
-@Serializable
-data class Target(
-    val id: String,
-    val ip4: String? = null,
-    val ip6: String? = null,
-    @SerialName("udp_port") val udpPort: Int = 0,
-    @SerialName("tcp_port") val tcpPort: Int = 0,
-    @SerialName("stun_port") val stunPort: Int = 0,
-)
-
-@Serializable
-data class SelfTest(
-    @SerialName("mtu_ok") val mtuOk: Boolean? = null,
-    @SerialName("sysctl_ok") val sysctlOk: Boolean? = null,
-)
-
-@Serializable
-data class Profile(
-    @SerialName("profile_version") val profileVersion: Int = 0,
-    val name: String = "",
-    @SerialName("server_version") val serverVersion: String = "",
-    val capabilities: List<String> = emptyList(),
-    val targets: List<Target> = emptyList(),
-    @SerialName("canary_zone") val canaryZone: String = "",
-    @SerialName("server_selftest") val serverSelftest: SelfTest? = null,
-    val pins: List<String> = emptyList(),
-) {
-    fun supports(capability: String) = capability in capabilities
-}
-
-@Serializable
-data class SessionResponse(
-    @SerialName("session_id") val sessionId: String,
-    @SerialName("key_salt") val keySalt: String, // base64
-    val epoch: String,
-    @SerialName("expires_s") val expiresS: Int,
-)
-
-/** Observations bundle (§6). Kept as raw JSON where the shape is still evolving server-side. */
-@Serializable
-data class Observations(
-    val udp: JsonElement? = null,
-    val tcp: JsonElement? = null,
-    @SerialName("connect_back") val connectBack: JsonElement? = null,
-    @SerialName("dns_canary") val dnsCanary: JsonElement? = null,
-)

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/Pinning.kt

@@ -1,39 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import java.security.MessageDigest
-import java.security.cert.X509Certificate
-import javax.net.ssl.SSLContext
-import javax.net.ssl.X509TrustManager
-
-/**
- * SPKI-pinned trust (probe-protocol.md §1): the client trusts the server ONLY against the
- * `pin-sha256` from enrollment — CA validation is not required and self-signed is first-class.
- * The pin is base64(SHA-256(SubjectPublicKeyInfo)), RFC 7469.
- */
-object Pinning {
-
-    fun spkiPin(cert: X509Certificate): String {
-        val spki = cert.publicKey.encoded // DER SubjectPublicKeyInfo
-        val digest = MessageDigest.getInstance("SHA-256").digest(spki)
-        return java.util.Base64.getEncoder().encodeToString(digest)
-    }
-
-    /** An SSLContext that accepts a chain iff its leaf SPKI matches one of the expected pins. */
-    fun sslContext(expectedPins: Set<String>): SSLContext {
-        val tm = object : X509TrustManager {
-            override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String) {
-                val leaf = chain.firstOrNull() ?: throw java.security.cert.CertificateException("empty chain")
-                val pin = spkiPin(leaf)
-                if (pin !in expectedPins) {
-                    throw java.security.cert.CertificateException("SPKI pin mismatch: got $pin")
-                }
-            }
-            override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String) = Unit
-            override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
-        }
-        return SSLContext.getInstance("TLS").apply { init(null, arrayOf(tm), null) }
-    }
-}

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/ProbeSession.kt

@@ -1,77 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import java.net.DatagramPacket
-import java.net.DatagramSocket
-import java.net.InetSocketAddress
-import java.util.Base64
-
-/**
- * A data-plane session (probe-protocol.md §3): derives the session key, then sends signed ELT1
- * packets to the server's UDP endpoint and reads back verified responses. One session ↔ one
- * server target. Blocking; the caller owns threading.
- */
-class ProbeSession(
-    private val credential: String,
-    private val session: SessionResponse,
-    private val serverHost: String,
-    private val serverUdpPort: Int,
-) : AutoCloseable {
-
-    private val key: ByteArray =
-        Crypto.sessionKey(credential, Base64.getDecoder().decode(session.keySalt), session.sessionId)
-    private val prefix: ByteArray = Wire.wirePrefix(session.sessionId)
-    private val epochNanos = System.nanoTime()
-    private val socket = DatagramSocket().apply { soTimeout = 3000 }
-    private val server = InetSocketAddress(serverHost, serverUdpPort)
-    private var seq = 0
-
-    private fun nowNs() = System.nanoTime() - epochNanos
-
-    /**
-     * One ECHO round trip. Returns RTT in ms and the server's observation, or null on loss.
-     *
-     * The response is capped at the request size (§3.4 anti-amplification) and the observation
-     * block is 40 bytes, so the request must be at least header+40 = 72 bytes for the full
-     * observation to fit — hence the ≥40 default padding. Smaller requests still measure RTT.
-     */
-    fun echo(paddingBytes: Int = 40): EchoResult? {
-        val t0 = System.nanoTime()
-        val pkt = Wire.build(Wire.TYPE_ECHO_REQ, prefix, ++seq, nowNs(), key, ByteArray(paddingBytes))
-        socket.send(DatagramPacket(pkt, pkt.size, server))
-        val resp = receive(Wire.TYPE_ECHO_RESP) ?: return null
-        val rttMs = (System.nanoTime() - t0) / 1_000_000.0
-        return EchoResult(rttMs, Observation.parse(resp.payload))
-    }
-
-    /** One MTU probe of [totalSize] bytes (DF is set by the OS on the socket where supported).
-     *  Returns the size the server acknowledged receiving, or null if the probe was lost. */
-    fun mtuProbe(totalSize: Int): Int? {
-        val payloadLen = (totalSize - Wire.HEADER_SIZE).coerceAtLeast(0)
-        val pkt = Wire.build(Wire.TYPE_MTU_PROBE, prefix, ++seq, nowNs(), key, ByteArray(payloadLen))
-        socket.send(DatagramPacket(pkt, pkt.size, server))
-        val resp = receive(Wire.TYPE_MTU_ACK) ?: return null
-        if (resp.payload.size < 4) return null
-        return ((resp.payload[0].toInt() and 0xFF) shl 24) or
-            ((resp.payload[1].toInt() and 0xFF) shl 16) or
-            ((resp.payload[2].toInt() and 0xFF) shl 8) or
-            (resp.payload[3].toInt() and 0xFF)
-    }
-
-    private fun receive(wantType: Int): Wire.Packet? {
-        val buf = ByteArray(2048)
-        return try {
-            val dp = DatagramPacket(buf, buf.size)
-            socket.receive(dp)
-            Wire.parseVerified(buf, dp.length, key)?.takeIf { it.type == wantType }
-        } catch (e: java.net.SocketTimeoutException) {
-            null
-        }
-    }
-
-    override fun close() = socket.close()
-
-    data class EchoResult(val rttMs: Double, val observation: Observation?)
-}

echolot-app/core-protocol/bin/main/app/echo_lot/protocol/Wire.kt

@@ -1,115 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import java.nio.ByteBuffer
-import java.nio.ByteOrder
-
-/**
- * The binary UDP probe protocol wire format (probe-protocol.md §3.1): a fixed 32-byte header
- * plus payload, HMAC-gated. Mirrors the Go server's dataplane package byte-for-byte.
- *
- * ```
- * 0  4  magic "ELT1"      8  8  session_prefix (first 8 bytes of session id)
- * 4  1  type            16  4  seq
- * 5  1  flags           20  8  t_ns (sender clock, ns since session epoch)
- * 6  2  payload_len     28  4  hmac32(session_key, header[0..28] || payload)
- * ```
- */
-object Wire {
-    const val HEADER_SIZE = 32
-    val MAGIC = byteArrayOf('E'.code.toByte(), 'L'.code.toByte(), 'T'.code.toByte(), '1'.code.toByte())
-
-    const val TYPE_ECHO_REQ: Int = 0x01
-    const val TYPE_ECHO_RESP: Int = 0x02
-    const val TYPE_TIMESYNC_REQ: Int = 0x07
-    const val TYPE_TIMESYNC_RSP: Int = 0x08
-    const val TYPE_MTU_PROBE: Int = 0x09
-    const val TYPE_MTU_ACK: Int = 0x0A
-    const val TYPE_DELAYED_ECHO: Int = 0x0B
-
-    /** The 8-byte on-the-wire prefix = first 16 hex chars of the session id, decoded. */
-    fun wirePrefix(sessionId: String): ByteArray {
-        require(sessionId.length >= 16) { "session id too short" }
-        val p = ByteArray(8)
-        for (i in 0 until 8) {
-            p[i] = ((hex(sessionId[i * 2]) shl 4) or hex(sessionId[i * 2 + 1])).toByte()
-        }
-        return p
-    }
-
-    private fun hex(c: Char): Int = when (c) {
-        in '0'..'9' -> c - '0'
-        in 'a'..'f' -> c - 'a' + 10
-        in 'A'..'F' -> c - 'A' + 10
-        else -> 0
-    }
-
-    /** Builds a signed packet ready to send. */
-    fun build(
-        type: Int, sessionPrefix: ByteArray, seq: Int, tNs: Long, key: ByteArray,
-        payload: ByteArray = ByteArray(0),
-    ): ByteArray {
-        val buf = ByteBuffer.allocate(HEADER_SIZE + payload.size).order(ByteOrder.BIG_ENDIAN)
-        buf.put(MAGIC)
-        buf.put(type.toByte())
-        buf.put(0) // flags
-        buf.putShort(payload.size.toShort())
-        buf.put(sessionPrefix, 0, 8)
-        buf.putInt(seq)
-        buf.putLong(tNs)
-        buf.position(28) // leave hmac slot; fill after
-        buf.putInt(0)
-        buf.put(payload)
-        val bytes = buf.array()
-        // HMAC over header[0..28] || payload (the hmac slot itself excluded).
-        val mac = Crypto.hmacSha256(key, concat(bytes, 0, 28, bytes, HEADER_SIZE, payload.size))
-        mac.copyInto(bytes, 28, 0, 4)
-        return bytes
-    }
-
-    /** A parsed, HMAC-verified inbound packet. */
-    data class Packet(val type: Int, val seq: Int, val tNs: Long, val payload: ByteArray)
-
-    /** Parses and verifies an inbound datagram; null if malformed or the HMAC fails. */
-    fun parseVerified(data: ByteArray, len: Int, key: ByteArray): Packet? {
-        if (len < HEADER_SIZE) return null
-        for (i in MAGIC.indices) if (data[i] != MAGIC[i]) return null
-        val bb = ByteBuffer.wrap(data, 0, len).order(ByteOrder.BIG_ENDIAN)
-        val type = bb.get(4).toInt() and 0xFF
-        val payloadLen = bb.getShort(6).toInt() and 0xFFFF
-        if (HEADER_SIZE + payloadLen > len) return null
-        val expect = Crypto.hmacSha256(key, concat(data, 0, 28, data, HEADER_SIZE, payloadLen))
-        for (i in 0 until 4) if (expect[i] != data[28 + i]) return null
-        val seq = bb.getInt(16)
-        val tNs = bb.getLong(20)
-        val payload = data.copyOfRange(HEADER_SIZE, HEADER_SIZE + payloadLen)
-        return Packet(type, seq, tNs, payload)
-    }
-
-    private fun concat(a: ByteArray, aOff: Int, aLen: Int, b: ByteArray, bOff: Int, bLen: Int): ByteArray {
-        val out = ByteArray(aLen + bLen)
-        a.copyInto(out, 0, aOff, aOff + aLen)
-        b.copyInto(out, aLen, bOff, bOff + bLen)
-        return out
-    }
-}
-
-/** Server observation block appended to ECHO_RESP (spec §3.3), fixed 40 bytes. */
-data class Observation(
-    val tRxNs: Long, val tTxNs: Long, val observedPort: Int, val receivedSize: Int,
-) {
-    companion object {
-        fun parse(payload: ByteArray): Observation? {
-            if (payload.size < 40) return null
-            val bb = ByteBuffer.wrap(payload).order(ByteOrder.BIG_ENDIAN)
-            return Observation(
-                tRxNs = bb.getLong(0),
-                tTxNs = bb.getLong(8),
-                observedPort = bb.getShort(32).toInt() and 0xFFFF,
-                receivedSize = bb.getInt(36),
-            )
-        }
-    }
-}

