librats 0.7.1 → 0.8.0

package/native-src/src/librats.cpp

@@ -1,42 +1,15 @@
 #include "librats.h"
-#include "gossipsub.h"
-#include "sha1.h"
 #include "os.h"
 #include "network_utils.h"
-#include "fs.h"
-#include "json.hpp" // nlohmann::json
 #include "version.h"
-#include <iostream>
 #include <algorithm>
-#include <chrono>
-#include <memory>
+#include <array>
 #include <random>
 #include <sstream>
 #include <iomanip>
-#include <stdexcept>
 #include <string_view>
 
-#ifdef TESTING
-#define LOG_CLIENT_DEBUG(message) LOG_DEBUG("client", "[pointer: " << this << "] " << message)
-#define LOG_CLIENT_INFO(message)  LOG_INFO("client", "[pointer: " << this << "] " << message)
-#define LOG_CLIENT_WARN(message)  LOG_WARN("client", "[pointer: " << this << "] " << message)
-#define LOG_CLIENT_ERROR(message) LOG_ERROR("client", "[pointer: " << this << "] " << message)
-
-#define LOG_SERVER_DEBUG(message) LOG_DEBUG("server", "[pointer: " << this << "] " << message)
-#define LOG_SERVER_INFO(message)  LOG_INFO("server", "[pointer: " << this << "] " << message)
-#define LOG_SERVER_WARN(message)  LOG_WARN("server", "[pointer: " << this << "] " << message)
-#define LOG_SERVER_ERROR(message) LOG_ERROR("server", "[pointer: " << this << "] " << message)
-#else
-#define LOG_CLIENT_DEBUG(message) LOG_DEBUG("client", message)
-#define LOG_CLIENT_INFO(message)  LOG_INFO("client", message)
-#define LOG_CLIENT_WARN(message)  LOG_WARN("client", message)
-#define LOG_CLIENT_ERROR(message) LOG_ERROR("client", message)
-
-#define LOG_SERVER_DEBUG(message) LOG_DEBUG("server", message)
-#define LOG_SERVER_INFO(message)  LOG_INFO("server", message)
-#define LOG_SERVER_WARN(message)  LOG_WARN("server", message)
-#define LOG_SERVER_ERROR(message) LOG_ERROR("server", message)
-#endif
+#include "librats_log_macros.h"
 
 namespace librats {
 
@@ -112,7 +85,6 @@ void RatsClient::destroy_modules() {
 // Core Lifecycle Management
 // =========================================================================
 
-
 bool RatsClient::start() {
     if (running_.load()) {
         LOG_CLIENT_WARN("RatsClient is already running");
@@ -146,16 +118,27 @@ bool RatsClient::start() {
     initialize_local_addresses();
     
     // Create dual-stack server socket (supports both IPv4 and IPv6)
-   server_socket_ = create_tcp_server(listen_port_, 5, bind_address_);
+    server_socket_ = create_tcp_server(listen_port_, 5, bind_address_);
+	// Fallback to free port
+    if (!is_valid_socket(server_socket_) && listen_port_ > 0) {
+        // Requested port is not available, try ephemeral port as fallback
+        int original_port = listen_port_;
+        LOG_CLIENT_WARN("TCP port " << original_port << " is not available, falling back to ephemeral port");
+        server_socket_ = create_tcp_server(0, 5, bind_address_);
+        if (is_valid_socket(server_socket_)) {
+            listen_port_ = get_bound_port(server_socket_);
+            LOG_CLIENT_INFO("Fell back from port " << original_port << " to ephemeral port " << listen_port_);
+        }
+    }
     if (!is_valid_socket(server_socket_)) {
-        LOG_CLIENT_ERROR("Failed to create dual-stack server socket on port " << listen_port_ <<
+        LOG_CLIENT_ERROR("Failed to create server socket on port " << listen_port_ <<
                         (bind_address_.empty() ? "" : " bound to " + bind_address_));
         return false;
     }
     
     // Update listen_port_ with actual bound port if ephemeral port was requested
     if (listen_port_ == 0) {
-        listen_port_ = get_ephemeral_port(server_socket_);
+        listen_port_ = get_bound_port(server_socket_);
         if (listen_port_ == 0) {
             LOG_CLIENT_WARN("Failed to get actual bound port - using port 0");
         } else {
@@ -163,12 +146,20 @@ bool RatsClient::start() {
         }
     }
     
+    // Set server socket to non-blocking for the IO poller
+    set_socket_nonblocking(server_socket_);
+    
+    // Create platform-optimal IO poller and register server socket
+    poller_ = IOPoller::create();
+    poller_->add(server_socket_, PollIn);
+    LOG_CLIENT_INFO("IO poller backend: " << poller_->name());
+    
     running_.store(true);
     
