@coventia/softphone 0.5.0 → 0.5.1

package/dist/index.cjs

@@ -351,6 +351,13 @@ function coventiaSources(config) {
             callbacks.onClaimResult?.(
               msg.ok === true ? { ok: true } : { ok: false, reason: typeof msg.reason === "string" ? msg.reason : "unavailable" }
             );
+          } else if (msg.type === "offer" && typeof msg.callId === "string" && msg.callId) {
+            const from = typeof msg.from === "string" && msg.from ? msg.from : null;
+            if (msg.state === "start") {
+              callbacks.onOffer?.({ state: "start", callId: msg.callId, from });
+            } else if (msg.state === "end") {
+              callbacks.onOffer?.(from ? { state: "end", callId: msg.callId, from } : { state: "end", callId: msg.callId });
+            }
           }
         };
         ws.onclose = () => {
@@ -976,21 +983,53 @@ var init_session = __esm({
 });
 
 // src/transports/sip/ua.ts
+function inviteTransactionOf(session) {
+  const tx = session._request?.transaction;
+  return tx && typeof tx.state === "number" && typeof tx.on === "function" ? tx : null;
+}
+function awaitsAnswer(tx) {
+  return tx.state === ICT_CALLING || tx.state === ICT_PROCEEDING;
+}
+function deferredCancelOf(session) {
+  const flag = session._is_canceled;
+  return typeof flag === "boolean" ? flag : null;
+}
+function sameNumber(a, b) {
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const [shorter, longer] = a.length < b.length ? [a, b] : [b, a];
+  return shorter.length >= SUFFIX_MATCH_MIN_DIGITS && longer.endsWith(shorter);
+}
+function isRefusal(e) {
+  const status = e?.response?.status_code;
+  if (typeof status === "number") return status === 401 || status === 403;
+  return e?.cause === "Authentication Error" || e?.cause === "Rejected";
+}
+function debug(message) {
+  console.debug(`[softphone] ${message}`);
+}
 function domainOf(credentials) {
   const at = credentials.uri.lastIndexOf("@");
   return at === -1 ? "" : credentials.uri.slice(at + 1);
 }
-var DEFAULT_ICE_CAP_MS, REGISTER_EXPIRES, SIGNAL_REFRESH_DEBOUNCE_MS, ERROR_DEBOUNCE_MS, CALL_END_CODES, callSeq, nextCallId, SipCallEngine;
+var DEFAULT_ICE_CAP_MS, REGISTER_EXPIRES, ERROR_DEBOUNCE_MS, OFFER_FORGOTTEN_MS, DECLINE_GUARD_CEILING_MS, OFFER_PUSH_SLACK_MS, INVITE_TRANSACTION_MAX_MS, ICT_PROCEEDING, ICT_CALLING, SUFFIX_MATCH_MIN_DIGITS, CALL_END_CODES, callSeq, nextCallId, SipCallEngine;
 var init_ua = __esm({
   "src/transports/sip/ua.ts"() {
     init_session();
     init_media();
     init_ice();
     init_errors();
+    init_sources();
     DEFAULT_ICE_CAP_MS = 3e3;
     REGISTER_EXPIRES = 580;
-    SIGNAL_REFRESH_DEBOUNCE_MS = 3e4;
     ERROR_DEBOUNCE_MS = 3e4;
+    OFFER_FORGOTTEN_MS = 12e4;
+    DECLINE_GUARD_CEILING_MS = 12e4;
+    OFFER_PUSH_SLACK_MS = 1e4;
+    INVITE_TRANSACTION_MAX_MS = 32e3;
+    ICT_PROCEEDING = 2;
+    ICT_CALLING = 3;
+    SUFFIX_MATCH_MIN_DIGITS = 9;
     CALL_END_CODES = {
       busy: "call/busy",
       "no-answer": "call/no-answer",
@@ -1022,8 +1061,30 @@ var init_ua = __esm({
       #ua = null;
       /** In-flight `#createUA()`. THE concurrency guard — see `#ensureUA`. */
       #uaInFlight = null;
-      /** Calls waiting for the current UA to register (`#callWhenRegistered`), failed by `#teardownUA`. */
+      /**
+       * Bumped by every `#teardownUA`. A UA still being provisioned when its reason to exist went away — the offer
+       * ended, the leak guard gave up — is then not built (`#createUA`): built anyway, it would REGISTER for nobody
+       * and nothing would ever tear it down.
+       */
+      #uaEpoch = 0;
+      /**
+       * Dials waiting for the current UA to register (`#callWhenRegistered`): dialled by its `registered`, failed by
+       * `#teardownUA` — but kept when the UA is only being rebuilt on fresh credentials (`#retryOnFreshCredentials`).
+       */
       #awaitingRegistration = /* @__PURE__ */ new Set();
+      /** `placeCall`s in progress, from before their UA exists: no offer's teardown may pull it from under them. */
+      #dialing = 0;
+      /**
+       * Where the current UA's registration stands: `connecting` (its REGISTER goes out once the WSS is up),
+       * `registering` (a REGISTER is out, unanswered), `registered` (the WSS is up and no REGISTER of ours is out — a
+       * refresh that failed under a live call leaves it here too). What decides how an offer gets a REGISTER sent
+       * after it (`#registerAfterOffer`).
+       */
+      #registration = "connecting";
+      /** An offer arrived while a REGISTER sent BEFORE it was still unanswered: another goes out once it is. */
+      #registerAgain = false;
+      /** A UA has already been rebuilt on fresh credentials since the last registration that worked: not again. */
+      #freshCredentialsTried = false;
       #domain = "";
       #activeCall = null;
       /**
@@ -1042,17 +1103,52 @@ var init_ua = __esm({
       #errorListeners = /* @__PURE__ */ new Set();
       #signalUnsub = null;
       #signalConnectionUnsub = null;
+      /** The offer waiting for its INVITE, if any (§4.3). */
+      #offerWait = null;
+      /**
+       * The latest offer pushed while a call was in progress. It used to be dropped for good — the caller then waited
+       * for the provider to offer it again. Now, when the call ends, it is registered for at once if it is still
+       * within its wait (no `offer-ended` for it, inside the leak guard), so it rings as soon as the line is free.
+       */
+      #pendingOffer = null;
+      /** Armed at the REGISTER's 200 OK while an offer waits (`noInviteAfterRegisterMs`). */
       #noInviteTimer;
-      #rejectGuardUntil = 0;
-      #signalRefreshAfter = 0;
+      /**
+       * What the backend has said about the calls offered to this line (`noteOffer`, §5), by `callId` — ended ones
+       * included, for a while. Only for telling, at a decline, which call was declined and whether it is still alive.
+       */
+      #offers = /* @__PURE__ */ new Map();
+      /** Declined calls whose re-offers are being ignored (§4.4). Pruned as they lapse. */
+      #declined = [];
+      /** CANCELs JsSIP still owes for outbound legs that ended before any ringback (§4.7, `#watchOwedCancel`). */
+      #owedCancels = [];
+      /** UAs let go of while owing one: un-REGISTERed, still connected — with the cap that stops them regardless. */
+      #lingering = /* @__PURE__ */ new Map();
       #errorSentAfter = /* @__PURE__ */ new Map();
       now;
       #resolvedFactory = null;
+      /** The loader in flight, shared: the pre-load at `start()` and a first UA racing it fetch the module once. */
+      #factoryLoad = null;
       async #resolveFactory() {
         if (this.#resolvedFactory) return this.#resolvedFactory;
-        this.#resolvedFactory = typeof this.factory === "function" ? await this.factory() : this.factory;
+        if (typeof this.factory !== "function") return this.#resolvedFactory = this.factory;
+        const loader = this.factory;
+        this.#factoryLoad ??= Promise.resolve().then(() => loader()).finally(() => {
+          this.#factoryLoad = null;
+        });
+        this.#resolvedFactory = await this.#factoryLoad;
         return this.#resolvedFactory;
       }
+      /**
+       * Fetch the SIP stack now, not on the first call. It is loaded lazily (`import('jssip')`, SSR-safe — SPEC §10.2),
+       * and that used to happen on the first UA: between the first push after a page load and its REGISTER, measured
+       * 33–109 ms on localhost and more on a slow network or a throttled tab. Fire-and-forget: a failure here only
+       * leaves the lazy path to try again when a UA is built (incoming-call-reliability.md §4.5).
+       */
+      #preloadFactory() {
+        this.#resolveFactory().catch(() => {
+        });
+      }
       get state() {
         return this.#state;
       }
@@ -1117,15 +1213,18 @@ var init_ua = __esm({
           if (run !== this.#run) return;
           this.#setState("online");
         } else {
+          this.#preloadFactory();
           const signal = this.provider.incomingSignal;
           if (signal) {
             try {
               await signal.connect();
             } catch (cause) {
-              if (run === this.#run) throw cause;
+              if (run !== this.#run) return;
+              signal.disconnect();
+              throw cause;
             }
             if (run !== this.#run) return;
-            this.#signalUnsub = signal.onSignal(() => void this.#onIncomingSignal());
+            this.#signalUnsub = signal.onSignal((event) => this.#onIncomingSignal(event));
             this.#signalConnectionUnsub = signal.onConnectionChange?.(
               (connected) => this.#setState(connected ? "online" : "offline")
             ) ?? null;
@@ -1135,6 +1234,7 @@ var init_ua = __esm({
       }
       async stop() {
         this.#run += 1;
+        this.#pendingOffer = null;
         this.#clearNoInviteTimer();
         this.#signalUnsub?.();
         this.#signalUnsub = null;
@@ -1145,63 +1245,271 @@ var init_ua = __esm({
         this.#setState("stopped");
       }
       async placeCall(destination, _options) {
-        const ua = await this.#ensureUA();
-        const session = await this.#callWhenRegistered(ua, this.#buildTarget(destination));
-        return this.#wrapCall(session);
+        this.#dialing += 1;
+        const run = this.#run;
+        try {
+          await this.#ensureUA();
+          return await this.#callWhenRegistered(this.#buildTarget(destination), run);
+        } finally {
+          this.#dialing -= 1;
+        }
+      }
+      /**
+       * What the backend says about calls offered to this line (incoming-call-reliability.md §5) — kept only to tell,
+       * at a decline, WHICH call was declined, and so how long its re-offers last (§4.4).