echolot-app/core-protocol/bin/test/app/echo_lot/protocol/CryptoWireTest.kt

@@ -1,76 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertNull
-import kotlin.test.assertNotNull
-import kotlin.test.assertTrue
-
-class CryptoWireTest {
-
-    @Test
-    fun hkdfMatchesRfc5869Vector() {
-        // RFC 5869 Appendix A.1 (SHA-256).
-        val ikm = ByteArray(22) { 0x0b }
-        val salt = byteArrayOf(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-        val info = byteArrayOf(
-            0xf0.toByte(), 0xf1.toByte(), 0xf2.toByte(), 0xf3.toByte(), 0xf4.toByte(),
-            0xf5.toByte(), 0xf6.toByte(), 0xf7.toByte(), 0xf8.toByte(), 0xf9.toByte(),
-        )
-        val okm = Crypto.hkdfSha256(ikm, salt, info, 42)
-        val expect = "3cb25f25faacd57a90434f64d0362f2a" +
-            "2d2d0a90cf1a5a4c5db02d56ecc4c5bf" +
-            "34007208d5b887185865"
-        assertEquals(expect, okm.joinToString("") { "%02x".format(it) })
-    }
-
-    @Test
-    fun wirePrefixDecodesHex() {
-        val prefix = Wire.wirePrefix("805a43f8395ae08ace7a14803766cb11")
-        assertEquals("805a43f8395ae08a", prefix.joinToString("") { "%02x".format(it) })
-    }
-
-    @Test
-    fun buildThenParseRoundTripsAndVerifies() {
-        val key = ByteArray(32) { it.toByte() }
-        val prefix = ByteArray(8) { (it + 1).toByte() }
-        val payload = "hello-echolot".toByteArray()
-        val pkt = Wire.build(Wire.TYPE_ECHO_REQ, prefix, 7, 123_456L, key, payload)
-        assertEquals(Wire.HEADER_SIZE + payload.size, pkt.size)
-
-        val parsed = Wire.parseVerified(pkt, pkt.size, key)
-        assertNotNull(parsed)
-        assertEquals(Wire.TYPE_ECHO_REQ, parsed.type)
-        assertEquals(7, parsed.seq)
-        assertEquals(123_456L, parsed.tNs)
-        assertEquals("hello-echolot", String(parsed.payload))
-    }
-
-    @Test
-    fun tamperedHmacIsRejected() {
-        val key = ByteArray(32) { it.toByte() }
-        val pkt = Wire.build(Wire.TYPE_ECHO_REQ, ByteArray(8), 1, 0, key, ByteArray(4))
-        pkt[pkt.size - 1] = (pkt[pkt.size - 1].toInt() xor 0xFF).toByte() // flip a payload byte
-        assertNull(Wire.parseVerified(pkt, pkt.size, key))
-    }
-
-    @Test
-    fun wrongKeyIsRejected() {
-        val pkt = Wire.build(Wire.TYPE_ECHO_REQ, ByteArray(8), 1, 0, ByteArray(32) { 1 }, ByteArray(0))
-        assertNull(Wire.parseVerified(pkt, pkt.size, ByteArray(32) { 2 }))
-    }
-
-    @Test
-    fun observationParses() {
-        // 40-byte block: t_rx, t_tx, 16-byte addr, port, ttl/dscp, size.
-        val b = ByteArray(40)
-        b[33] = 0x1F // port low byte = 8191... set port bytes 32..33
-        b[32] = 0x00
-        val obs = Observation.parse(b)
-        assertNotNull(obs)
-        assertTrue(obs.observedPort in 0..65535)
-    }
-}

echolot-app/core-protocol/bin/test/app/echo_lot/protocol/LiveServerTest.kt

@@ -1,66 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Echolot contributors
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package app.echo_lot.protocol
-
-import kotlin.test.Test
-import kotlin.test.assertNotNull
-import kotlin.test.assertTrue
-
-/**
- * End-to-end test of the Kotlin client against a REAL running server. It self-skips unless the
- * environment provides a live target, so it never breaks CI (no network / no server):
- *
- *   ECHOLOT_LIVE_URL    = https://fmr-1.echo-lot.app:8443
- *   ECHOLOT_LIVE_PIN    = <base64 pin-sha256>
- *   ECHOLOT_LIVE_CRED   = <device credential from an enrollment>
- *   ECHOLOT_LIVE_UDP    = fmr-1.echo-lot.app:8442
- *   ECHOLOT_LIVE_TARGET = fmr           (profile target id)
- *
- * The harness (test-fmr.sh) mints a token over SSH, enrolls via the public control plane, and
- * exports these — proving the client talks to the deployed server over the wire.
- */
-class LiveServerTest {
-
-    private val url = System.getenv("ECHOLOT_LIVE_URL")
-    private val pin = System.getenv("ECHOLOT_LIVE_PIN")
-    private val cred = System.getenv("ECHOLOT_LIVE_CRED")
-    private val udp = System.getenv("ECHOLOT_LIVE_UDP")
-    private val target = System.getenv("ECHOLOT_LIVE_TARGET") ?: "fmr"
-
-    @Test
-    fun fullFlowAgainstLiveServer() {
-        if (url == null || pin == null || cred == null || udp == null) {
-            println("LiveServerTest skipped (no ECHOLOT_LIVE_* env)")
-            return
-        }
-        val control = ControlClient(url, setOf(pin))
-
-        val profile = control.profile(cred)
-        println("profile: name=${profile.name} v=${profile.serverVersion} caps=${profile.capabilities}")
-        assertTrue(profile.supports("udp-probe"), "server must offer udp-probe")
-
-        val session = control.createSession(cred, target)
-        println("session: ${session.sessionId} expires=${session.expiresS}s")
-
-        val (host, port) = udp.split(":").let { it[0] to it[1].toInt() }
-        ProbeSession(cred, session, host, port).use { ps ->
-            // ECHO: verified response + observation with our observed port.
-            val echo = ps.echo(paddingBytes = 64) // ≥40 so the observation block fits (§3.4)
-            assertNotNull(echo, "no verified ECHO_RESP from live server")
-            println("echo rtt=${"%.1f".format(echo.rttMs)}ms observedPort=${echo.observation?.observedPort} size=${echo.observation?.receivedSize}")
-            assertNotNull(echo.observation, "ECHO_RESP missing observation block")
-
-            // MTU probe: server acks the size it received.
-            val acked = ps.mtuProbe(1400)
-            assertNotNull(acked, "no MTU_ACK from live server")
-            println("mtu probe 1400 -> server received $acked bytes")
-            assertTrue(acked!! in 1300..1500, "acked size implausible: $acked")
-        }
-
-        val obs = control.observations(cred, session.sessionId)
-        println("observations bytes: ${obs.length}")
-        assertTrue(obs.contains("packets_seen"), "observations should report packets_seen")
-        control.deleteSession(cred, session.sessionId)
-    }
-}

echolot-app/core-protocol/src/main/kotlin/app/echo_lot/protocol/ControlClient.kt

@@ -17,6 +17,9 @@ import javax.net.ssl.HttpsURLConnection
  * @param controlUrl e.g. "https://fmr-1.echo-lot.app:8443"
  * @param pins       the `pin-sha256` value(s) from the enrollment QR (base64, no prefix)
  */
+/** The server declined to store this run, per the operator's policy. Not a transport failure. */
+class UploadRefused(message: String) : Exception(message)
+
 class ControlClient(private val controlUrl: String, pins: Set<String>) {
 
     private val json = Json { ignoreUnknownKeys = true }
@@ -80,6 +83,57 @@ class ControlClient(private val controlUrl: String, pins: Set<String>) {
         return json.decodeFromString(SessionResponse.serializer(), body(conn))
     }
 