-    // Start server thread
-    server_thread_ = std::thread(&RatsClient::server_loop, this);
+    // Start IO thread (single-threaded event loop for all sockets)
+    io_thread_ = std::thread(&RatsClient::io_loop, this);
     
-    // Start management thread
+    // Start management thread (handshake timeouts, reconnection, thread cleanup)
     management_thread_ = std::thread(&RatsClient::management_loop, this);
     
     // Start GossipSub
@@ -181,7 +172,7 @@ bool RatsClient::start() {
     // Attempt to reconnect to saved peers
     add_managed_thread(std::thread([this]() {
         // Give the server some time to fully initialize
-        std::this_thread::sleep_for(std::chrono::milliseconds(100));
+        std::this_thread::sleep_for(std::chrono::milliseconds(PEER_RECONNECT_DELAY_MS));
         int reconnect_attempts = load_and_reconnect_peers();
         if (reconnect_attempts > 0) {
             LOG_CLIENT_INFO("Attempted to reconnect to " << reconnect_attempts << " saved peers");
@@ -189,7 +180,7 @@ bool RatsClient::start() {
         
         // Also attempt to reconnect to historical peers if not at peer limit
         if (!is_peer_limit_reached()) {
-            std::this_thread::sleep_for(std::chrono::milliseconds(500)); // Give current peers time to connect
+            std::this_thread::sleep_for(std::chrono::milliseconds(HISTORICAL_RECONNECT_DELAY_MS));
             int historical_attempts = load_and_reconnect_historical_peers();
             if (historical_attempts > 0) {
                 LOG_CLIENT_INFO("Attempted to reconnect to " << historical_attempts << " historical peers");
@@ -211,8 +202,7 @@ void RatsClient::stop() {
     if (gossipsub_) {
         gossipsub_->stop();
     }
-
-
+    
     // Trigger immediate shutdown of all background threads
     shutdown_all_threads();
     
@@ -235,25 +225,25 @@ void RatsClient::stop() {
         manual_disconnect_peers_.clear();
     }
     
-    // Close all peer connections
+    // Close all peer connections and remove from poller
     {
         std::lock_guard<std::mutex> lock(peers_mutex_);
         LOG_CLIENT_INFO("Closing " << peers_.size() << " peer connections");
         for (const auto& pair : peers_) {
             const RatsPeer& peer = pair.second;
+            if (poller_) poller_->remove(peer.socket);
             close_socket(peer.socket, true);
         }
         peers_.clear();
         socket_to_peer_id_.clear();
         address_to_peer_id_.clear();
+        validated_peer_count_.store(0, std::memory_order_relaxed);
     }
     
-
-    
-    // Wait for server thread to finish
-    if (server_thread_.joinable()) {
-        LOG_CLIENT_DEBUG("Waiting for server thread to finish");
-        server_thread_.join();
+    // Wait for IO thread to finish
+    if (io_thread_.joinable()) {
+        LOG_CLIENT_DEBUG("Waiting for IO thread to finish");
+        io_thread_.join();
     }
     
     // Wait for management thread to finish
@@ -262,11 +252,14 @@ void RatsClient::stop() {
         management_thread_.join();
     }
     
+    // Destroy poller after threads have stopped
+    poller_.reset();
+    
     // Join all managed threads for graceful cleanup
     join_all_active_threads();
     
     cleanup_socket_library();
-
+    
     // Save configuration before stopping
     save_configuration();
     
@@ -278,7 +271,7 @@ void RatsClient::shutdown_all_threads() {
     
     // Signal all threads to stop
     running_.store(false);
-
+    
     // Call parent class to handle thread management shutdown
     ThreadManager::shutdown_all_threads();
 }
@@ -300,456 +293,564 @@ std::string RatsClient::get_bind_address() const {
 }
 
 // =========================================================================
-// Managment loops
+// Async I/O – single-threaded event loop
 // =========================================================================
 