+       *
+       * Per `callId`, every message is idempotent, and they come duplicated, with no order at all — not even between
+       * the `start` and the `end` of one call, which reach different backend instances and are relayed through Redis,
+       * and a stored offer replayed after `hello` can race either. So `ended` is sticky: a `start` after its call's
+       * `end` never makes it live again. An `end` also reaches a softphone that is not the line's owner (a `start` only
+       * the owner): stored all the same, whatever state this engine is in. `null`: the channel went away, so no `end`
+       * can be counted on for the calls still live; a guard following one falls back to its window. What is known to
+       * have ended stays known.
+       */
+      noteOffer(offer) {
+        const now = this.now();
+        for (const [callId, known2] of this.#offers) {
+          if (now - known2.at >= OFFER_FORGOTTEN_MS) this.#offers.delete(callId);
+        }
+        if (offer === null) {
+          for (const [callId, known2] of this.#offers) if (known2.endedAt === null) this.#offers.delete(callId);
+          return;
+        }
+        const known = this.#offers.get(offer.callId);
+        this.#offers.delete(offer.callId);
+        const from = toDigits(offer.from ?? "") || (known?.from ?? "");
+        const fallbackMs = this.#declineFallbackMs();
+        if (offer.state === "end") {
+          this.#offers.set(offer.callId, { from, at: now, endedAt: known?.endedAt ?? now });
+          this.#declined = this.#declined.filter((declined) => declined.callId !== offer.callId);
+          if (from) {
+            this.#declined = this.#declined.map(
+              (declined) => declined.adopts && now >= declined.since && sameNumber(declined.caller, from) ? { ...declined, adopts: false } : declined
+            );
+          }
+          return;
+        }
+        const endedAt = known?.endedAt ?? null;
+        this.#offers.set(offer.callId, { from, at: now, endedAt });
+        if (!from) return;
+        if (endedAt !== null) {
+          const isThatCall = (declined) => declined.adopts && now - declined.at < fallbackMs && endedAt >= declined.since && sameNumber(declined.caller, from);
+          this.#declined = this.#declined.filter((declined) => !isThatCall(declined));
+          return;
+        }
+        this.#declined = this.#declined.map(
+          (declined) => declined.adopts && now - declined.at < fallbackMs && now <= declined.since + OFFER_PUSH_SLACK_MS && sameNumber(declined.caller, from) ? { ...declined, callId: offer.callId, adopts: false } : declined
+        );
       }
       // ── incoming (on-demand: push → register → INVITE) ────────────────────────
-      async #onIncomingSignal() {
-        if (this.now() < this.#rejectGuardUntil) return;
-        if (this.#activeCall) return;
+      /**
+       * The push's own word on what it is (incoming-call-reliability.md §4.1, read by the provider): only an `offer`
+       * registers. Before this, every push did — `answered` after each hang-up included — and the UA it left
+       * registered is where the next call's INVITE never came (F2).
+       */
+      #onIncomingSignal(event) {
+        if (event.kind === "offer") void this.#onOffer(event.from);
+        else if (event.kind === "offer-ended") this.#onOfferEnded(event.from);
+        else debug(`push ignored: ${event.detail}`);
+      }
+      /** `pushedAt`: when its push came, for an offer kept while a call was in progress (`#pendingOffer`). */
+      async #onOffer(from, pushedAt = this.now()) {
+        if (this.#isDeclinedCaller(from)) {
+          debug("offer ignored: the caller just declined is being offered again");
+          return;
+        }
+        if (this.#activeCall) {
+          this.#pendingOffer = { from, at: pushedAt };
+          return;
+        }
+        this.#awaitOffer(from, pushedAt);
+        const ua = this.#ua;
+        if (ua) {
+          this.#registerAfterOffer(ua);
+          return;
+        }
         const run = this.#run;
+        const epoch = this.#uaEpoch;
         try {
           await this.#ensureUA();
-          this.#armNoInviteTeardown();
         } catch {
-          if (run === this.#run) this.#teardownUA();
+          if (run === this.#run && epoch === this.#uaEpoch) this.#teardownUA();
         }
       }
-      #armNoInviteTeardown() {
-        const ms = this.provider.quirks?.noInviteTeardownMs;
-        if (!ms) return;
+      /**
+       * That offer is over — answered elsewhere, declined, cancelled, timed out (§4.1). A UA still waiting for its
+       * INVITE goes now instead of when a timer says so; never one carrying a call (`#maybeTeardownUA`). Only when the
+       * push names the same caller as the offer waited for: two offers can overlap, and an end that names nobody (a
+       * withheld number, a push with no `callerid`) could be anyone's — the timers bound that wait instead.
+       */
+      #onOfferEnded(from) {
+        const caller = toDigits(from ?? "");
+        if (!caller) return;
+        if (this.#pendingOffer && sameNumber(caller, toDigits(this.#pendingOffer.from ?? ""))) this.#pendingOffer = null;
+        const wait = this.#offerWait;
+        if (!wait || !sameNumber(caller, wait.from)) return;
+        this.#offerOver();
+      }
+      /**
+       * Starts waiting for this offer's INVITE: a leak guard from its push (§4.3), and no no-INVITE timer yet.
+       * `pushedAt` is now, except for an offer kept through a call (`#pendingOffer`).
+       */
+      #awaitOffer(from, pushedAt) {
+        this.#endOfferWait();
+        const ms = this.provider.quirks?.offerWaitMaxMs;
+        const leak = ms ? setTimeout(
+          () => {
+            if (this.#offerWait !== wait) return;
+            debug("offer abandoned: still no INVITE long after its push");
+            this.#offerOver();
+          },
+          Math.max(0, ms - (this.now() - pushedAt))
+        ) : void 0;
+        const wait = { from: toDigits(from ?? ""), at: pushedAt, leak };
+        this.#offerWait = wait;
+      }
+      /**
+       * The offer kept through the call that just ended, if it is still worth registering for: no `offer-ended` for
+       * it, and still inside the leak guard from its push. Taken: it is registered for once, at most.
+       */
+      #takePendingOffer() {
+        const pending = this.#pendingOffer;
+        this.#pendingOffer = null;
+        if (!pending || !this.#signalUnsub) return null;
+        const maxMs = this.provider.quirks?.offerWaitMaxMs;
+        if (maxMs && this.now() - pending.at >= maxMs) return null;
+        return pending;
+      }
+      /** No INVITE is coming for the offer being waited for: its UA goes, unless something else is on it. */
+      #offerOver() {
+        this.#endOfferWait();
+        this.#maybeTeardownUA();
+      }
+      #endOfferWait() {
+        if (this.#offerWait?.leak) clearTimeout(this.#offerWait.leak);
+        this.#offerWait = null;
+        this.#registerAgain = false;
         this.#clearNoInviteTimer();
-        this.#noInviteTimer = setTimeout(() => this.#maybeTeardownUA(), ms);
       }
       /**
-       * Rebuild the incoming-signal channel with fresh credentials, after a registration failure.
+       * A REGISTER sent AFTER this offer's push, on the UA that is already there (§4.2). Whether one is needed depends
+       * on where that UA's registration stands:
+       *   - `connecting`: its REGISTER goes out when the WSS is up — after this push already.
+       *   - `registering`: the REGISTER in flight went out BEFORE this push; another follows its answer.
+       *   - `registered`: a refresh, now.
+       */
+      #registerAfterOffer(ua) {
+        if (this.#registration === "registering") this.#registerAgain = true;
+        else if (this.#registration === "registered") this.#refreshRegistration(ua);
+      }
+      /**
+       * A REGISTER refresh whose 200 OK is HEARD — the no-INVITE wait counts from it (§4.3).
        *
-       * Registration fails when the credentials behind it have gone stale — and for Zadarma those come
-       * from the same WebRTC key the push socket is holding. Tearing down the UA alone leaves that stale
-       * key in place, so every subsequent attempt fails the same way and the phone is dead until the page
-       * is reloaded. Reconnecting re-fetches the key. The legacy hook did exactly this from both of its
-       * `registrationFailed` handlers.
+       * JsSIP's `register()` sends one, but announces `registered` only for a UA that was not registered
+       * (`Registrator.js`: `if (!this._registered)`), so a refresh's 200 OK would pass in silence.
+       * `registrator().onTransportClosed()` clears that flag and sends nothing — it is what JsSIP runs itself when its
+       * WSS drops, before registering again — so after it the refresh is announced like a first registration. On the
+       * wire nothing changes: the same refresh (same Call-ID, next CSeq) the lab saw answered with the INVITE
+       * (Q5). Only called with no REGISTER of ours in flight (`#registration`), so no answer is left orphaned.
        *
-       * Debounced, which the legacy was not: a provider failing every attempt would otherwise become a
-       * tight loop against our backend and theirs.
+       * A JsSIP without that hook still sends the refresh; its 200 OK just cannot be heard, so the wait starts now.
        */
-      async #refreshSignal() {
-        const signal = this.provider.incomingSignal;
-        if (!signal) return;
-        if (this.now() < this.#signalRefreshAfter) return;
-        this.#signalRefreshAfter = this.now() + SIGNAL_REFRESH_DEBOUNCE_MS;
-        try {
-          signal.disconnect();
-          await signal.connect();
-        } catch {
-        }
+      #refreshRegistration(ua) {
+        const registrator = ua.registrator?.();
+        const heard = typeof registrator?.onTransportClosed === "function";
+        if (heard) registrator.onTransportClosed();
+        this.#registration = heard ? "registering" : "registered";
+        ua.register();
+        if (!heard && this.#offerWait) this.#armNoInviteTimer();
+      }
+      /**
+       * Armed at the REGISTER's 200 OK, never at `ua.start()`: on a slow network the WSS alone outlasted the old 5 s,
+       * and the UA was gone before it ever registered (F3). The INVITE follows the 200 OK by ~0.1 s (§2).