+    /**
+     * Requests a §5 action. The server creates an asymmetric grant for the granted ones
+     * (downtrain / big_send) and starts sending toward the session's observed data-plane source,
+     * so the caller must already have sent at least one ECHO. Returns the raw JSON reply.
+     */
+    fun action(credential: String, sessionId: String, bodyJson: String): String {
+        val conn = open("/v1/sessions/$sessionId/actions", "POST", credential)
+        writeJson(conn, bodyJson)
+        val body = body(conn)
+        check(conn.responseCode in 200..299) { "action failed: ${conn.responseCode} $body" }
+        return body
+    }
+
+    /**
+     * Uploads one measurement document. The body is sent exactly as given — whatever the
+     * anonymizer produced is what the server stores, so what the user was shown is what left
+     * the device. Returns the server's index entry as raw JSON.
+     *
+     * A refusal is not an error condition to retry: 403 means the operator's policy says no
+     * (uploads off, accounts required, or not anonymized enough), so it is surfaced as
+     * [UploadRefused] for the caller to show rather than swallow.
+     */
+    fun uploadRun(credential: String, documentJson: String): String {
+        val conn = open("/v1/runs", "POST", credential)
+        writeJson(conn, documentJson)
+        val body = body(conn)
+        when (conn.responseCode) {
+            in 200..299 -> return body
+            403 -> throw UploadRefused(body)
+            413 -> throw UploadRefused("run is larger than this server accepts: $body")
+            else -> error("upload failed: ${conn.responseCode} $body")
+        }
+    }
+
+    /** Lists this device's runs stored on the server. */
+    fun listRuns(credential: String): String {
+        val conn = open("/v1/runs", "GET", credential)
+        check(conn.responseCode == 200) { "list runs failed: ${conn.responseCode}" }
+        return body(conn)
+    }
+
+    fun getRun(credential: String, runId: String): String {
+        val conn = open("/v1/runs/$runId", "GET", credential)
+        check(conn.responseCode == 200) { "get run failed: ${conn.responseCode}" }
+        return body(conn)
+    }
+
+    fun deleteRun(credential: String, runId: String) {
+        open("/v1/runs/$runId", "DELETE", credential).responseCode
+    }
+
     fun observations(credential: String, sessionId: String): String {
         val conn = open("/v1/sessions/$sessionId/observations", "GET", credential)
         check(conn.responseCode == 200) { "observations failed: ${conn.responseCode}" }

echolot-app/core-protocol/src/main/kotlin/app/echo_lot/protocol/Model.kt

@@ -32,6 +32,30 @@ data class SelfTest(
     @SerialName("sysctl_ok") val sysctlOk: Boolean? = null,
 )
 
+/**
+ * The operator's upload rules, advertised in the profile so the app can present the choice
+ * honestly — greyed out with a reason when the server refuses, and pre-set to the server's
+ * minimum anonymization when it accepts — instead of discovering the policy by being rejected.
+ */
+@Serializable
+data class UploadPolicy(
+    val mode: String = "off",
+    @SerialName("max_bytes") val maxBytes: Long = 0,
+    @SerialName("retention_days") val retentionDays: Int = 0,
+    @SerialName("max_runs_per_device") val maxRunsPerDevice: Int = 0,
+    @SerialName("min_anonymization") val minAnonymization: String = "full",
+    val reason: String? = null,
+) {
+    val accepted: Boolean get() = mode == "anonymous" || mode == "account"
+
+    /** Why uploads are unavailable, in words a user can act on. */
+    fun refusalReason(): String? = when (mode) {
+        "off" -> reason ?: "This server does not accept uploaded runs."
+        "account" -> "This server only accepts uploads from signed-in accounts."
+        else -> null
+    }
+}
+
 @Serializable
 data class Profile(
     @SerialName("profile_version") val profileVersion: Int = 0,
@@ -42,6 +66,7 @@ data class Profile(
     @SerialName("canary_zone") val canaryZone: String = "",
     @SerialName("server_selftest") val serverSelftest: SelfTest? = null,
     val pins: List<String> = emptyList(),
+    val uploads: UploadPolicy = UploadPolicy(),
 ) {
     fun supports(capability: String) = capability in capabilities
 }

echolot-app/core-protocol/src/main/kotlin/app/echo_lot/protocol/ProbeSession.kt

@@ -60,6 +60,40 @@ class ProbeSession(
             (resp.payload[3].toInt() and 0xFF)
     }
 
+    /**
+     * Collects packets the SERVER sends under a grant (downtrain / big_send) for [windowMs].
+     * These arrive unsolicited after a control-plane action, so this just drains the socket and
+     * keeps every HMAC-verified packet — anything that fails verification is not ours and is
+     * silently ignored (an injected packet must not be able to fake a measurement).
+     */
+    fun collectGranted(windowMs: Long): List<Received> {
+        val out = ArrayList<Received>()
+        val deadline = System.nanoTime() + windowMs * 1_000_000
+        val buf = ByteArray(9200)
+        val prevTimeout = socket.soTimeout
+        try {
+            while (System.nanoTime() < deadline) {
+                val remainMs = ((deadline - System.nanoTime()) / 1_000_000).toInt()
+                if (remainMs <= 0) break
+                socket.soTimeout = remainMs.coerceAtMost(2000)
+                val dp = DatagramPacket(buf, buf.size)
+                try {
+                    socket.receive(dp)
+                } catch (e: java.net.SocketTimeoutException) {
+                    continue
+                }
+                val pkt = Wire.parseVerified(buf, dp.length, key) ?: continue
+                out.add(Received(pkt.type, pkt.seq, dp.length, (System.nanoTime() - epochNanos)))
+            }
+        } finally {
+            socket.soTimeout = prevTimeout
+        }
+        return out
+    }
+
+    /** One packet received from the server, with the wire size actually delivered. */
+    data class Received(val type: Int, val seq: Int, val sizeBytes: Int, val tRxNs: Long)
+
     private fun receive(wantType: Int): Wire.Packet? {
         val buf = ByteArray(2048)
         return try {

echolot-app/core-protocol/src/main/kotlin/app/echo_lot/protocol/Wire.kt

@@ -28,6 +28,9 @@ object Wire {
     const val TYPE_MTU_PROBE: Int = 0x09
     const val TYPE_MTU_ACK: Int = 0x0A
     const val TYPE_DELAYED_ECHO: Int = 0x0B
+    /** Server->client under an asymmetric grant (spec §3.4/§5). */
+    const val TYPE_DOWNTRAIN_DATA: Int = 0x06
+    const val TYPE_BIG_SEND: Int = 0x0C
 
     /** The 8-byte on-the-wire prefix = first 16 hex chars of the session id, decoded. */
     fun wirePrefix(sessionId: String): ByteArray {

echolot-app/scripts/test-fmr.sh

@@ -8,7 +8,8 @@
 # whole lot to the Gradle test. Proves the Kotlin client talks to the real
 # server over the wire.
 #
-# Usage: JAVA_HOME=... echolot-app/scripts/test-fmr.sh
+# Usage: JAVA_HOME=... echolot-app/scripts/test-fmr.sh [gradle-task] [test-filter]
+#   e.g. ... test-fmr.sh :core-engine:test '*LiveGrantedTest*'
 set -euo pipefail
 
 SSH_HOST="${ECHOLOT_SSH:-claude-echolot}"
@@ -33,12 +34,14 @@ PIN=$(echo | openssl s_client -connect "${CTL_HOST}:${CTL_PORT}" 2>/dev/null \
   | openssl dgst -sha256 -binary | openssl base64)
 
 echo "· pin=${PIN}"
-echo "· running LiveServerTest ..."
+TASK="${1:-:core-protocol:test}"
+FILTER="${2:-*LiveServerTest*}"
+echo "· running ${TASK} ${FILTER} ..."
 cd "$(dirname "$0")/.."
 ECHOLOT_LIVE_URL="$CTL_URL" \
 ECHOLOT_LIVE_PIN="$PIN" \
 ECHOLOT_LIVE_CRED="$CRED" \
 ECHOLOT_LIVE_UDP="${CTL_HOST}:${UDP_PORT}" \
 ECHOLOT_LIVE_TARGET="${ECHOLOT_LIVE_TARGET:-fmr}" \
-  ./gradlew :core-protocol:test --tests '*LiveServerTest*' --info --rerun-tasks --console=plain \
+  ./gradlew "$TASK" --tests "$FILTER" --info --rerun-tasks --console=plain \
-  2>&1 | grep -E "profile:|session:|echo |mtu probe|observations bytes|LiveServerTest|BUILD|FAIL|PASS" || true
+  2>&1 | grep -E "profile:|capabilities:|session:|echo |primed|mtu probe|downtrain|big_send|largest|observations bytes|Live[A-Za-z]*Test|BUILD|FAIL|PASS|^e:" || true

echolot-app/settings.gradle.kts

@@ -24,6 +24,8 @@ rootProject.name = "echolot-app"
 include(":core-protocol")
 include(":core-measurement")
 include(":core-engine")
+include(":core-privacy")
+include(":core-archive")
 include(":core-probe")
 include(":core-shizuku")
 include(":app")

server/cmd/echolot-server/main.go

@@ -39,6 +39,7 @@ import (
 	"echo-lot.app/server/internal/config"
 	"echo-lot.app/server/internal/control"
 	"echo-lot.app/server/internal/dataplane"
+	"echo-lot.app/server/internal/runs"
 	"echo-lot.app/server/internal/selftest"
 	"echo-lot.app/server/internal/selfupdate"
 	"echo-lot.app/server/internal/session"
@@ -113,6 +114,23 @@ func serve(cfg *config.Config) error {
 		caps = append(caps, "tcp-echo", "tls-echo")
 	}
 