-void RatsClient::server_loop() {
-    LOG_SERVER_INFO("Server loop started");
+void RatsClient::io_loop() {
+    LOG_CLIENT_INFO("IO loop started (backend: " << poller_->name() << ")");
+    
+    static constexpr int MAX_EVENTS = 256;
+    PollResult results[MAX_EVENTS];
     
     while (running_.load()) {
-        socket_t client_socket = accept_client(server_socket_);
-        if (!is_valid_socket(client_socket)) {
-            if (running_.load()) {
-                LOG_SERVER_ERROR("Failed to accept client connection");
+        int n = poller_->wait(results, MAX_EVENTS, IO_POLL_TIMEOUT_MS);
+        
+        if (n < 0) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(10));
+            continue;
+        }
+        
+        // Collect sockets to disconnect (defer to avoid iterator issues)
+        std::vector<socket_t> to_disconnect;
+        
+        for (int i = 0; i < n; ++i) {
+            socket_t fd = results[i].fd;
+            uint32_t events = results[i].events;
+            
+            // Server socket – accept incoming connections
+            if (fd == server_socket_) {
+                if (events & PollIn) accept_incoming();
+                continue;
             }
-            break;
+            
+            bool should_close = false;
+            
+            if (events & (PollErr | PollHup)) {
+                should_close = true;
+            }
+            
+            if (!should_close && (events & PollIn)) {
+                should_close = handle_readable(fd);
+            }
+            
+            if (!should_close && (events & PollOut)) {
+                should_close = handle_writable(fd);
+            }
+            
+            if (should_close) {
+                to_disconnect.push_back(fd);
+            }
+        }
+        
+        // Handle disconnections outside the event loop
+        for (socket_t fd : to_disconnect) {
+            handle_disconnect(fd);
         }
+    }
+    
+    LOG_CLIENT_INFO("IO loop ended");
+}
+
+// ---------------------------------------------------------------------------
+// accept_incoming – non-blocking accept of new TCP connections
+// ---------------------------------------------------------------------------
+void RatsClient::accept_incoming() {
+    // Accept as many pending connections as possible (level-triggered)
+    while (true) {
+        socket_t client = accept_client(server_socket_);
+        if (!is_valid_socket(client)) break;
         
-        // Get peer address information
-        std::string peer_address = get_peer_address(client_socket);
+        std::string peer_address = get_peer_address(client);
         if (peer_address.empty()) {
-            LOG_SERVER_ERROR("Failed to get peer address for incoming connection");
-            close_socket(client_socket);
+            close_socket(client);
             continue;
         }
         
-        // Parse IP and port from peer_address
         std::string ip;
         int port = 0;
         if (!parse_address_string(peer_address, ip, port)) {
-            LOG_SERVER_ERROR("Failed to parse peer address from incoming connection: " << peer_address);
-            close_socket(client_socket);
+            close_socket(client);
             continue;
         }
         
-        std::string normalized_peer_address = normalize_peer_address(ip, port);
+        std::string normalized = normalize_peer_address(ip, port);
         
-        // Check if peer limit is reached
         if (is_peer_limit_reached()) {
-            LOG_SERVER_INFO("Peer limit reached (" << max_peers_ << "), rejecting connection from " << normalized_peer_address);
-            close_socket(client_socket);
+            LOG_SERVER_INFO("Peer limit reached, rejecting " << normalized);
+            close_socket(client);
             continue;
         }
         
-        // Check if we're already connected to this peer
-        if (is_already_connected_to_address(normalized_peer_address)) {
-            LOG_SERVER_INFO("Already connected to peer " << normalized_peer_address << ", rejecting duplicate connection");
-            close_socket(client_socket);
+        if (is_already_connected_to_address(normalized)) {
+            LOG_SERVER_DEBUG("Duplicate connection from " << normalized);
+            close_socket(client);
             continue;
         }
-
-
-        // Generate unique hash ID for this incoming client
-        std::string connection_info = "incoming_from_" + peer_address;
-        std::string peer_hash_id = generate_peer_hash_id(client_socket, connection_info); // Temporary hash ID (real hash ID will be set after handshake)
         
-        // Create RatsPeer object for incoming connection
+        // Make the new socket non-blocking and register with poller
+        set_socket_nonblocking(client);
+        
+        std::string initial_id = generate_temporary_peer_id(client, "incoming_from_" + peer_address);
+        
         {
             std::lock_guard<std::mutex> lock(peers_mutex_);
-            RatsPeer new_peer(peer_hash_id, ip, port, client_socket, normalized_peer_address, false); // false = incoming connection
+            RatsPeer new_peer(initial_id, ip, port, client, normalized, false);
             new_peer.encryption_enabled = is_encryption_enabled();
             add_peer_unlocked(new_peer);
         }
         
-        // Start a thread to handle this client
-        LOG_SERVER_DEBUG("Starting thread for client " << peer_hash_id << " from " << peer_address);
-        add_managed_thread(std::thread(&RatsClient::handle_client, this, client_socket, peer_hash_id), 
-                          "client-handler-" + peer_hash_id.substr(0, 8));
+        poller_add(client, PollIn);
         