+       */
+      #armNoInviteTimer() {
+        this.#clearNoInviteTimer();
+        const ms = this.provider.quirks?.noInviteAfterRegisterMs;
+        if (!ms) return;
+        this.#noInviteTimer = setTimeout(() => {
+          this.#noInviteTimer = void 0;
+          this.#offerOver();
+        }, ms);
       }
       #clearNoInviteTimer() {
         if (this.#noInviteTimer) clearTimeout(this.#noInviteTimer);
         this.#noInviteTimer = void 0;
       }
+      // ── the decline guard (SPEC §3.4, incoming-call-reliability.md §4.4) ───────
+      /**
+       * Whether an offer — or an INVITE — from this caller is a re-offer of a call just declined. The provider re-offers a
+       * declined call until its ring time ends, and nothing in a re-offer tells it from a new call. The guard used to
+       * swallow EVERY offer and INVITE for 35 s, whoever called: a new call in that window was lost (CWA-81, F1).
+       *
+       * Now it holds only for the declined caller, and only while that call lives: until the backend's `end` for it
+       * when it announced the call (`noteOffer`) — at most `DECLINE_GUARD_CEILING_MS` — else for the provider's
+       * fallback window after the decline. Anyone else always rings; so does a caller this cannot name.
+       */
+      #isDeclinedCaller(number) {
+        const fallbackMs = this.#declineFallbackMs();
+        if (!fallbackMs || this.#declined.length === 0) return false;
+        const now = this.now();
+        this.#declined = this.#declined.filter((declined) => {
+          const offer = declined.callId === null ? void 0 : this.#offers.get(declined.callId);
+          if (offer && offer.endedAt === null) return now - declined.at < DECLINE_GUARD_CEILING_MS;
+          return now - declined.at < fallbackMs;
+        });
+        const caller = toDigits(number ?? "");
+        return this.#declined.some((declined) => sameNumber(declined.caller, caller));
+      }
+      /** The decline guard's fallback window — and whether there is a guard at all: only a provider that re-offers. */
+      #declineFallbackMs() {
+        return this.provider.quirks?.declinedCallerGuardMs ?? 0;
+      }
+      /**
+       * The user declined `call`. Remembers the caller as its INVITE named them, and which offer the backend says that
+       * is (§4.4). Only what the backend said about THIS call counts: a call from the same caller that ended before
+       * this one was pushed (`since`) is another call — taking it for this one lost the callback after a second
+       * decline of the same caller.
+       *   - a live offer from that caller, announced around this call's push or after: the guard follows it until
+       *     its `end`;
+       *   - an offer from that caller that ENDED since this call's push (the first leg of a transfer, a ring-group
+       *     call someone else answered): the fallback window — whatever that caller sends next is not that call, so
+       *     no later `start` is taken for it;
+       *   - neither (its `start` lands after the decline): the fallback window, and a `start` from that caller that
+       *     comes around this call's push is taken as this call's (`noteOffer`).
+       *
+       * An INVITE that names nobody (a withheld number) guards nobody. It used to borrow the caller of the latest push,
+       * which with two offers overlapping is someone else's — and that someone's calls were then ignored.
+       */
+      #onDecline(call, since) {
+        if (!this.#declineFallbackMs() || call.direction !== "inbound") return;
+        const caller = toDigits(call.remoteNumber);
+        if (!caller) return;
+        const now = this.now();
+        let latest = null;
+        for (const [callId, offer] of this.#offers) {
+          if (!sameNumber(offer.from, caller) || now - offer.at >= OFFER_FORGOTTEN_MS) continue;
+          if (offer.endedAt === null && offer.at >= since - OFFER_PUSH_SLACK_MS) latest = { callId, ended: false };
+          else if (offer.endedAt !== null && offer.endedAt >= since) latest = { callId, ended: true };
+        }
+        this.#declined.push(
+          latest && !latest.ended ? { caller, callId: latest.callId, adopts: false, at: now, since } : { caller, callId: null, adopts: latest === null, at: now, since }
+        );
+      }
       #onNewSession(session, originator) {
         if (originator !== "remote") return;
-        this.#clearNoInviteTimer();
-        if (this.#activeCall || this.now() < this.#rejectGuardUntil) {
+        if (this.#activeCall) {
           session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
           return;
         }
-        const call = this.#wrapCall(session);
+        if (this.#isDeclinedCaller(remoteNumberOf(session))) {
+          debug("INVITE declined: the caller just declined is being offered again");
+          session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
+          return;
+        }
+        const since = this.#offerWait?.at ?? this.now();
+        this.#endOfferWait();
+        const call = this.#wrapCall(session, since);
         for (const listener of [...this.#incomingListeners]) listener(call);
       }
       // ── UA lifecycle ───────────────────────────────────────────────────────────
@@ -1214,9 +1522,9 @@ var init_ua = __esm({
        * torn down. The visible symptom is two `get_webphone_data.php` calls at startup and a phone that
        * never registers.
        *
-       * Concurrency is the normal case here, not an edge: the push socket can signal twice in a
-       * heartbeat (SPEC §3.3 — a push is not an INVITE; it fires for transfers, retries and hangups),
-       * and `placeCall` can land on top of one. So the in-flight promise IS the guard.
+       * Concurrency is the normal case here, not an edge: the push socket can offer twice in a heartbeat
+       * (a push seen on both sockets of a rebuild, two calls at once), and `placeCall` can land on top of
+       * one. So the in-flight promise IS the guard.
        */
       async #ensureUA() {
         if (this.#ua) return this.#ua;
@@ -1230,6 +1538,7 @@ var init_ua = __esm({
       }
       async #createUA() {
         const run = this.#run;
+        const epoch = this.#uaEpoch;
         const factory = await this.#resolveFactory();
         let credentials;
         try {
@@ -1240,9 +1549,11 @@ var init_ua = __esm({
           throw cause;
         }
         if (run !== this.#run) throw createError("engine/not-started");
+        if (epoch !== this.#uaEpoch) throw createError("call/failed", "the UA was let go of before it was built");
         this.#domain = domainOf(credentials);
         const config = this.#uaConfig(credentials, factory);
         const ua = factory.createUA(config);
+        let reached = false;
         ua.on("newRTCSession", ({ session, originator }) => {
           if (ua !== this.#ua) {
             if (originator === "remote") session.terminate({ status_code: 486, reason_phrase: "Busy Here" });
@@ -1252,29 +1563,82 @@ var init_ua = __esm({
         });
         ua.on("disconnected", ({ error }) => {
           if (ua !== this.#ua) return;
+          this.#registration = "connecting";
           if (!error) return;
+          if (!reached && this.#retryOnFreshCredentials("unreachable", ua, credentials)) return;
           this.#setState("reconnecting");
           this.#reportError("net/transport-failed", error);
         });
         ua.on("connected", () => {
-          if (ua === this.#ua) this.#setState("online");
+          if (ua !== this.#ua) return;
+          reached = true;
+          this.#registration = "registering";
+          this.#setState("online");
+        });
+        ua.on("registered", () => {
+          if (ua !== this.#ua) return;
+          this.#registration = "registered";
+          this.#freshCredentialsTried = false;
+          this.provider.credentialsWorked?.();
+          for (const waiter of [...this.#awaitingRegistration]) waiter.dial(ua);
+          if (this.#registerAgain) {
+            this.#registerAgain = false;
+            this.#refreshRegistration(ua);
+            return;
+          }
+          if (this.#offerWait) this.#armNoInviteTimer();
         });
         ua.on("registrationFailed", (e) => {
           if (run !== this.#run) return;
           const detail = e;
+          if (isRefusal(detail) && this.#retryOnFreshCredentials("rejected", ua, credentials)) return;
           this.#reportError("net/registration-failed", {
             cause: detail?.cause,
             status: detail?.response?.status_code,
             domain: this.#domain,
             hint: "A bare 401 with no auth challenge usually means the registrar is in the wrong datacenter (SPEC \xA73.1)."
           });
-          if (ua === this.#ua) this.#teardownUA();
-          void this.#refreshSignal();
+          if (ua !== this.#ua) return;
+          if (this.#carriesCall()) {
+            for (const waiter of [...this.#awaitingRegistration]) waiter.fail();
+            this.#registration = "registered";
+            const wait = this.#offerWait;
+            if (wait) {
+              this.#pendingOffer = { from: wait.from || null, at: wait.at };
+              this.#endOfferWait();
+            }
+            return;
+          }
+          this.#teardownUA();
         });
         this.#ua = ua;
+        this.#registration = "connecting";
         ua.start();
         return ua;
       }
+      /**
+       * The credentials behind `ua` did not work. The provider hears it either way, with the credentials in question
+       * (it forgets them unless it has moved on from them already; a provider whose signal shares them renews that
+       * too); then, if it has new ones to give, the current UA is rebuilt on them — once until a registration works,
+       * and never under a live call. Whoever waited on the old UA — an offer, a dial — waits on the new one. Returns
+       * whether it was rebuilt.
+       *
+       * This replaces the engine's old `#refreshSignal` (a close-then-reopen of the push socket after ANY failed
+       * registration): only the provider knows what its credentials and its signal share.
+       */
+      #retryOnFreshCredentials(reason, ua, credentials) {
+        const fresh = this.provider.credentialsFailed?.(reason, credentials) ?? false;
+        if (!fresh || ua !== this.#ua || this.#freshCredentialsTried) return false;
+        if (this.#carriesCall()) return false;
+        this.#freshCredentialsTried = true;
+        const run = this.#run;
+        this.#teardownUA({ replacing: true });
+        const epoch = this.#uaEpoch;
+        void this.#ensureUA().catch(() => {
+          if (run === this.#run && epoch === this.#uaEpoch) this.#teardownUA();
+        });
+        return true;
+      }
       #uaConfig(credentials, factory) {
         return {
           sockets: [factory.createWebSocket(credentials.wsUrl)],
@@ -1292,21 +1656,133 @@ var init_ua = __esm({
           user_agent: this.provider.quirks?.userAgent ?? "Coventia Softphone"
         };
       }
-      #teardownUA() {
+      /**
+       * Lets the current UA go — and one still being provisioned (`#uaEpoch`). `replacing`: a successor is being
+       * built on fresh credentials right away (`#retryOnFreshCredentials`), so the dials and the offer waiting on
+       * this one carry over to it instead of ending here.