+	// Uploaded-run storage. A failure here is not fatal: measurement still works, uploads just
+	// stay unavailable and say so in the profile.
+	runStore, err := runs.Open(cfg.StateDir, runs.Policy{
+		Mode:             runs.Mode(cfg.UploadsMode),
+		MaxBytes:         cfg.UploadMaxBytes,
+		RetentionDays:    cfg.UploadRetentionDays,
+		MaxRunsPerDevice: cfg.UploadMaxRuns,
+		MinAnonymization: cfg.UploadMinAnon,
+	})
+	if err != nil {
+		slog.Warn("uploaded-run storage unavailable — uploads disabled", "err", err)
+		runStore = nil
+	} else {
+		slog.Info("uploads", "mode", cfg.UploadsMode, "min_anonymization", cfg.UploadMinAnon,
+			"retention_days", cfg.UploadRetentionDays, "max_runs_per_device", cfg.UploadMaxRuns)
+	}
+
 	ctl := &control.Server{
 		Store: st, Sessions: sessions, Name: cfg.Name,
 		UDPPort: mustPort(firstAddr(cfg.UDPListen)), TCPPort: mustPort(firstAddr(cfg.TCPListen)),
@@ -121,6 +139,7 @@ func serve(cfg *config.Config) error {
 		DownTrain:   dp.DownTrain,
 		BigSend:     dp.BigSend,
 		TCPRecent:   func(ip string) any { return tcpSrv.RecentFor(ip) },
+		Runs:        runStore,
 	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -172,6 +191,17 @@ func serve(cfg *config.Config) error {
 		r := selftestPtr.Load()
 		return r.MTUOK, r.SysctlOK
 	}
+	// The smallest egress MTU we measured is the ceiling for DF-mode big_send: above it our own
+	// kernel refuses the datagram, which would otherwise look like a downstream path limit.
+	ctl.EgressMTU = func() int {
+		best := 0
+		for _, m := range selftestPtr.Load().EgressMTU {
+			if m.DiscoveredMTU > 0 && (best == 0 || m.DiscoveredMTU < best) {
+				best = m.DiscoveredMTU
+			}
+		}
+		return best
+	}
 
 	// Admin/health (plain HTTP, localhost by default; spec §7)
 	admin := http.NewServeMux()

server/internal/canarydns/canarydns.go

@@ -284,4 +284,3 @@ func (s *Server) errorResponse(id uint16, rcode int, opt *optInfo) []byte {
 	}
 	return hdr
 }
-

server/internal/config/config.go

@@ -11,6 +11,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"strconv"
 	"strings"
 )
 
@@ -49,10 +50,28 @@ type Config struct {
 	// e.g. https://git.example.net/api/v1/repos/owner/repo
 	SelfUpdateAPI string // ECHOLOT_SELF_UPDATE_API / --self-update-api
 
+	// Uploaded-run storage. The default is "anonymous": any enrolled device may upload,
+	// which is what a self-hosted server wants. Operators of shared servers turn it down.
+	UploadsMode         string // ECHOLOT_UPLOADS / --uploads (off|anonymous|account)
+	UploadMaxBytes      int64  // ECHOLOT_UPLOAD_MAX_BYTES / --upload-max-bytes
+	UploadRetentionDays int    // ECHOLOT_UPLOAD_RETENTION_DAYS / --upload-retention-days
+	UploadMaxRuns       int    // ECHOLOT_UPLOAD_MAX_RUNS / --upload-max-runs (per device)
+	UploadMinAnon       string // ECHOLOT_UPLOAD_MIN_ANONYMIZATION / --upload-min-anonymization
+
 	// Mode
 	Docker bool // --docker (or autodetected; env ECHOLOT_DOCKER=1 forces)
 }
 
+// envInt reads ECHOLOT_<key> as an integer with a fallback.
+func envInt(key string, def int) int {
+	if v := envOr(key, ""); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return def
+}
+
 // envOr reads ECHOLOT_<key> with a fallback.
 func envOr(key, def string) string {
 	if v, ok := os.LookupEnv("ECHOLOT_" + key); ok {
@@ -82,6 +101,11 @@ func Load(args []string) (*Config, *Actions, error) {
 	fs.StringVar(&c.StateDir, "state-dir", envOr("STATE_DIR", defaultStateDir()), "state directory (device store, generated TLS)")
 	fs.StringVar(&c.Name, "name", envOr("NAME", "echolot"), "server profile name")
 	fs.StringVar(&c.SelfUpdateAPI, "self-update-api", envOr("SELF_UPDATE_API", ""), "Gitea repo API base for self-update; empty disables")
+	fs.StringVar(&c.UploadsMode, "uploads", envOr("UPLOADS", "anonymous"), "who may upload measurement runs: off|anonymous|account")
+	fs.Int64Var(&c.UploadMaxBytes, "upload-max-bytes", int64(envInt("UPLOAD_MAX_BYTES", 4<<20)), "largest accepted uploaded run, bytes")
+	fs.IntVar(&c.UploadRetentionDays, "upload-retention-days", envInt("UPLOAD_RETENTION_DAYS", 90), "delete uploaded runs older than this; 0 disables")
+	fs.IntVar(&c.UploadMaxRuns, "upload-max-runs", envInt("UPLOAD_MAX_RUNS", 200), "keep at most this many runs per device; 0 disables")
+	fs.StringVar(&c.UploadMinAnon, "upload-min-anonymization", envOr("UPLOAD_MIN_ANONYMIZATION", "full"), "least anonymization accepted: full|balanced|strict")
 	fs.BoolVar(&c.Docker, "docker", envOr("DOCKER", "") == "1", "force container mode (config from env, no systemd/self-update)")
 
 	fs.BoolVar(&a.InstallSystemd, "install-systemd", false, "install a systemd unit for this binary and exit")

server/internal/control/bigsend_df_test.go

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package control
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	"echo-lot.app/server/internal/session"
+)
+
+// The DF ceiling is the difference between "the client's path cannot carry this" and "we could
+// never have sent it in the first place". Getting the header arithmetic wrong would silently
+// attribute a server limit to the client's network, so it is pinned here.
+func TestMaxDFPayload(t *testing.T) {
+	mgr := session.NewManager(time.Minute)
+
+	newSess := func(src string) *session.Session {
+		s, _, err := mgr.New("dev", "cred", netip.MustParseAddr("203.0.113.9"))
+		if err != nil {
+			t.Fatalf("new session: %v", err)
+		}
+		if src != "" {
+			s.NoteDataSource(netip.MustParseAddrPort(src))
+		}
+		return s
+	}
+
+	cases := []struct {
+		name string
+		mtu  func() int
+		src  string
+		want int
+	}{
+		{"no egress mtu hook means no clamp", nil, "198.51.100.4:5000", 0},
+		{"unknown egress mtu means no clamp", func() int { return 0 }, "198.51.100.4:5000", 0},
+		{"ipv4 subtracts ip+udp", func() int { return 1500 }, "198.51.100.4:5000", 1472},
+		{"ipv6 subtracts the larger header", func() int { return 1500 }, "[2001:db8::4]:5000", 1452},
+		{"pppoe-style 1492 egress", func() int { return 1492 }, "198.51.100.4:5000", 1464},
+		{"no data source yet falls back to ipv4 overhead", func() int { return 1500 }, "", 1472},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s := &Server{EgressMTU: tc.mtu}
+			if got := s.maxDFPayload(newSess(tc.src)); got != tc.want {
+				t.Fatalf("maxDFPayload = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}

server/internal/control/control.go

@@ -15,6 +15,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"io"
 	"log/slog"
 	"net"
 	"net/http"
@@ -23,6 +24,8 @@ import (
 	"strings"
 	"time"
 