+       */
+      #teardownUA({ replacing = false } = {}) {
+        this.#uaEpoch += 1;
         this.#uaInFlight = null;
-        if (!this.#ua) return;
-        for (const fail of [...this.#awaitingRegistration]) fail();
-        try {
-          this.#ua.terminateSessions({ status_code: 487 });
-          this.#ua.stop();
-        } catch {
+        this.#registration = "connecting";
+        this.#registerAgain = false;
+        if (!replacing) {
+          for (const waiter of [...this.#awaitingRegistration]) waiter.fail();
+          this.#endOfferWait();
         }
+        if (!this.#ua) return;
+        const ua = this.#ua;
         this.#ua = null;
         this.#activeCall = null;
         this.#consultCall = null;
+        try {
+          ua.terminateSessions({ status_code: 487 });
+        } catch {
+        }
+        if (this.#owedCancels.some((owed) => owed.ua === ua)) {
+          this.#linger(ua);
+          return;
+        }
+        try {
+          ua.stop();
+        } catch {
+        }
       }
-      /** Place a call once the UA is registered (its 200 OK for REGISTER has arrived). */
+      // ── the CANCEL a hang-up still owes (incoming-call-reliability.md §4.7, F6) ─────────────────────────────
       /**
+       * Watches an outbound leg — a call or a consult leg — from its creation, for the CANCEL JsSIP may end up owing.
+       *
+       * JsSIP's `terminate()` between sending the INVITE and the first provisional response cannot cancel yet (RFC 3261
+       * §9.1): it marks the session canceled, fails it locally with `Canceled`, and sends the CANCEL when a 1xx comes —
+       * or ACKs and BYEs a late 2xx. Live, that 1xx came 17 s late, the engine had torn the UA down on the call's end, and
+       * the callee's phone rang on for a caller who was gone: a ghost call. Hence: the INVITE went out (`sending`), no
+       * provisional above 100 came (`progress`), and it failed locally `Canceled` → the CANCEL is owed, on this UA.
+       *
+       * Registered BEFORE the leg's own listeners: its `failed` must be on record before the leg's end tears the UA down.
+       */
+      #watchOwedCancel(session, ua) {
+        let sent = false;
+        let ringing = false;
+        session.on("sending", () => sent = true);
+        session.on("progress", () => ringing = true);
+        session.on("failed", ({ originator, cause }) => {
+          if (!sent || originator !== "local" || cause !== "Canceled") return;
+          const tx = inviteTransactionOf(session);
+          const owes = deferredCancelOf(session) ?? (tx ? tx.state === ICT_CALLING : !ringing);
+          if (!owes || tx && !awaitsAnswer(tx)) return;
+          const owed = { ua, session, tx };
+          this.#owedCancels.push(owed);
+          if (tx) this.#followInvite(owed, tx);
+        });
+      }
+      /**
+       * Follows the INVITE an owed CANCEL is waiting on, until it is over. Not just the first one: Zadarma challenges every
+       * INVITE (407), and JsSIP re-sends it with credentials on a NEW transaction — canceled leg or not — in the same tick
+       * that completes the first. Releasing on that first transaction stopped the UA two seconds later, and the re-sent
+       * INVITE's 1xx landed nowhere: the ghost call again (found driving the real JsSIP). So once one is over, the leg's
+       * current transaction is read again a moment later, and followed while it still waits for an answer.
+       */
+      #followInvite(owed, tx) {
+        const settle = () => {
+          if (awaitsAnswer(tx)) return;
+          tx.removeListener?.("stateChanged", settle);
+          queueMicrotask(() => {
+            const latest = inviteTransactionOf(owed.session);
+            if (latest && latest !== tx && awaitsAnswer(latest)) {
+              owed.tx = latest;
+              this.#followInvite(owed, latest);
+              return;
+            }
+            this.#owedCancels = this.#owedCancels.filter((other) => other !== owed);
+            this.#releaseIfSettled(owed.ua);
+          });
+        };
+        tx.on("stateChanged", settle);
+      }
+      /**
+       * Lets `ua` go while it owes a CANCEL: un-REGISTERed at once, as any teardown, but connected until every INVITE it
+       * owes is over — COMPLETED (a final non-2xx: the 487 after the late 1xx's CANCEL), ACCEPTED (a late 2xx, which
+       * JsSIP ACKs and BYEs) or TERMINATED (Timer B, a transport error) — and never longer than Timer B. Detached: the
+       * engine has already moved on (a push or a dial builds a fresh UA), so no timer of its own, no teardown and no
+       * "is a call on it" ever sees this one, and an INVITE reaching it is declined like any let-go UA's.
+       */
+      #linger(ua) {
+        if (this.#lingering.has(ua)) return;
+        this.#lingering.set(ua, setTimeout(() => this.#release(ua), INVITE_TRANSACTION_MAX_MS));
+        ua.on("registered", () => {
+          if (this.#lingering.has(ua)) this.#unregister(ua);
+        });
+        this.#unregister(ua);
+        this.#releaseIfSettled(ua);
+      }
+      #unregister(ua) {
+        try {
+          ua.unregister();
+        } catch {
+        }
+      }
+      /**
+       * Once nothing is owed on a lingering UA, it stops — on the next tick: a late 2xx is ACKed and BYEd in the very
+       * tick that settled it, and JsSIP's own `stop()` then keeps the transport ≤ 2 s for that BYE's answer.
+       */
+      #releaseIfSettled(ua) {
+        if (!this.#lingering.has(ua) || this.#owedCancels.some((owed) => owed.ua === ua)) return;
+        setTimeout(() => this.#release(ua), 0);
+      }
+      #release(ua) {
+        const cap = this.#lingering.get(ua);
+        if (cap === void 0) return;
+        clearTimeout(cap);
+        this.#lingering.delete(ua);
+        this.#owedCancels = this.#owedCancels.filter((owed) => owed.ua !== ua);
+        try {
+          ua.stop();
+        } catch {
+        }
+      }
+      /**
+       * Place a call once the current UA is registered (its 200 OK for REGISTER has arrived).
+       *
        * **No `mediaStream`** — JsSIP calls `getUserMedia` itself, which is what opens a real capture.
        *
        * That is load-bearing, not incidental. Firefox restricts ICE gathering on a page with no active
@@ -1316,39 +1792,46 @@ var init_ua = __esm({
        * contains no candidates. The legacy hook passed `mediaConstraints` and nothing else, for what
        * turns out to be a very good reason.
        */
-      #callWhenRegistered(ua, target) {
+      #callWhenRegistered(target, run) {
         const options = { mediaConstraints: buildAudioConstraints(this.#inputDeviceId), pcConfig: PC_CONFIG };
-        if (ua.isRegistered()) return Promise.resolve(ua.call(target, options));
-        const run = this.#run;
+        const refusal = () => createError(run === this.#run ? "call/failed" : "engine/not-started");
+        const dial = (registered) => {
+          const session = registered.call(target, options);
+          this.#watchOwedCancel(session, registered);
+          return this.#wrapCall(session);
+        };
+        const ua = this.#ua;
+        if (!ua || run !== this.#run) return Promise.reject(refusal());
+        if (ua.isRegistered()) return Promise.resolve(dial(ua));
         return new Promise((resolve, reject) => {
-          let settled = false;
-          const fail = () => {
-            if (settled) return;
-            settled = true;
-            this.#awaitingRegistration.delete(fail);
-            reject(createError(run === this.#run ? "call/failed" : "engine/not-started"));
-          };
-          this.#awaitingRegistration.add(fail);
-          ua.on("registered", () => {
-            if (settled) return;
-            if (ua !== this.#ua) return fail();
-            settled = true;
-            this.#awaitingRegistration.delete(fail);
-            try {
-              resolve(ua.call(target, options));
-            } catch (cause) {
-              reject(cause);
+          const waiter = {
+            dial: (registered) => {
+              this.#awaitingRegistration.delete(waiter);
+              try {
+                resolve(dial(registered));
+              } catch (cause) {
+                reject(cause);
+              }
+            },
+            fail: () => {
+              this.#awaitingRegistration.delete(waiter);
+              reject(refusal());
             }
-          });
+          };
+          this.#awaitingRegistration.add(waiter);
         });
       }
-      #wrapCall(session) {
+      /**
+       * `since`, for an inbound call: when its push came (its INVITE, when none was seen) — what `#onDecline` needs to
+       * tell this call from the caller's others.
+       */
+      #wrapCall(session, since = this.now()) {
         const call = new SipEngineCall(session, {
           id: nextCallId(),
           buildTarget: (t) => this.#buildTarget(t),
           placeConsult: (t) => this.#placeConsult(t),
           // The guard is tied to the reject ACTION, not to `ended` — a normal hangup must not arm it.
-          onReject: () => this.#startRejectGuard(),
+          onReject: () => this.#onDecline(call, since),
           iceGatheringCapMs: this.provider.quirks?.iceGatheringCapMs ?? DEFAULT_ICE_CAP_MS,
           // Inbound answers open their own peer connection, so they need the same ICE servers the
           // outbound leg got. Missing here, an ANSWERED call is the one that fails — the half nobody
@@ -1365,17 +1848,27 @@ var init_ua = __esm({
             const code = missed ? "call/missed" : CALL_END_CODES[event.reason];
             if (code) this.#reportError(code, event.cause);
             if (this.#activeCall === call) this.#activeCall = null;
-            this.#maybeTeardownUA();
+            this.#legEnded();
           }
         });
         return call;
       }
+      /**
+       * A leg ended. The UA goes if nothing is left on it (`#maybeTeardownUA`); and once no leg at all is left, an
+       * offer kept through the call (`#pendingOffer`, §4.3) gets its REGISTER — the line is free now.
+       */
+      #legEnded() {
+        const pending = this.#activeCall || this.#consultCall ? null : this.#takePendingOffer();
+        this.#maybeTeardownUA();
+        if (pending) void this.#onOffer(pending.from, pending.at);
+      }
       async #placeConsult(target) {
         const ua = await this.#ensureUA();
         const consultSession = ua.call(this.#buildTarget(target), {
           mediaConstraints: buildAudioConstraints(this.#inputDeviceId),
           pcConfig: PC_CONFIG
         });
+        this.#watchOwedCancel(consultSession, ua);
         const consultCall = new SipEngineCall(consultSession, {
           id: nextCallId(),
           buildTarget: (x) => this.#buildTarget(x),
@@ -1386,7 +1879,7 @@ var init_ua = __esm({
         consultCall.onEvent((event) => {
           if (event.type === "ended") {
             if (this.#consultCall === consultCall) this.#consultCall = null;
-            this.#maybeTeardownUA();
+            this.#legEnded();
           }
         });
         return consultCall;
@@ -1399,19 +1892,29 @@ var init_ua = __esm({
        * session on it, via `terminateSessions`) the instant the main leg's `ended` fires killed that
        * consult leg out from under the transfer before the bridge could use it, and the caller was simply
        * gone. Two real call sites hit this independently (found live, 2026-08-04): the main leg's own
-       * `ended` handler, and `#armNoInviteTeardown`'s 5s timer — the latter re-arms on EVERY push,
-       * including unrelated "answered" pushes Zadarma sends around other account activity, so it can fire
-       * minutes after a transfer with no `#activeCall` and no idea a consult leg is mid-handoff. Both now
-       * route through here rather than checking `#activeCall` alone.
+       * `ended` handler, and the no-INVITE timer — which then re-armed on EVERY push, including the
+       * `answered` pushes Zadarma sends around other account activity, so it could fire minutes after a
+       * transfer with no `#activeCall` and no idea a consult leg was mid-handoff. Every teardown an offer
+       * asks for (its timers, its `offer-ended`) routes through here rather than checking `#activeCall` alone.
+       *
+       * A dial on its way (`#dialing`) counts too: its UA may not even exist yet, and an offer ending must not
+       * take it. So does an offer still waiting for its INVITE: mid-transfer, with only the consult leg left, an
+       * offer registers on this UA — and the consult leg ending used to tear it down and drop that offer, its call
+       * ringing nowhere until the provider offered it again ~30 s later. The wait's own ending (its INVITE, its
+       * `offer-ended`, the no-INVITE timer, the leak guard) clears `#offerWait` before it calls this, so nothing keeps
+       * the UA past those (incoming-call-reliability.md §4.3).
        */
       #maybeTeardownUA() {
         if (this.provider.registrationMode !== "on-demand") return;
-        if (this.#activeCall || this.#consultCall) return;
+        if (this.#activeCall || this.#consultCall || this.#dialing > 0 || this.#offerWait) return;
         this.#teardownUA();
       }
-      #startRejectGuard() {
-        const ms = this.provider.quirks?.rejectGuardMs;
-        if (ms) this.#rejectGuardUntil = this.now() + ms;
+      /**
+       * A live leg is on the current UA: the call or a consult leg. An outbound call counts from the moment its INVITE
+       * is created — `#callWhenRegistered` wraps it there and then — so no failure in between can end it unseen.
+       */
+      #carriesCall() {
+        return this.#activeCall !== null || this.#consultCall !== null;
       }
       #buildTarget(target) {
         return target.includes("@") ? target : `sip:${target}@${this.#domain}`;
@@ -1451,11 +1954,44 @@ function buildPushUrl(key, sip) {
   const params = new URLSearchParams({ key, integrationType: "site", sipId: sip });
   return `wss://ws.zadarma.com/webrtc_pushes?${params.toString()}`;
 }
-var PING, KEY_REFRESH_BUFFER_MS, REBUILD_CONNECT_TIMEOUT_MS, REBUILD_RETRY_MS, ZADARMA_QUIRKS, ZadarmaPushSignal, ZadarmaProvider;
+function readPush(payload) {
+  let data = payload;
+  if (typeof data === "string") {
+    try {
+      data = JSON.parse(data);
+    } catch {
+      return { kind: "other", detail: "unreadable payload" };
+    }
+  }
+  if (!data || typeof data !== "object") return { kind: "other", detail: "no payload" };
+  const { action, callerid } = data;
+  let from = null;
+  if (typeof callerid === "string" && callerid) from = callerid;
+  else if (typeof callerid === "number") from = String(callerid);
+  if (action === "incoming") return { kind: "offer", from };
+  if (action === "answered") return { kind: "offer-ended", from };
+  return { kind: "other", detail: typeof action === "string" ? `action "${action}"` : "no action" };
+}
+function expiryOf(key) {
+  if (!key.keyExpiresAt) return null;
+  const at = new Date(key.keyExpiresAt).getTime();
+  return Number.isFinite(at) ? at : null;
+}
+function toSipCredentials({ key, pass, domain }) {
+  return {
+    uri: `sip:${key.sip}@${domain}`,
+    authUser: key.sip,
+    password: pass,
+    wsUrl: `wss://${domain}:4443`
+  };
+}
+var PING, KEY_REFRESH_BUFFER_MS, KEY_EXPIRY_MARGIN_MS, REKEY_DEBOUNCE_MS, REBUILD_CONNECT_TIMEOUT_MS, REBUILD_RETRY_MS, ZADARMA_QUIRKS, ZadarmaCredentials, ZadarmaPushSignal, ZadarmaProvider;
 var init_zadarma = __esm({
   "src/transports/providers/zadarma.ts"() {
     PING = { localMs: 3e4, globalMs: 6e4 };
     KEY_REFRESH_BUFFER_MS = 2 * 60 * 60 * 1e3;
+    KEY_EXPIRY_MARGIN_MS = 6e4;
+    REKEY_DEBOUNCE_MS = 3e4;
     REBUILD_CONNECT_TIMEOUT_MS = 1e4;
     REBUILD_RETRY_MS = 3e4;
     ZADARMA_QUIRKS = {
@@ -1463,20 +1999,147 @@ var init_zadarma = __esm({
       // after a valid digest challenge, indistinguishable from a wrong password (§3.1). The old CRM
       // hook carried this string; the port dropped it, and registration failed for exactly that reason.
       userAgent: "Zadarma webRTC",
-      // Zadarma re-rings a declined call for ~30 s (return_timeout). Swallow those (§3.4).
+      // Zadarma re-offers a declined call until its ring time ends (~30 s by default): the declined caller's offers
+      // are ignored while that call lives — this long after the decline when the backend cannot say (§3.4,
+      // incoming-call-reliability.md §4.4, Q1).
+      declinedCallerGuardMs: 35e3,
+      // The INVITE follows the REGISTER's 200 OK by ~0.1 s. Nothing 10 s after it: no call is coming to this UA.
+      noInviteAfterRegisterMs: 1e4,
+      // A leak guard only: an offer still waiting for its INVITE 2 min after its push is abandoned (§4.3).
+      offerWaitMaxMs: 12e4,
+      // Deprecated names of the two above, same values: this object is exported, and 0.5.1 is a patch. Never read.
       rejectGuardMs: 35e3,
-      // A push is not an INVITE (§3.3). If none arrives, tear the fresh UA down.
-      noInviteTeardownMs: 5e3,
+      noInviteTeardownMs: 1e4,
       // A ceiling on ICE gathering, not a target: JsSIP sends as soon as gathering completes. 3 s leaves
       // room for a TURN allocation (whose relay candidates arrive last) while still bounding the ~40 s
       // Chrome can spend against an unreachable server. See `capIceGathering`.
       iceGatheringCapMs: 3e3
     };
-    ZadarmaPushSignal = class {
+    ZadarmaCredentials = class {
       constructor(deps) {
         this.deps = deps;
       }
       deps;
+      #key = null;
+      #keyInFlight = null;
+      #sip = null;
+      #sipInFlight = null;
+      /**
+       * Bumped by `forget`, one per half: a fetch begun before it must not put back what was just forgotten — a
+       * refused credential that comes back from a slow request is still refused.
+       */
+      #keyGeneration = 0;
+      #sipGeneration = 0;
+      /**
+       * The SIP credentials were already refetched once because their WSS could not be reached: if the fresh ones
+       * cannot reach it either, the network is the problem, and asking Zadarma again would not change it. Re-armed by
+       * a registration that works (`worked`), and by forgetting everything (a refusal, a stop).
+       */
+      #unreachableRefetched = false;
+      /** What is in memory right now — both halves, for one key — or `null`. Never fetches. */
+      current() {
+        const key = this.#key?.value;
+        const sip = this.#sip;
+        return key && sip && sip.forKey === key.key ? { key, pass: sip.pass, domain: sip.domain } : null;
+      }
+      /** Their WSS could not be reached: forget the SIP half — once, until `worked()`. Whether it was forgotten. */
+      forgetUnreachable() {
+        if (this.#unreachableRefetched) return false;
+        this.forget("sip");
+        this.#unreachableRefetched = true;
+        return true;
+      }
+      /** A registration worked with what is in memory. */
+      worked() {
+        this.#unreachableRefetched = false;
+      }
+      /** The cached key while it is alive; otherwise a fresh one (and, in the background, its SIP credentials). */
+      key() {
+        const cached2 = this.#key;
+        if (cached2 && (cached2.expiresAt === null || Date.now() < cached2.expiresAt - KEY_EXPIRY_MARGIN_MS)) {
+          return Promise.resolve(cached2.value);
+        }
+        return this.#fetchKey();
+      }
+      /** A new key now, whatever is cached: the refresh ahead of expiry. The old one serves until this one lands. */
+      renew() {
+        return this.#fetchKey();
+      }
+      /** The key and the SIP credentials it bought, from memory when they are there. */
+      async sip() {
+        const key = await this.key();
+        const { pass, domain } = await this.#sipFor(key);
+        return { key, pass, domain };
+      }
+      /** Synchronous up to the request, so a prefetch and a `provision()` racing it share one exchange. */
+      #sipFor(key) {
+        const cached2 = this.#sip;
+        if (cached2 && cached2.forKey === key.key) return Promise.resolve({ pass: cached2.pass, domain: cached2.domain });
+        const inFlight = this.#sipInFlight;
+        if (inFlight && inFlight.forKey === key.key) return inFlight.promise;
+        const generation = this.#sipGeneration;
+        let request;
+        try {
+          request = this.deps.exchangeWebphoneData(key.key, key.sip);
+        } catch (cause) {
+          request = Promise.reject(cause instanceof Error ? cause : new Error(String(cause)));
+        }
+        const promise = request.then((data) => {
+          if (generation === this.#sipGeneration) this.#sip = { forKey: key.key, pass: data.pass, domain: data.domain };
+          return data;
+        });
+        const entry = { forKey: key.key, promise };
+        this.#sipInFlight = entry;
+        void promise.finally(() => {
+          if (this.#sipInFlight === entry) this.#sipInFlight = null;
+        }).catch(() => {
+        });
+        return promise;
+      }
+      /**
+       * Drop what stopped working. `all`: the registrar refused the credentials, so the key behind them may be the
+       * stale part too. `sip`: their WSS could not be reached — the key is fine, the datacenter may not be.