+	"echo-lot.app/server/internal/dataplane"
+	"echo-lot.app/server/internal/runs"
 	"echo-lot.app/server/internal/session"
 	"echo-lot.app/server/internal/store"
 )
@@ -51,7 +54,13 @@ type Server struct {
 	DelayedEcho func(sess *session.Session, actionID string) error
 	// Granted server->client sends (spec §5). Both consume an asymmetric grant.
 	DownTrain func(sess *session.Session, g *session.Grant, count, sizeBytes, intervalUs int) (int, error)
-	BigSend   func(sess *session.Session, g *session.Grant, sizes []int) ([]int, error)
+	BigSend   func(sess *session.Session, g *session.Grant, sizes []int, df bool) ([]dataplane.BigSendResult, error)
+	// Runs stores uploaded measurement documents (may be nil: uploads unsupported).
+	Runs *runs.Store
+	// EgressMTU reports the server's own measured egress path MTU (0 = unknown). With DF set
+	// we cannot emit a datagram larger than this, so requested sizes above it are refused up
+	// front and reported as such — the client must not read that as a downstream path limit.
+	EgressMTU func() int
 	// CanaryQueries returns logged canary lookups for a session prefix (may be nil).
 	CanaryQueries func(sessionPrefix string) any
 	// CanaryZone is surfaced in the profile so the app knows what to query.
@@ -73,6 +82,10 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /v1/sessions/{id}/actions", s.actions)
 	mux.HandleFunc("POST /v1/echo", s.httpEcho)
 	mux.HandleFunc("GET /v1/tls-reference", s.tlsReference)
+	mux.HandleFunc("POST /v1/runs", s.uploadRun)
+	mux.HandleFunc("GET /v1/runs", s.listRuns)
+	mux.HandleFunc("GET /v1/runs/{id}", s.getRun)
+	mux.HandleFunc("DELETE /v1/runs/{id}", s.deleteRun)
 	// TODO(spec §5): frag_send, throughput (both build on the same grant machinery)
 	return mux
 }
@@ -156,6 +169,7 @@ func (s *Server) actions(w http.ResponseWriter, r *http.Request) {
 		SizeBytes  int    `json:"size_bytes"`
 		IntervalUs int    `json:"interval_us"`
 		SizesBytes []int  `json:"sizes_bytes"`
+		DF         *bool  `json:"df"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "bad body"})
@@ -241,6 +255,35 @@ func (s *Server) actions(w http.ResponseWriter, r *http.Request) {
 		if len(sizes) > 32 {
 			sizes = sizes[:32]
 		}
+		// DF on by default: an unfragmented burst is what makes the result a path-MTU
+		// measurement rather than a fragment-delivery one. Callers opt out explicitly.
+		df := true
+		if req.DF != nil {
+			df = *req.DF
+		}
+		// With DF we can only emit up to our own egress MTU minus IP+UDP headers. Drop the
+		// rest here and say so, rather than sending nothing and letting the client blame
+		// the path.
+		maxDF := 0
+		if df {
+			maxDF = s.maxDFPayload(sess)
+			if maxDF > 0 {
+				kept := sizes[:0]
+				for _, x := range sizes {
+					if x <= maxDF {
+						kept = append(kept, x)
+					}
+				}
+				sizes = kept
+			}
+		}
+		if len(sizes) == 0 {
+			writeJSON(w, http.StatusBadRequest, map[string]any{
+				"error":        "every requested size exceeds the server's own egress MTU with DF set",
+				"max_df_bytes": maxDF,
+			})
+			return
+		}
 		total := 0
 		for _, x := range sizes {
 			total += clamp(x, dataMinPacket, 9000)
@@ -251,11 +294,11 @@ func (s *Server) actions(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		go func() {
-			attempted, err := s.BigSend(sess, g, sizes)
+			results, err := s.BigSend(sess, g, sizes, df)
-			slog.Info("big_send finished", "action", actionID, "attempted", attempted, "err", err)
+			slog.Info("big_send finished", "action", actionID, "results", results, "df", df, "err", err)
 		}()
 		writeJSON(w, http.StatusAccepted, map[string]any{
-			"action_id": actionID, "sizes_bytes": sizes,
+			"action_id": actionID, "sizes_bytes": sizes, "df": df, "max_df_bytes": maxDF,
 			"grant": map[string]any{"max_bytes": g.MaxBytes, "max_kbps": g.MaxKbps},
 		})
 
@@ -264,6 +307,24 @@ func (s *Server) actions(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// maxDFPayload is the largest UDP payload the server can emit toward this session without
+// fragmenting: its own egress MTU less the IP and UDP headers of the session's address family.
+// Returns 0 when the egress MTU is unknown, meaning "do not clamp".
+func (s *Server) maxDFPayload(sess *session.Session) int {
+	if s.EgressMTU == nil {
+		return 0
+	}
+	mtu := s.EgressMTU()
+	if mtu <= 0 {
+		return 0
+	}
+	overhead := 28 // IPv4 (20) + UDP (8)
+	if src := sess.DataSource(); src.IsValid() && !src.Addr().Unmap().Is4() {
+		overhead = 48 // IPv6 (40) + UDP (8)
+	}
+	return mtu - overhead
+}
+
 // dataMinPacket is the smallest datagram that still carries a header + a little payload.
 const dataMinPacket = 40
 
@@ -360,6 +421,9 @@ func (s *Server) profile(w http.ResponseWriter, r *http.Request) {
 		"canary_zone":     s.CanaryZone,
 		"server_selftest": selftestSignal(s.ProvenGood),
 		"limits":          map[string]any{"max_kbps": 50000, "max_session_s": 900},
+		// The app needs the upload rules before it offers the switch: whether uploads are
+		// accepted at all, and how much identifying detail it must strip first.
+		"uploads": s.uploadPolicy(),
 	})
 }
 
@@ -411,3 +475,102 @@ func SpkiPinB64(cert tls.Certificate) (string, error) {
 	sum := sha256.Sum256(leaf.RawSubjectPublicKeyInfo)
 	return base64.StdEncoding.EncodeToString(sum[:]), nil
 }
+
+// uploadPolicy is the profile's advertisement of the operator's upload rules.
+func (s *Server) uploadPolicy() map[string]any {
+	if s.Runs == nil {
+		return map[string]any{"mode": string(runs.ModeOff), "reason": "not configured"}
+	}
+	p := s.Runs.Policy()
+	return map[string]any{
+		"mode":                string(p.Mode),
+		"max_bytes":           p.MaxBytes,
+		"retention_days":      p.RetentionDays,
+		"max_runs_per_device": p.MaxRunsPerDevice,
+		"min_anonymization":   p.MinAnonymization,
+	}
+}
+
+// uploadRun stores one measurement document for the calling device.
+func (s *Server) uploadRun(w http.ResponseWriter, r *http.Request) {
+	dev := s.Store.DeviceByCredential(bearer(r))
+	if dev == nil {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unknown credential"})
+		return
+	}
+	if s.Runs == nil {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": runs.ErrDisabled.Error()})
+		return
+	}
+	limit := s.Runs.Policy().MaxBytes
+	if limit <= 0 {
+		limit = 4 << 20
+	}
+	// +1 so a body exactly at the limit is distinguishable from one over it.
+	body, err := io.ReadAll(io.LimitReader(r.Body, limit+1))
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "read failed"})
+		return
+	}
+	meta, err := s.Runs.Put(dev.ID, body)
+	switch {
+	case err == nil:
+		slog.Info("run uploaded", "device", dev.ID, "run", meta.ID,
+			"bytes", meta.SizeBytes, "anon", meta.Anonymization, "findings", meta.FindingCount)
+		writeJSON(w, http.StatusCreated, meta)
+	case errors.Is(err, runs.ErrDisabled), errors.Is(err, runs.ErrNeedAccount),
+		errors.Is(err, runs.ErrNotAnonEnough):
+		writeJSON(w, http.StatusForbidden, map[string]any{
+			"error": err.Error(), "uploads": s.uploadPolicy(),
+		})
+	case errors.Is(err, runs.ErrTooLarge):
+		writeJSON(w, http.StatusRequestEntityTooLarge, map[string]any{
+			"error": err.Error(), "max_bytes": s.Runs.Policy().MaxBytes,
+		})
+	default:
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+}
+
+func (s *Server) listRuns(w http.ResponseWriter, r *http.Request) {
+	dev := s.Store.DeviceByCredential(bearer(r))
+	if dev == nil || s.Runs == nil {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unknown credential"})
+		return
+	}
+	list := s.Runs.List(dev.ID)
+	if list == nil {
+		list = []runs.Meta{}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"runs": list})
+}
+
+func (s *Server) getRun(w http.ResponseWriter, r *http.Request) {
+	dev := s.Store.DeviceByCredential(bearer(r))
+	if dev == nil || s.Runs == nil {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unknown credential"})
+		return
+	}
+	// Scoped to the calling device's own directory: one device cannot read another's runs by
+	// guessing a run id.
+	b, err := s.Runs.Get(dev.ID, r.PathValue("id"))
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "no such run"})
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write(b)
+}
+
+func (s *Server) deleteRun(w http.ResponseWriter, r *http.Request) {
+	dev := s.Store.DeviceByCredential(bearer(r))
+	if dev == nil || s.Runs == nil {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unknown credential"})
+		return
+	}
+	if err := s.Runs.Delete(dev.ID, r.PathValue("id")); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}

server/internal/control/httpecho_test.go

@@ -60,4 +60,3 @@ func TestTLSReferenceReturnsChain(t *testing.T) {
 		t.Fatalf("leaf DER not round-tripped: %x", first)
 	}
 }
-

server/internal/dataplane/connfor_test.go

@@ -0,0 +1,71 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package dataplane
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+)
+
+// A multi-homed server must answer from the address the client has been talking to. Sending from
+// a sibling address is silently dropped by the client's NAT or stateful firewall, and the client
+// then reports downstream loss that never happened — a wrong measurement, which is worse than a
+// failed one. This was a real bug: fmr binds two IPv4 addresses, the granted train went out from
+// the one the session had never used, and every packet vanished in transit.
+func TestConnForPrefersTheAddressTheSessionUsed(t *testing.T) {
+	// Two loopback-bound sockets stand in for the two service addresses.
+	a := mustListen(t, "127.0.0.1:0")
+	b := mustListen(t, "127.0.0.1:0")
+	defer a.Close()
+	defer b.Close()
+
+	srv := &Server{}
+	srv.conns = []*net.UDPConn{a, b}
+
+	client := netip.MustParseAddrPort("198.51.100.7:41000")
+	bLocal := b.LocalAddr().(*net.UDPAddr).AddrPort()
+
+	if got := srv.connFor(client, bLocal); got != b {
+		t.Fatalf("connFor picked the wrong socket: want the one the session used (%v)", bLocal)
+	}
+
+	// With no recorded local address (nothing received yet) any socket of the right family is
+	// the best available answer — but it must still be one, not nil.
+	if got := srv.connFor(client, netip.AddrPort{}); got == nil {
+		t.Fatal("connFor returned nil when a family match exists")
+	}
+}
+
+func TestConnForFallsBackByFamily(t *testing.T) {
+	v4 := mustListen(t, "127.0.0.1:0")
+	defer v4.Close()
+	srv := &Server{}
+	srv.conns = []*net.UDPConn{v4}
+
+	// A recorded local address that no longer matches any bound socket (a reload changed the
+	// binds) must not strand the session: fall back rather than return nil.
+	stale := netip.MustParseAddrPort("203.0.113.1:8442")
+	if got := srv.connFor(netip.MustParseAddrPort("198.51.100.7:41000"), stale); got != v4 {
+		t.Fatal("connFor should fall back to a family match when the recorded socket is gone")
+	}
+
+	// No IPv6 socket is bound, so an IPv6 target has no answer — nil, not an IPv4 socket.
+	if got := srv.connFor(netip.MustParseAddrPort("[2001:db8::1]:41000"), netip.AddrPort{}); got != nil {
+		t.Fatal("connFor returned an IPv4 socket for an IPv6 target")
+	}
+}
+
+func mustListen(t *testing.T, addr string) *net.UDPConn {
+	t.Helper()
+	ua, err := net.ResolveUDPAddr("udp", addr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := net.ListenUDP("udp", ua)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}