+       */
+      forget(what) {
+        this.#sipGeneration += 1;
+        this.#sip = null;
+        this.#sipInFlight = null;
+        if (what === "sip") return;
+        this.#keyGeneration += 1;
+        this.#key = null;
+        this.#keyInFlight = null;
+        this.#unreachableRefetched = false;
+      }
+      #fetchKey() {
+        if (this.#keyInFlight) return this.#keyInFlight;
+        const generation = this.#keyGeneration;
+        const inFlight = this.deps.fetchKey().then((value) => {
+          if (generation === this.#keyGeneration) {
+            this.#key = { value, expiresAt: expiryOf(value) };
+            void this.#sipFor(value).catch(() => {
+            });
+          }
+          return value;
+        });
+        this.#keyInFlight = inFlight;
+        void inFlight.finally(() => {
+          if (this.#keyInFlight === inFlight) this.#keyInFlight = null;
+        }).catch(() => {
+        });
+        return inFlight;
+      }
+    };
+    ZadarmaPushSignal = class {
+      /**
+       * `credentials` is shared with the provider's `provision()`: one key for the push socket and the SIP
+       * credentials, fetched once (§4.5). A signal on its own gets a cache of its own.
+       */
+      constructor(deps, credentials = new ZadarmaCredentials(deps)) {
+        this.deps = deps;
+        this.credentials = credentials;
+      }
+      deps;
+      credentials;
       #socket = null;
       #connected = false;
       #pingTimers = [];
@@ -1495,6 +2158,14 @@ var init_zadarma = __esm({
        * start again) has reset it: the late socket was built beside the new one, and nothing ever closed it.
        */
       #run = 0;
+      /**
+       * The key is due for its refresh (`#armRefresh`): the next rebuild fetches a new one instead of reusing the
+       * cached one — and keeps trying, on every retry and every hidden-tab tick, until one arrives.
+       */
+      #renewDue = false;
+      /** A rebuild asked for (`rekey`) while another was in flight: it runs once that one ends. */
+      #rekeyQueued = false;
+      #rekeyAfter = 0;
       #listeners = /* @__PURE__ */ new Set();
       #connectionListeners = /* @__PURE__ */ new Set();
       async connect() {
@@ -1503,9 +2174,25 @@ var init_zadarma = __esm({
         this.#unwatchBackground ??= this.deps.watchBackgroundReconnect?.(() => void this.#reopen());
         await this.#open();
       }
+      /**
+       * The registrar refused credentials bought with this socket's key, and the provider has forgotten them: the
+       * socket is rebuilt on a fresh key, make-before-break like every rebuild (`#reopen`).
+       *
+       * Debounced: a registrar refusing every attempt must not become a tight loop against our backend and
+       * Zadarma's. This rebuild used to be the engine's (`#refreshSignal`, a close-then-open); it lives here now
+       * because only the provider knows the push socket and the SIP credentials share one key.
+       */
+      rekey() {
+        if (this.#closed || !this.#socket) return;
+        const now = Date.now();
+        if (now < this.#rekeyAfter) return;
+        this.#rekeyAfter = now + REKEY_DEBOUNCE_MS;
+        if (this.#rebuilding) this.#rekeyQueued = true;
+        else void this.#reopen();
+      }
       async #open() {
         const run = this.#run;
-        const { key, sip, keyExpiresAt } = await this.deps.fetchKey();
+        const { key, sip, keyExpiresAt } = await this.credentials.key();
         if (run !== this.#run) return;
         const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
         this.#socket = socket;
@@ -1516,8 +2203,8 @@ var init_zadarma = __esm({
        * Wires one socket's events. `this.#socket` is read when an event FIRES, not when it is wired: a socket that
        * has been replaced must stop driving connectivity (our own `close()` of it emits `disconnect`, which would
        * otherwise flip the state to offline right after a perfectly healthy swap). `update` is the exception — it is
-       * forwarded from any socket not yet closed, because a push seen twice is harmless (the engine ignores a
-       * repeated signal mid-call and reuses a UA that already exists) while one seen by neither is a missed call.
+       * forwarded from any socket not yet closed, because a push seen twice is harmless (the engine ignores an offer
+       * mid-call, and a second one only sends one more REGISTER) while one seen by neither is a missed call.
        *
        * With `hooks`, the socket is a rebuild's candidate: its first `connect` or failure goes to the rebuild instead
        * of changing the connection state (it is not current yet).
@@ -1529,7 +2216,7 @@ var init_zadarma = __esm({
           this.#setConnected(true);
           this.#startPings(socket);
         });
-        socket.on("update", () => this.#emit());
+        socket.on("update", (payload) => this.#emit(readPush(payload)));
         const lost = () => {
           if (hooks && socket === this.#candidate) return hooks.onFailure();
           if (socket !== this.#socket) return;
@@ -1568,13 +2255,19 @@ var init_zadarma = __esm({
        * given at construction. A tab left open past the key's 72 h lifetime would reconnect forever with
        * a dead credential. Absolute, from the backend's `key_expires_at`, so it targets the real expiry
        * rather than restarting a countdown on every reconnect.
+       *
+       * It is also the refresh of the shared credentials (incoming-call-reliability.md §4.5): the new key replaces
+       * the cached one, and its SIP credentials are fetched with it, in the background — no call waits for either.
        */
       #armRefresh(keyExpiresAt) {
         clearTimeout(this.#refreshTimer);
         if (!keyExpiresAt) return;
         const ms = new Date(keyExpiresAt).getTime() - Date.now() - KEY_REFRESH_BUFFER_MS;
         if (!Number.isFinite(ms) || ms <= 0) return;
-        this.#refreshTimer = setTimeout(() => void this.#reopen(), ms);
+        this.#refreshTimer = setTimeout(() => {
+          this.#renewDue = true;
+          void this.#reopen();
+        }, ms);
       }
       /**
        * Replaces the push socket with a fresh one — MAKE-BEFORE-BREAK (presence-client-reporting.md §4.1, T8).
@@ -1590,6 +2283,9 @@ var init_zadarma = __esm({
        * throws, the socket errors, or it has not connected within `REBUILD_CONNECT_TIMEOUT_MS` — keeps the old socket
        * and retries, instead of leaving the tab disconnected. Zadarma does not evict the older of two sockets for one
        * sip (multi-tab-leader-election.md §1), so the overlap is safe.
+       *
+       * The key comes from the shared cache — a hidden-tab tick makes no request — unless it is due for its refresh
+       * (`#renewDue`) or has been forgotten after a refused registration (`rekey`).
        */
       async #reopen() {
         if (this.#closed || this.#rebuilding) return;
@@ -1603,8 +2299,9 @@ var init_zadarma = __esm({
         this.#rebuilding = true;
         const run = this.#run;
         try {
-          const { key, sip, keyExpiresAt } = await this.deps.fetchKey();
+          const { key, sip, keyExpiresAt } = await (this.#renewDue ? this.credentials.renew() : this.credentials.key());
           if (run !== this.#run) return;
+          this.#renewDue = false;
           const swapped = await new Promise((resolve) => {
             const socket = this.deps.createPushSocket(buildPushUrl(key, sip));
             this.#candidate = socket;
@@ -1632,6 +2329,10 @@ var init_zadarma = __esm({
         } finally {
           this.#rebuilding = false;
         }
+        if (this.#rekeyQueued) {
+          this.#rekeyQueued = false;
+          void this.#reopen();
+        }
       }
       /**
        * The moment of the swap — synchronous, called from the candidate's own `connect` event so nothing can run
@@ -1655,9 +2356,17 @@ var init_zadarma = __esm({
         clearTimeout(this.#retryTimer);
         this.#retryTimer = setTimeout(() => void this.#reopen(), REBUILD_RETRY_MS);
       }
+      /**
+       * Closes everything — and forgets the credentials: this is how the engine stops, and a phone that is off holds
+       * no SIP password. The next `connect()` fetches them again.
+       */
       disconnect() {
         this.#closed = true;
         this.#run += 1;
+        this.#renewDue = false;
+        this.#rekeyQueued = false;
+        this.#rekeyAfter = 0;
+        this.credentials.forget("all");
         this.#stopPings();
         clearTimeout(this.#refreshTimer);
         this.#refreshTimer = void 0;
@@ -1686,16 +2395,11 @@ var init_zadarma = __esm({
         this.#connected = connected;
         for (const listener of [...this.#connectionListeners]) listener(connected);
       }
-      #emit() {
-        for (const listener of [...this.#listeners]) listener();
+      #emit(event) {
+        for (const listener of [...this.#listeners]) listener(event);
       }
     };
     ZadarmaProvider = class {
-      constructor(deps) {
-        this.deps = deps;
-        this.incomingSignal = new ZadarmaPushSignal(deps);
-      }
-      deps;
       name = "zadarma";
       // Zadarma's PBX ignores a standing registration — it routes INVITEs only to a UA that registered
       // in response to a push (SPEC §3.2). Hence on-demand.
@@ -1703,25 +2407,64 @@ var init_zadarma = __esm({
       quirks = ZADARMA_QUIRKS;
       incomingSignal;
       /**
-       * Per-registration credentialing: fetch a scoped key, then exchange it in the browser for
-       * ephemeral SIP creds. The key fetch is cheap and backend-cached; doing it here (rather than
-       * sharing state with the push signal) keeps the two paths independent.
+       * One key and one set of SIP credentials for the push socket and every registration (§4.5). Its "unreachable
+       * refetched once" mark lives there too, so a stop — which forgets the credentials — clears it as well.
+       */
+      #credentials;
+      #signal;
+      constructor(deps) {
+        this.#credentials = new ZadarmaCredentials(deps);
+        this.#signal = new ZadarmaPushSignal(deps, this.#credentials);
+        this.incomingSignal = this.#signal;
+      }
+      /**
+       * The SIP credentials, from memory (incoming-call-reliability.md §4.5). They were fetched when the push socket
+       * opened — the key from our backend, then `{ pass, domain }` from Zadarma, in the browser for the geo-routing
+       * (SPEC §3.1) — so a push goes straight to the WSS and the REGISTER. Fetched here only when they are not there:
+       * the background fetch failed, or they were forgotten (`credentialsFailed`).
        */
       async provision() {
-        const { key, sip } = await this.deps.fetchKey();
-        const { pass, domain } = await this.deps.exchangeWebphoneData(key, sip);
-        return {
-          uri: `sip:${sip}@${domain}`,
-          authUser: sip,
-          password: pass,
-          wsUrl: `wss://${domain}:4443`
-        };
+        return toSipCredentials(await this.#credentials.sip());
+      }
+      /**
+       * `rejected` (401/403): the key may be the stale part, so both are forgotten, and the push socket — which
+       * holds the same key — is rebuilt on a fresh one. `unreachable`: only the SIP credentials, and only once
+       * until a registration works: Zadarma may have moved this browser to another datacenter (SPEC §3.1).
+       *
+       * Only if `credentials` — the ones that failed — are still what is in memory: a UA let go of earlier can report
+       * late, when the cache has already moved on to fresh ones, and those must not be thrown away for it.
+       */
+      credentialsFailed(reason, credentials) {
+        if (credentials && !this.#holds(credentials)) return true;
+        if (reason === "rejected") {
+          this.#credentials.forget("all");
+          this.#signal.rekey();
+          return true;
+        }
+        return this.#credentials.forgetUnreachable();
+      }
+      credentialsWorked() {
+        this.#credentials.worked();
+      }
+      #holds(credentials) {
+        const current = this.#credentials.current();
+        if (!current) return false;
+        const held = toSipCredentials(current);
+        return held.uri === credentials.uri && held.authUser === credentials.authUser && held.password === credentials.password;
       }
     };
   }
 });
 
 // src/transports/providers/zadarma-browser.ts
+function retryAfterMsOf(res) {
+  const value = res.headers?.get?.("retry-after");
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : void 0;
+}
 function makeFetchKey(config) {
   const attempt = async () => {
     let token;
@@ -1737,7 +2480,7 @@ function makeFetchKey(config) {
     if (!res.ok) {
       const body = await res.json().catch(() => null);
       const message = body?.message ?? `webrtc/key HTTP ${res.status}`;
-      throw res.status === 401 ? new UnauthorizedKeyError(message) : new Error(message);
+      throw res.status === 401 ? new UnauthorizedKeyError(message) : new KeyFetchError(message, res.status, retryAfterMsOf(res));
     }
     const data = await res.json();
     return {
@@ -1883,13 +2626,22 @@ function makeZadarmaBrowserDeps(config) {
     watchBackgroundReconnect
   };
 }
-var UnauthorizedKeyError, BACKGROUND_RECONNECT_MS, HEARTBEAT_WORKER_SOURCE;
+var UnauthorizedKeyError, KeyFetchError, BACKGROUND_RECONNECT_MS, HEARTBEAT_WORKER_SOURCE;
 var init_zadarma_browser = __esm({
   "src/transports/providers/zadarma-browser.ts"() {
     init_token_cache();
     init_errors();
     UnauthorizedKeyError = class extends Error {
     };
+    KeyFetchError = class extends Error {
+      constructor(message, status, retryAfterMs) {
+        super(message);
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+      }
+      status;
+      retryAfterMs;
+    };
     BACKGROUND_RECONNECT_MS = 2e4;
     HEARTBEAT_WORKER_SOURCE = `
   let timer;
@@ -2396,9 +3148,56 @@ function startTransferWatch(params) {
   return stop;
 }
 
+// src/core/start-retry.ts
+init_errors();
+var BACKOFF_BASE_MS = 1e3;
+var BACKOFF_MAX_MS = 3e4;
+function backoffDelayMs(attempt, random = Math.random) {
+  const capped = Math.min(BACKOFF_BASE_MS * 2 ** (Math.max(1, attempt) - 1), BACKOFF_MAX_MS);
+  return capped * random();
+}
+function isTransientStatus(status) {
+  return status === 0 || status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function isNetworkFailure(error) {
+  const name = typeof error.name === "string" ? error.name : "";
+  return error instanceof TypeError || name === "AbortError" || name === "TimeoutError" || name === "NetworkError";
+}
+function transientStartFailure(error) {
+  let retryAfterMs = 0;
+  let viaTokenEndpoint = false;
+  let current = error;
+  for (let depth = 0; depth < 6 && current !== null && typeof current === "object"; depth += 1) {
+    const layer = current;
+    if (typeof layer.retryAfterMs === "number" && Number.isFinite(layer.retryAfterMs)) {
+      retryAfterMs = Math.max(retryAfterMs, layer.retryAfterMs);
+    }
+    if (typeof layer.status === "number") return isTransientStatus(layer.status) ? { retryAfterMs } : null;
+    if (isNetworkFailure(layer)) return { retryAfterMs };
+    if (isSoftphoneError(current)) {
+      if (layer.code === "auth/token-rejected") return null;
+      if (layer.code === "auth/token-fetch-failed") viaTokenEndpoint = true;
+    }
+    current = layer.cause;
+  }
+  return viaTokenEndpoint ? { retryAfterMs } : null;
+}
+function watchWake(wake) {
+  if (!isBrowser()) return () => {
+  };
+  const onOnline = () => wake();
+  const onVisibility = () => {
+    if (document.visibilityState === "visible") wake();
+  };
+  window.addEventListener("online", onOnline);
+  document.addEventListener("visibilitychange", onVisibility);
+  return () => {
+    window.removeEventListener("online", onOnline);
+    document.removeEventListener("visibilitychange", onVisibility);
+  };
+}
+
 // src/core/presence-socket.ts
-var RECONNECT_BASE_MS = 1e3;
-var RECONNECT_MAX_MS = 3e4;
 var NOOP_WATCH = { reportCallState: () => {
 }, claimLine: () => false, stop: () => {
 } };
@@ -2410,6 +3209,7 @@ function startPresenceSocket(params) {
     clientId,
     onLine,
     onClaimResult,
+    onOffer,
     onLineUnsupported,
     onConnectFailed,
     onDisconnect,
@@ -2450,8 +3250,7 @@ function startPresenceSocket(params) {
   const scheduleReconnect = () => {
     if (stopped) return;
     attempt += 1;
-    const capped = Math.min(RECONNECT_BASE_MS * 2 ** (attempt - 1), RECONNECT_MAX_MS);
-    const delay = capped * random();
+    const delay = backoffDelayMs(attempt, random);
     reconnectTimer = scheduleTimeout(() => void connect(), delay);
   };
   const connect = async () => {
@@ -2486,6 +3285,9 @@ function startPresenceSocket(params) {
         },
         onClaimResult: (result) => {
           if (!stopped) onClaimResult?.(result);
+        },
+        onOffer: (offer) => {
+          if (!stopped) onOffer?.(offer);
         }
       });
     } catch {
@@ -2738,6 +3540,17 @@ var SoftphoneImpl = class extends Emitter {
   #claim = null;
   /** Pending: what the server said about the line stops counting (`LINE_LAPSE_MS`). */
   #lineLapseTimer = null;
+  // ── The start retry (incoming-call-reliability.md §4.6) ─────────────────────────────────────────────────
+  // An engine start that failed for a passing reason (a 5xx, the network, a timeout) is attempted again on its
+  // own, with backoff, instead of leaving the phone `offline` until someone presses "Reintentar".
+  /** Failed attempts in the current streak; back to 0 when the engine starts, or the softphone stops. */
+  #startRetries = 0;
+  /** The wait before the next attempt, or `null` when none is pending. */
+  #startRetryTimer = null;
+  /** No attempt before this (epoch ms): a `Retry-After` the failure carried, which a wake-up must honour too. */
+  #startRetryNotBefore = 0;
+  /** Unsubscribes the `online` / tab-visible wake-ups, armed only while an attempt is pending. */
+  #unwatchWake = null;
   /**
    * `tabLock` defaults to the real Web Locks implementation — not part of `SoftphoneConfig` (an
    * internal seam, not something an integrator tunes). Tests construct this class directly with a
@@ -2820,6 +3633,7 @@ var SoftphoneImpl = class extends Emitter {
   async stop() {
     if (!this.#startedHere) return;
     this.#run += 1;
+    this.#cancelStartRetry();
     this.#lineMode = "off";
     this.#sayGoodbye();
     this.#startDecision?.end();
@@ -2863,6 +3677,7 @@ var SoftphoneImpl = class extends Emitter {
   async call(destination, options) {
     this.#assertUsable();
     const run = this.#run;
+    if (this.#startRetryTimer !== null) this.#wakeStartRetry();
     if (this.#startDecision) {
       let timer;
       const decided = await Promise.race([
@@ -3006,6 +3821,9 @@ var SoftphoneImpl = class extends Emitter {
         clientId: this.#clientId,
         onLine: (update) => this.#onLine(update),
         onClaimResult: (result) => this.#onClaimResult(result),
+        // The calls offered to this line, straight to the engine: after a decline, they say when the declined
+        // call's re-offers stop (incoming-call-reliability.md §4.4). Not public — nothing a host acts on.