server/internal/dataplane/df_linux.go

@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+//go:build linux
+
+package dataplane
+
+import (
+	"net"
+	"syscall"
+)
+
+// PMTUD socket-option values. Go's syscall package exports IP_MTU_DISCOVER and
+// IPV6_MTU_DISCOVER but not the IP_PMTUDISC_* values, so they are spelled out
+// here (include/linux/in.h, in6.h — stable ABI, same reasoning as the client's
+// OsAbi.kt).
+const (
+	pmtudiscWant = 0 // per-route default: fragment locally when needed
+	pmtudiscDo   = 2 // always set DF: oversized sends fail with EMSGSIZE, never fragment
+)
+
+// withDF runs fn with the Don't-Fragment bit forced on for conn, then puts the
+// socket back the way it was found.
+//
+// The socket is shared by every session on that address family, so the caller
+// must hold Server.dfMu: a concurrent big_send must not silently ride along
+// with someone else's DF window (or, worse, clear it mid-flight).
+func withDF(conn *net.UDPConn, fn func() error) error {
+	raw, err := conn.SyscallConn()
+	if err != nil {
+		return err
+	}
+	v4 := conn.LocalAddr().(*net.UDPAddr).IP.To4() != nil
+	level, opt := syscall.IPPROTO_IPV6, syscall.IPV6_MTU_DISCOVER
+	if v4 {
+		level, opt = syscall.IPPROTO_IP, syscall.IP_MTU_DISCOVER
+	}
+
+	var setErr error
+	prev := pmtudiscWant
+	if err := raw.Control(func(fd uintptr) {
+		if p, e := syscall.GetsockoptInt(int(fd), level, opt); e == nil {
+			prev = p
+		}
+		setErr = syscall.SetsockoptInt(int(fd), level, opt, pmtudiscDo)
+	}); err != nil {
+		return err
+	}
+	if setErr != nil {
+		return setErr
+	}
+	defer func() {
+		_ = raw.Control(func(fd uintptr) {
+			_ = syscall.SetsockoptInt(int(fd), level, opt, prev)
+		})
+	}()
+	return fn()
+}
+
+// dfSupported reports whether withDF can actually set the DF bit here.
+const dfSupported = true

server/internal/dataplane/df_other.go

@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+//go:build !linux
+
+package dataplane
+
+import "net"
+
+// Forcing DF per-socket is Linux-specific (IP_MTU_DISCOVER). Off Linux the
+// send still happens — just without the guarantee that nothing fragmented it,
+// so the caller must report the result as fragment-delivery evidence rather
+// than a path-MTU measurement. See dfSupported.
+func withDF(conn *net.UDPConn, fn func() error) error { return fn() }
+
+const dfSupported = false

server/internal/dataplane/granted.go

@@ -26,7 +26,7 @@ func (s *Server) DownTrain(sess *session.Session, g *session.Grant, count, sizeB
 	if !target.IsValid() {
 		return 0, fmt.Errorf("no observed data-plane source")
 	}
-	conn := s.connFor(target)
+	conn := s.connFor(target, sess.DataLocal())
 	if conn == nil {
 		return 0, fmt.Errorf("no data-plane socket matches target family")
 	}
@@ -52,19 +52,36 @@ func (s *Server) DownTrain(sess *session.Session, g *session.Grant, count, sizeB
 	return sent, nil
 }
 
-// BigSend transmits one datagram per requested size, largest-first metadata intact, so the client
+// BigSendResult records what happened to one requested size. `Sent` false with an EMSGSIZE-ish
-// can see which sizes survive the *downstream* path — the mtu.pmtud_down / mtu.blackhole evidence.
+// Err means *we* could not put it on the wire (the datagram exceeds our own egress MTU with DF
-// The client cannot produce this itself: only the far end can emit a large packet toward it.
+// set) — the client must not read its absence as a path limit, so this is reported, not hidden.
-func (s *Server) BigSend(sess *session.Session, g *session.Grant, sizes []int) ([]int, error) {
+type BigSendResult struct {
+	SizeBytes int    `json:"size_bytes"`
+	Seq       int    `json:"seq"`
+	Sent      bool   `json:"sent"`
+	Err       string `json:"err,omitempty"`
+}
+
+// BigSend transmits one datagram per requested size so the client can see which sizes survive the
+// *downstream* path — the mtu.pmtud_down / mtu.frag_delivery evidence. The client cannot produce
+// this itself: only the far end can emit a large packet toward it.
+//
+// With df set, the DF bit is forced for the whole burst, so nothing fragments and the largest
+// size that arrives IS the downstream path MTU. Without it, the kernel fragments freely and the
+// result only says whether fragments get through — a different (also useful) measurement, and
+// the reason the two are separate test types.
+func (s *Server) BigSend(sess *session.Session, g *session.Grant, sizes []int, df bool) ([]BigSendResult, error) {
 	target := sess.DataSource()
 	if !target.IsValid() {
 		return nil, fmt.Errorf("no observed data-plane source")
 	}
-	conn := s.connFor(target)
+	conn := s.connFor(target, sess.DataLocal())
 	if conn == nil {
 		return nil, fmt.Errorf("no data-plane socket matches target family")
 	}
-	attempted := make([]int, 0, len(sizes))
+
+	results := make([]BigSendResult, 0, len(sizes))
+	burst := func() error {
 		for i, size := range sizes {
 			if size < HeaderSize+8 {
 				size = HeaderSize + 8
@@ -79,9 +96,29 @@ func (s *Server) BigSend(sess *session.Session, g *session.Grant, sizes []int) (
 			// Echo the intended size into the payload so a truncated/fragmented arrival is
 			// still attributable to the size we meant to send.
 			binary.BigEndian.PutUint32(payload[0:4], uint32(size))
-		s.send(conn, target, sess, TypeBigSend, uint32(i), payload)
+			err := s.sendErr(conn, target, sess, TypeBigSend, uint32(i), payload)
-		attempted = append(attempted, size)
+			results = append(results, BigSendResult{
+				SizeBytes: size, Seq: i, Sent: err == nil, Err: errString(err),
+			})
 			time.Sleep(20 * time.Millisecond) // keep bursts from being read as congestion loss
 		}
-	return attempted, nil
+		return nil
+	}
+
+	if df && dfSupported {
+		s.dfMu.Lock()
+		defer s.dfMu.Unlock()
+		if err := withDF(conn, burst); err != nil {
+			return results, err
+		}
+		return results, nil
+	}
+	return results, burst()
+}
+
+func errString(err error) string {
+	if err == nil {
+		return ""
+	}
+	return err.Error()
 }

server/internal/dataplane/udp.go

@@ -45,6 +45,10 @@ type Server struct {
 
 	mu    sync.Mutex
 	conns []*net.UDPConn
+
+	// dfMu serialises DF windows: the listening socket is shared by every session on that
+	// family, so two concurrent big_sends must not overlap their DF on/off transitions.
+	dfMu sync.Mutex
 }
 
 // Serve runs the read loop for one socket; call once per bound address.
@@ -69,9 +73,23 @@ func (s *Server) Serve(conn *net.UDPConn) error {
 }
 
 // connFor picks a retained socket whose family matches the target.
-func (s *Server) connFor(target netip.AddrPort) *net.UDPConn {
+// connFor picks the socket to send to target from.
+//
+// When the session recorded which local address it has been talking to (local), that socket wins
+// outright. Falling back to "any socket of the right family" is only correct for a single-homed
+// server: on a multi-homed one it sends from a sibling address the client's NAT has no mapping
+// for, the packets are dropped in transit, and the client reports downstream loss that does not
+// exist. That bug is invisible in a lab with one address, which is exactly why this is explicit.
+func (s *Server) connFor(target, local netip.AddrPort) *net.UDPConn {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if local.IsValid() {
+		for _, c := range s.conns {
+			if c.LocalAddr().(*net.UDPAddr).AddrPort() == local {
+				return c
+			}
+		}
+	}
 	want4 := target.Addr().Unmap().Is4()
 	for _, c := range s.conns {
 		la := c.LocalAddr().(*net.UDPAddr).AddrPort()
@@ -90,7 +108,7 @@ func (s *Server) SendDelayedEcho(sess *session.Session, actionID string) error {
 	if !target.IsValid() {
 		return fmt.Errorf("session has no observed data-plane source yet")
 	}
-	conn := s.connFor(target)
+	conn := s.connFor(target, sess.DataLocal())
 	if conn == nil {
 		return fmt.Errorf("no data-plane socket matches target family")
 	}
@@ -127,6 +145,9 @@ func (s *Server) handle(conn *net.UDPConn, raddr netip.AddrPort, pkt []byte, tRx
 		return
 	}
 	sess.NoteDataSource(raddr)
+	if la, ok := conn.LocalAddr().(*net.UDPAddr); ok {
+		sess.NoteDataLocal(la.AddrPort())
+	}
 	sess.RecordUDP(session.UDPObservation{
 		Seq: seq, TRxNs: tRxNs, TTxNs: time.Since(s.start).Nanoseconds(),
 		Src: raddr.String(), Size: len(pkt), Type: typ,
@@ -203,6 +224,13 @@ func (s *Server) timesyncResp(conn *net.UDPConn, raddr netip.AddrPort, sess *ses
 }
 