+        onOffer: (offer) => this.#engine.noteOffer?.(offer),
         // A source that cannot take part will never answer, and one that cannot connect cannot answer yet:
         // `start()` need not wait out its 4 s for either (R7). A later answer still applies.
         onLineUnsupported: () => this.#releaseFirstLine?.(),
@@ -3052,6 +3870,7 @@ var SoftphoneImpl = class extends Emitter {
     this.#presenceAgents = [];
     this.emit("presenceChanged" /* PresenceChanged */, { agents: [] });
     this.#forgetLine();
+    this.#engine.noteOffer?.(null);
   }
   /**
    * A DELIBERATE stop (`stop()` / `destroy()`): say any call is over, then say goodbye, so the backend drops
@@ -3111,12 +3930,14 @@ var SoftphoneImpl = class extends Emitter {
     });
     return step;
   }
+  /** Resolves when the engine started — or when its failure is being retried on its own (§4.6). */
   async #startEngine(run) {
     const reported = this.#lastError;
     try {
       await this.#engine.start();
+      if (run === this.#run) this.#startRetries = 0;
     } catch (cause) {
-      if (run === this.#run) this.#engineStartFailed(cause, reported);
+      if (run === this.#run && this.#engineStartFailed(cause, reported)) return;
       throw cause;
     }
   }
@@ -3124,19 +3945,99 @@ var SoftphoneImpl = class extends Emitter {
    * An engine start the line asked for failed. Kept as it was, this softphone would stay the owner on the
    * server — `starting`, its presence socket renewing the line — with no push socket anywhere: nobody would
    * listen. So it gives the line up the ordinary way, by closing its presence socket without a goodbye (the
-   * phone was not switched off): the server hands the line on after its grace (R4). The failure is reported
-   * like any engine failure — `SoftphoneEvent.Error` and `lastError`, which is the widget's error gate and
-   * its "Reintentar" (`stop()` then `start()`, which asks for the line again). Nothing retries on its own.
+   * phone was not switched off): the server hands the line on after its grace (R4).
+   *
+   * Then it depends on why (incoming-call-reliability.md §4.6, F5):
+   *   - **a passing failure** (a 5xx, the network, a timeout — `transientStartFailure`) is attempted again on its
+   *     own, after a backoff, as `reconnecting`, with no error gate. Found live: a voice token answered 500 after
+   *     10 s left a background tab `offline` for good, and every call was lost until someone pressed "Reintentar".
+   *     Returns `true`.
+   *   - **anything else** (a refused credential, no extension) is reported like any engine failure —
+   *     `SoftphoneEvent.Error` and `lastError`, which is the widget's error gate and its "Reintentar" (`stop()`
+   *     then `start()`, which asks for the line again) — and nothing retries on its own. Returns `false`.
    */
   #engineStartFailed(cause, reportedBefore) {
     this.#engineOn = false;
     this.#engineRunning = false;
     this.#lineMode = "off";
+    const transient = this.#destroyed ? null : transientStartFailure(cause);
+    this.#stopPresence();
+    if (transient) {
+      this.#scheduleStartRetry(transient.retryAfterMs, cause);
+      this.#setState("reconnecting");
+      return true;
+    }
     if (this.#lastError === reportedBefore) {
       this.#onError(isSoftphoneError(cause) && isFatal(cause) ? cause : createError("net/transport-failed", cause));
     }
-    this.#stopPresence();
     this.#setState("offline");
+    return false;
+  }
+  /**
+   * The next attempt, after the shared backoff (1 s doubling to 30 s, jittered — the presence socket's own) and
+   * never before a `Retry-After` the failure carried. A plain timer: in a hidden tab it can stretch to about a
+   * minute, which is why the browser coming back `online`, or the tab becoming visible, attempts at once
+   * (`watchWake`). One warning per streak, so a console says what is going on without filling up.
+   */
+  #scheduleStartRetry(retryAfterMs, cause) {
+    this.#startRetries += 1;
+    const wait = Math.max(backoffDelayMs(this.#startRetries), retryAfterMs);
+    if (this.#startRetries === 1) {
+      console.warn("[softphone] the phone could not start; it keeps trying on its own", cause);
+    }
+    this.#startRetryNotBefore = Date.now() + retryAfterMs;
+    if (this.#startRetryTimer !== null) clearTimeout(this.#startRetryTimer);
+    const run = this.#run;
+    this.#startRetryTimer = setTimeout(() => void this.#retryStart(run), wait);
+    this.#unwatchWake ??= watchWake(() => this.#wakeStartRetry());
+  }
+  /** The pending attempt, now — unless a `Retry-After` says not yet, in which case it moves up to that moment. */
+  #wakeStartRetry() {
+    if (this.#startRetryTimer === null) return;
+    const run = this.#run;
+    clearTimeout(this.#startRetryTimer);
+    const wait = this.#startRetryNotBefore - Date.now();
+    if (wait > 0) {
+      this.#startRetryTimer = setTimeout(() => void this.#retryStart(run), wait);
+      return;
+    }
+    void this.#retryStart(run);
+  }
+  /** The wait and the wake-ups go; the streak's count stays (the next failure doubles on from it). */
+  #clearStartRetryWait() {
+    if (this.#startRetryTimer !== null) clearTimeout(this.#startRetryTimer);
+    this.#startRetryTimer = null;
+    this.#unwatchWake?.();
+    this.#unwatchWake = null;
+  }
+  #cancelStartRetry() {
+    this.#clearStartRetryWait();
+    this.#startRetries = 0;
+  }
+  /**
+   * One attempt: what "Reintentar" does after its `stop()`, minus the goodbye and the leadership (both kept) —
+   * the presence socket opens again and its `hello` asks for the line, the line decides (`standby` if it went
+   * elsewhere meanwhile, as at any start), and the engine starts. Without the goodbye, an attempt inside the
+   * server's 10 s grace gets the line straight back. Never for a softphone stopped since it was scheduled.
+   */
+  async #retryStart(run) {
+    this.#clearStartRetryWait();
+    if (this.#destroyed || run !== this.#run || !this.#startedHere || !this.#isLeader) return;
+    const decision = this.#openStartDecision();
+    try {
+      this.#lineMode = "deciding";
+      this.#setState("starting");
+      if (this.#presenceWatch && this.#line === "unknown") await this.#waitForFirstLine();
+      if (this.#destroyed || run !== this.#run) return;
+      this.#lineMode = "on";
+      const engineStart = this.#applyLine();
+      if (!engineStart) this.#startRetries = 0;
+      decision.end();
+      await engineStart?.catch(() => {
+      });
+    } finally {
+      decision.end();
+    }
   }
   /** `start()`'s decision (`#startDecision`): ended once, by whichever comes first — the decision or its end. */
   #openStartDecision() {
@@ -3190,6 +4091,7 @@ var SoftphoneImpl = class extends Emitter {
    * waiting softphone answers by listening again.
    */
   #onPresenceDisconnect() {
+    this.#engine.noteOffer?.(null);
     this.#settleClaim(createError("line/unavailable"));
     if (this.#line === "unknown" || this.#lineLapseTimer !== null) return;
     this.#lineLapseTimer = setTimeout(() => {
@@ -3299,6 +4201,7 @@ var SoftphoneImpl = class extends Emitter {
 
 // src/core/default-provider.ts
 init_errors();
+var MAX_PENDING_OFFERS = 20;
 var LazyRelay = class {
   #listeners = /* @__PURE__ */ new Set();
   #realOff = /* @__PURE__ */ new Map();
@@ -3325,6 +4228,7 @@ function defaultZadarmaEngine(config) {
   const incoming = new LazyRelay();
   const stateChange = new LazyRelay();
   const error = new LazyRelay();
+  let pendingOffers = [];
   function load() {
     pending ??= Promise.resolve().then(() => (init_zadarma_engine(), zadarma_engine_exports)).then(({ createZadarmaEngine: createZadarmaEngine2 }) => {
       const engine = createZadarmaEngine2(config);
@@ -3332,6 +4236,8 @@ function defaultZadarmaEngine(config) {
       stateChange.attach({ on: (l) => engine.onStateChange(l) });
       error.attach({ on: (l) => engine.onError?.(l) ?? (() => {
       }) });
+      for (const offer of pendingOffers) engine.noteOffer?.(offer);
+      pendingOffers = [];
       real = engine;
       return engine;
     }).catch((cause) => {
@@ -3362,7 +4268,20 @@ function defaultZadarmaEngine(config) {
     },
     onIncoming: (listener) => incoming.subscribe(listener),
     onStateChange: (listener) => stateChange.subscribe(listener),
-    onError: (listener) => error.subscribe(listener)
+    onError: (listener) => error.subscribe(listener),
+    /*
+     * Relayed like the listeners above, or the decline guard on this — the default — path would never hear the
+     * backend (incoming-call-reliability.md §4.4). Before the engine loads, kept (a few) rather than loading it:
+     * a softphone in `standby` hears offers without ever starting an engine.
+     */
+    noteOffer: (offer) => {
+      if (real) {
+        real.noteOffer?.(offer);
+        return;
+      }
+      pendingOffers.push(offer);
+      if (pendingOffers.length > MAX_PENDING_OFFERS) pendingOffers.shift();
+    }
   };
 }
 
@@ -3405,7 +4324,7 @@ function isCallEngine(value) {
 // src/index.ts
 init_errors();
 init_outbound_numbers();
-var VERSION = "0.5.0";
+var VERSION = "0.5.1";
 
 exports.CALL_TRANSITIONS = CALL_TRANSITIONS;
 exports.CallEvent = CallEvent;