 func (s *Server) send(conn *net.UDPConn, raddr netip.AddrPort, sess *session.Session, typ byte, seq uint32, payload []byte) {
+	_ = s.sendErr(conn, raddr, sess, typ, seq, payload)
+}
+
+// sendErr is send with the write error surfaced. Only the DF-mode big_send cares: there an
+// EMSGSIZE means our own egress MTU refused the datagram, which is a different fact from the
+// client not receiving it.
+func (s *Server) sendErr(conn *net.UDPConn, raddr netip.AddrPort, sess *session.Session, typ byte, seq uint32, payload []byte) error {
 	pkt := make([]byte, HeaderSize+len(payload))
 	copy(pkt[0:4], Magic)
 	pkt[4] = typ
@@ -218,7 +246,8 @@ func (s *Server) send(conn *net.UDPConn, raddr netip.AddrPort, sess *session.Ses
 	mac.Write(pkt[0:28])
 	mac.Write(payload)
 	copy(pkt[28:32], mac.Sum(nil)[:4])
-	_, _ = conn.WriteToUDPAddrPort(pkt, raddr)
+	_, err := conn.WriteToUDPAddrPort(pkt, raddr)
+	return err
 }
 
 func hexByte(hi, lo byte) byte {

server/internal/runs/runs.go

@@ -0,0 +1,300 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package runs stores uploaded measurement documents.
+//
+// The premise (and the reason uploads exist at all) is that an engineer runs their own server:
+// uploading a run there is how history, diffing and "it was fine last Tuesday" work. That makes
+// the storage deliberately dumb — one JSON file per run, on disk, greppable, deletable with rm —
+// and puts the interesting policy in two places instead:
+//
+//   - who may upload (Policy.Mode), because a public server is a different proposition from a
+//     private one; and
+//   - how much identifying detail the client must strip first (Policy.MinAnonymization), because
+//     someone measuring against a stranger's server should not be shipping their SSIDs there.
+//
+// Retention is enforced on every upload, not by a sweeper, so a server left alone does not grow.
+package runs
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Mode says who may upload.
+type Mode string
+
+const (
+	// ModeOff refuses every upload. The endpoint still answers, with 403 and a reason, so the
+	// app can say "this server does not accept uploads" instead of showing a network error.
+	ModeOff Mode = "off"
+	// ModeAnonymous accepts uploads from any enrolled device. The default: enrollment already
+	// required an admin-minted token, so "anyone enrolled" is not "anyone".
+	ModeAnonymous Mode = "anonymous"
+	// ModeAccount accepts uploads only from a device tied to a signed-in account. The account
+	// system (OIDC) is not built yet, so today this refuses everything with a distinct reason —
+	// it exists so operators can pick the strict setting now and have it mean the right thing
+	// when accounts land, rather than silently loosening on upgrade.
+	ModeAccount Mode = "account"
+)
+
+// Anonymization levels, mirroring the client's redaction levels (measurement-schema.md §8).
+// Ordered: full < balanced < strict.
+const (
+	AnonFull     = "full"     // nothing removed — for your own server
+	AnonBalanced = "balanced" // network names and device identity pseudonymized, neighbours dropped
+	AnonStrict   = "strict"   // metrics and findings only
+)
+
+func anonRank(level string) int {
+	switch level {
+	case AnonStrict:
+		return 2
+	case AnonBalanced:
+		return 1
+	case AnonFull:
+		return 0
+	}
+	return -1 // unknown
+}
+
+// Policy is the operator's upload configuration.
+type Policy struct {
+	Mode             Mode   `json:"mode"`
+	MaxBytes         int64  `json:"max_bytes"`
+	RetentionDays    int    `json:"retention_days"`
+	MaxRunsPerDevice int    `json:"max_runs_per_device"`
+	MinAnonymization string `json:"min_anonymization"`
+}
+
+func DefaultPolicy() Policy {
+	return Policy{
+		Mode:             ModeAnonymous,
+		MaxBytes:         4 << 20,
+		RetentionDays:    90,
+		MaxRunsPerDevice: 200,
+		MinAnonymization: AnonFull,
+	}
+}
+
+var (
+	ErrDisabled      = errors.New("uploads are disabled on this server")
+	ErrNeedAccount   = errors.New("this server only accepts uploads from signed-in accounts")
+	ErrTooLarge      = errors.New("run exceeds the server's upload size limit")
+	ErrNotAnonEnough = errors.New("run is less anonymized than this server requires")
+	ErrMalformed     = errors.New("run is not a measurement document")
+)
+
+// Meta is the index entry for one stored run — enough to list history without opening the files.
+type Meta struct {
+	ID            string    `json:"id"`
+	DeviceID      string    `json:"device_id"`
+	UploadedAt    time.Time `json:"uploaded_at"`
+	StartedAt     string    `json:"started_at,omitempty"`
+	Anonymization string    `json:"anonymization"`
+	SizeBytes     int64     `json:"size_bytes"`
+	Verdict       string    `json:"verdict,omitempty"`
+	FindingCount  int       `json:"finding_count"`
+}
+
+type Store struct {
+	mu     sync.Mutex
+	dir    string
+	policy Policy
+}
+
+func Open(stateDir string, p Policy) (*Store, error) {
+	dir := filepath.Join(stateDir, "runs")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return nil, err
+	}
+	return &Store{dir: dir, policy: p}, nil
+}
+
+func (s *Store) Policy() Policy { return s.policy }
+
+// Accepts reports whether an upload would be allowed at all, so callers can answer the
+// capability question without a body.
+func (s *Store) Accepts() error {
+	switch s.policy.Mode {
+	case ModeOff:
+		return ErrDisabled
+	case ModeAccount:
+		return ErrNeedAccount
+	}
+	return nil
+}
+
+// Put validates and stores one uploaded document. body is the raw JSON as received: it is stored
+// byte-for-byte so what the device signed off on is what sits on disk.
+func (s *Store) Put(deviceID string, body []byte) (Meta, error) {
+	if err := s.Accepts(); err != nil {
+		return Meta{}, err
+	}
+	if s.policy.MaxBytes > 0 && int64(len(body)) > s.policy.MaxBytes {
+		return Meta{}, ErrTooLarge
+	}
+
+	// Peek at the parts we index on. Unknown fields are ignored: the server must not become a
+	// second schema authority that rejects documents a newer client legitimately produces.
+	var doc struct {
+		Run struct {
+			ID        string `json:"id"`
+			StartedAt string `json:"started_at"`
+			Privacy   struct {
+				Anonymization string `json:"anonymization"`
+			} `json:"privacy"`
+		} `json:"run"`
+		Findings []json.RawMessage `json:"findings"`
+		Summary  struct {
+			Verdict string `json:"verdict"`
+		} `json:"summary"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil || doc.Run.ID == "" {
+		return Meta{}, ErrMalformed
+	}
+
+	level := doc.Run.Privacy.Anonymization
+	if level == "" {
+		level = AnonFull // no declaration means nothing was stripped
+	}
+	if anonRank(level) < anonRank(s.policy.MinAnonymization) {
+		return Meta{}, fmt.Errorf("%w: got %q, need at least %q",
+			ErrNotAnonEnough, level, s.policy.MinAnonymization)
+	}
+
+	id := sanitizeID(doc.Run.ID)
+	if id == "" {
+		return Meta{}, ErrMalformed
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	devDir := filepath.Join(s.dir, sanitizeID(deviceID))
+	if err := os.MkdirAll(devDir, 0o700); err != nil {
+		return Meta{}, err
+	}
+	if err := os.WriteFile(filepath.Join(devDir, id+".json"), body, 0o600); err != nil {
+		return Meta{}, err
+	}
+
+	meta := Meta{
+		ID: id, DeviceID: deviceID, UploadedAt: time.Now().UTC(),
+		StartedAt: doc.Run.StartedAt, Anonymization: level,
+		SizeBytes: int64(len(body)), Verdict: doc.Summary.Verdict,
+		FindingCount: len(doc.Findings),
+	}
+	if err := os.WriteFile(filepath.Join(devDir, id+".meta.json"), mustJSON(meta), 0o600); err != nil {
+		return Meta{}, err
+	}
+	s.enforceRetentionLocked(devDir)
+	return meta, nil
+}
+
+// List returns one device's runs, newest first.
+func (s *Store) List(deviceID string) []Meta {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.listLocked(filepath.Join(s.dir, sanitizeID(deviceID)))
+}
+
+// Get returns the stored document bytes for one run.
+func (s *Store) Get(deviceID, runID string) ([]byte, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return os.ReadFile(filepath.Join(s.dir, sanitizeID(deviceID), sanitizeID(runID)+".json"))
+}
+
+// Delete removes one run. Missing is not an error: delete is idempotent so a client retrying
+// after a dropped response does not see a spurious failure.
+func (s *Store) Delete(deviceID, runID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	dev, run := sanitizeID(deviceID), sanitizeID(runID)
+	for _, suffix := range []string{".json", ".meta.json"} {
+		if err := os.Remove(filepath.Join(s.dir, dev, run+suffix)); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *Store) listLocked(devDir string) []Meta {
+	entries, err := os.ReadDir(devDir)
+	if err != nil {
+		return nil
+	}
+	out := make([]Meta, 0, len(entries))
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".meta.json") {
+			continue
+		}
+		b, err := os.ReadFile(filepath.Join(devDir, e.Name()))
+		if err != nil {
+			continue
+		}
+		var m Meta
+		if json.Unmarshal(b, &m) == nil {
+			out = append(out, m)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].UploadedAt.After(out[j].UploadedAt) })
+	return out
+}
+
+// enforceRetentionLocked drops runs past the age limit, then past the count limit. Age first, so
+// a burst of uploads cannot push out runs that are still inside the retention window.
+func (s *Store) enforceRetentionLocked(devDir string) {
+	metas := s.listLocked(devDir)
+	drop := func(m Meta) {
+		_ = os.Remove(filepath.Join(devDir, m.ID+".json"))
+		_ = os.Remove(filepath.Join(devDir, m.ID+".meta.json"))
+	}
+	kept := metas[:0]
+	if s.policy.RetentionDays > 0 {
+		cutoff := time.Now().Add(-time.Duration(s.policy.RetentionDays) * 24 * time.Hour)
+		for _, m := range metas {
+			if m.UploadedAt.Before(cutoff) {
+				drop(m)
+				continue
+			}
+			kept = append(kept, m)
+		}
+	} else {
+		kept = metas
+	}
+	if s.policy.MaxRunsPerDevice > 0 && len(kept) > s.policy.MaxRunsPerDevice {
+		for _, m := range kept[s.policy.MaxRunsPerDevice:] { // listLocked is newest-first
+			drop(m)
+		}
+	}
+}
+
+// sanitizeID keeps ids to characters that cannot escape the directory or collide with the
+// .meta.json suffix convention. Ids are uuids and device ids in practice; anything else is
+// truncated to nothing and rejected upstream.
+func sanitizeID(s string) string {
+	var b strings.Builder
+	for _, r := range s {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '-', r == '_':
+			b.WriteRune(r)
+		}
+		if b.Len() >= 64 {
+			break
+		}
+	}
+	return b.String()
+}
+
+func mustJSON(v any) []byte {
+	b, _ := json.Marshal(v)
+	return b
+}

server/internal/runs/runs_test.go

@@ -0,0 +1,197 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package runs
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func doc(id, anon string) []byte {
+	return []byte(fmt.Sprintf(
+		`{"run":{"id":%q,"started_at":"2026-08-01T10:00:00Z","privacy":{"anonymization":%q}},`+
+			`"findings":[{"id":"f1"},{"id":"f2"}],"summary":{"verdict":"warn"}}`, id, anon))
+}
+
+func open(t *testing.T, p Policy) (*Store, string) {
+	t.Helper()
+	dir := t.TempDir()
+	s, err := Open(dir, p)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	return s, dir
+}
+
+func TestModeOffRefusesEverything(t *testing.T) {
+	p := DefaultPolicy()
+	p.Mode = ModeOff
+	s, _ := open(t, p)
+	if _, err := s.Put("dev1", doc("run-1", AnonFull)); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("want ErrDisabled, got %v", err)
+	}
+}
+
+// ModeAccount must refuse today rather than fall back to anonymous: an operator who selects the
+// strict setting before accounts exist must not be silently running the permissive one.
+func TestModeAccountRefusesUntilAccountsExist(t *testing.T) {
+	p := DefaultPolicy()
+	p.Mode = ModeAccount
+	s, _ := open(t, p)
+	if _, err := s.Put("dev1", doc("run-1", AnonFull)); !errors.Is(err, ErrNeedAccount) {
+		t.Fatalf("want ErrNeedAccount, got %v", err)
+	}
+}
+
+func TestMinAnonymizationEnforced(t *testing.T) {
+	p := DefaultPolicy()
+	p.MinAnonymization = AnonBalanced
+	s, _ := open(t, p)
+
+	if _, err := s.Put("dev1", doc("run-full", AnonFull)); !errors.Is(err, ErrNotAnonEnough) {
+		t.Fatalf("full should be refused when balanced is required, got %v", err)
+	}
+	// An undeclared level means nothing was stripped, so it must be treated as "full".
+	if _, err := s.Put("dev1", []byte(`{"run":{"id":"run-bare"},"summary":{}}`)); !errors.Is(err, ErrNotAnonEnough) {
+		t.Fatalf("undeclared level should be treated as full, got %v", err)
+	}
+	for _, lvl := range []string{AnonBalanced, AnonStrict} {
+		if _, err := s.Put("dev1", doc("run-"+lvl, lvl)); err != nil {
+			t.Fatalf("%s should be accepted: %v", lvl, err)
+		}
+	}
+}
+
+func TestSizeLimit(t *testing.T) {
+	p := DefaultPolicy()
+	p.MaxBytes = 200
+	s, _ := open(t, p)
+	big := append(doc("run-1", AnonFull), make([]byte, 400)...)
+	if _, err := s.Put("dev1", big); !errors.Is(err, ErrTooLarge) {
+		t.Fatalf("want ErrTooLarge, got %v", err)
+	}
+}
+
+func TestRetentionByCountKeepsNewest(t *testing.T) {
+	p := DefaultPolicy()
+	p.MaxRunsPerDevice = 3
+	s, _ := open(t, p)
+	for i := 0; i < 6; i++ {
+		if _, err := s.Put("dev1", doc(fmt.Sprintf("run-%d", i), AnonFull)); err != nil {
+			t.Fatalf("put %d: %v", i, err)
+		}
+		time.Sleep(2 * time.Millisecond) // distinct UploadedAt so "newest" is well defined
+	}
+	got := s.List("dev1")
+	if len(got) != 3 {
+		t.Fatalf("kept %d runs, want 3", len(got))
+	}
+	for i, want := range []string{"run-5", "run-4", "run-3"} {
+		if got[i].ID != want {
+			t.Fatalf("kept[%d] = %s, want %s (newest first)", i, got[i].ID, want)
+		}
+	}
+	// The documents themselves must be gone too, not just their index entries.
+	if _, err := s.Get("dev1", "run-0"); err == nil {
+		t.Fatal("purged run is still readable")
+	}
+}
+
+func TestRetentionByAge(t *testing.T) {
+	p := DefaultPolicy()
+	p.RetentionDays = 7
+	p.MaxRunsPerDevice = 0
+	s, dir := open(t, p)
+	if _, err := s.Put("dev1", doc("run-old", AnonFull)); err != nil {
+		t.Fatal(err)
+	}
+	// Backdate the index entry past the retention window.
+	metaPath := filepath.Join(dir, "runs", "dev1", "run-old.meta.json")
+	b, _ := os.ReadFile(metaPath)
+	var m Meta
+	_ = json.Unmarshal(b, &m)
+	m.UploadedAt = time.Now().Add(-30 * 24 * time.Hour)
+	nb, _ := json.Marshal(m)
+	if err := os.WriteFile(metaPath, nb, 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := s.Put("dev1", doc("run-new", AnonFull)); err != nil {
+		t.Fatal(err)
+	}
+	got := s.List("dev1")
+	if len(got) != 1 || got[0].ID != "run-new" {
+		t.Fatalf("age retention did not drop the old run: %+v", got)
+	}
+}
+
+// Run and device ids reach the filesystem, so a hostile one must not be able to climb out of the
+// store directory or overwrite another device's data.
+func TestIDsCannotEscapeTheStoreDirectory(t *testing.T) {
+	s, dir := open(t, DefaultPolicy())
+	if _, err := s.Put("../../etc", doc("../../../passwd", AnonFull)); err != nil {
+		t.Fatalf("put: %v", err)
+	}
+	var found []string
+	_ = filepath.Walk(dir, func(p string, info os.FileInfo, err error) error {
+		if err == nil && !info.IsDir() {
+			rel, _ := filepath.Rel(dir, p)
+			found = append(found, filepath.ToSlash(rel))
+		}
+		return nil
+	})
+	for _, f := range found {
+		if strings.Contains(f, "..") {
+			t.Fatalf("path escaped the store: %s", f)
+		}
+	}
+	if len(found) == 0 {
+		t.Fatal("nothing written at all")
+	}
+}
+
+func TestListIsPerDevice(t *testing.T) {
+	s, _ := open(t, DefaultPolicy())
+	if _, err := s.Put("devA", doc("run-a", AnonFull)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Put("devB", doc("run-b", AnonFull)); err != nil {
+		t.Fatal(err)
+	}
+	if got := s.List("devA"); len(got) != 1 || got[0].ID != "run-a" {
+		t.Fatalf("devA sees %+v", got)
+	}
+	if _, err := s.Get("devA", "run-b"); err == nil {
+		t.Fatal("devA could read devB's run")
+	}
+}
+
+func TestMetaSummarisesTheDocument(t *testing.T) {
+	s, _ := open(t, DefaultPolicy())
+	m, err := s.Put("dev1", doc("run-1", AnonBalanced))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.FindingCount != 2 || m.Verdict != "warn" || m.Anonymization != AnonBalanced {
+		t.Fatalf("meta not extracted: %+v", m)
+	}
+	if m.StartedAt != "2026-08-01T10:00:00Z" {
+		t.Fatalf("started_at = %q", m.StartedAt)
+	}
+}
+
+func TestMalformedRejected(t *testing.T) {
+	s, _ := open(t, DefaultPolicy())
+	for _, body := range [][]byte{[]byte("not json"), []byte(`{"run":{}}`), []byte(`{}`)} {
+		if _, err := s.Put("dev1", body); !errors.Is(err, ErrMalformed) {
+			t.Fatalf("body %q: want ErrMalformed, got %v", body, err)
+		}
+	}
+}

server/internal/session/session.go

@@ -27,6 +27,7 @@ type Session struct {
 	// Last data-plane source seen with a valid HMAC (NAT rebinding evidence).
 	mu         sync.Mutex
 	dataSource netip.AddrPort
+	dataLocal  netip.AddrPort
 	// Replay window (spec §3.1: 1024-wide seq window). Highest seq seen plus
 	// a bitmask of the 1024 preceding.
 	maxSeq uint32
@@ -192,6 +193,25 @@ func (s *Session) CheckSeq(seq uint32) bool {
 	return true
 }
 
+// DataLocal returns the server-side address that received this session's data-plane traffic.
+//
+// This matters more than it looks: a server bound to several addresses must send granted traffic
+// back from the one the client has been talking to. Any stateful firewall or NAT in between has
+// a mapping keyed on that exact pair, and a reply from a sibling address is dropped — which the
+// client would then measure as downstream loss. See connFor.
+func (s *Session) DataLocal() netip.AddrPort {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.dataLocal
+}
+
+// NoteDataLocal records which of our own bound addresses saw this session's traffic.
+func (s *Session) NoteDataLocal(ap netip.AddrPort) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.dataLocal = ap
+}
+
 // NoteDataSource records the latest verified data-plane source.
 func (s *Session) NoteDataSource(ap netip.AddrPort) {
 	s.mu.Lock()