-        // Note: Connection callback will be called after handshake completion in handle_client
+        LOG_SERVER_INFO("Accepted incoming connection from " << normalized << " (id: " << initial_id.substr(0, 8) << "…)");
     }
-    
-    LOG_SERVER_INFO("Server loop ended");
 }
 
-void RatsClient::management_loop() {
-    LOG_CLIENT_INFO("Management loop started");
-    
-    auto last_thread_cleanup = std::chrono::steady_clock::now();
-    const auto thread_cleanup_interval = std::chrono::seconds(30);
-    
-    while (running_.load()) {
-        // Wait for 2 seconds or until shutdown (for responsive reconnection processing)
-        {
-            std::unique_lock<std::mutex> lock(shutdown_mutex_);
-            if (shutdown_cv_.wait_for(lock, std::chrono::seconds(2), [this] { return !running_.load(); })) {
-                break; // Exit if shutdown requested
-            }
-        }
-        
-        // Process reconnection queue
-        try {
-            process_reconnect_queue();
-        } catch (const std::exception& e) {
-            LOG_CLIENT_ERROR("Exception during reconnect queue processing: " << e.what());
-        }
-        
-        // Periodically cleanup finished threads (every 30 seconds)
-        auto now = std::chrono::steady_clock::now();
-        if (now - last_thread_cleanup >= thread_cleanup_interval) {
-            try {
-                cleanup_finished_threads();
-                LOG_CLIENT_DEBUG("Periodic thread cleanup completed. Active threads: " << get_active_thread_count());
-            } catch (const std::exception& e) {
-                LOG_CLIENT_ERROR("Exception during thread cleanup: " << e.what());
-            }
-            last_thread_cleanup = now;
-        }
-    }
-    
-    LOG_CLIENT_INFO("Management loop ended");
-}
-
-
-void RatsClient::handle_client(socket_t client_socket, const std::string& peer_hash_id) {
-    LOG_CLIENT_INFO("Started handling client: " << peer_hash_id);
+// ---------------------------------------------------------------------------
+// handle_readable – drain kernel buffer, parse length-prefixed frames
+// Returns true if the peer should be disconnected.
+// ---------------------------------------------------------------------------
+bool RatsClient::handle_readable(socket_t socket) {
+    // ── Phase 1: drain data & extract complete frames under lock ──────────
+    struct PendingFrame {
+        std::vector<uint8_t> data;
+        RatsPeer::HandshakeState state;
+        std::string peer_id;
+        bool noise_encrypted;
+        std::shared_ptr<rats::NoiseCipherState> recv_cipher;
+    };
     
-    // ===== INITIALIZATION =====
-    bool handshake_completed = false;
-    bool noise_handshake_done = false;
-    bool encryption_enabled = is_encryption_enabled();
-    bool is_outgoing = false;
-    auto last_timeout_check = std::chrono::steady_clock::now();
+    std::vector<PendingFrame> frames;
+    bool peer_closed = false;
+    bool need_post_handshake = false;
+    RatsPeer peer_copy_for_post_handshake;
     
     {
         std::lock_guard<std::mutex> lock(peers_mutex_);
-        auto sock_it = socket_to_peer_id_.find(client_socket);
-        if (sock_it != socket_to_peer_id_.end()) {
-            auto peer_it = peers_.find(sock_it->second);
-            if (peer_it != peers_.end()) {
-                is_outgoing = peer_it->second.is_outgoing;
+        auto peer_it = find_peer_by_socket_unlocked(socket);
+        if (peer_it == peers_.end()) return true;
+        
+        RatsPeer& peer = peer_it->second;
+        auto& recv_buf = peer.io_.recv_buffer;
+        
+        // Non-blocking recv loop
+        while (true) {
+            recv_buf.ensure_space(16384);
+            int bytes = ::recv(socket,
+                               reinterpret_cast<char*>(recv_buf.write_ptr()),
+                               static_cast<int>(recv_buf.write_space()), 0);
+            
+            if (bytes > 0) {
+                recv_buf.received(static_cast<size_t>(bytes));
+                continue;
             }
-        }
-    }
-    
-    // ===== SEND INITIAL HANDSHAKE FOR OUTGOING CONNECTIONS =====
-    if (is_outgoing) {
-        LOG_CLIENT_DEBUG("Sending initial handshake for outgoing connection to " << peer_hash_id);
-        if (!send_handshake(client_socket, get_our_peer_id())) {
-            LOG_CLIENT_ERROR("Failed to send initial handshake for outgoing connection to " << peer_hash_id);
-            remove_peer(client_socket);
-            close_socket(client_socket);
-            return;
-        }
-    }
-    
-    // ===== MAIN LOOP =====
-    while (running_.load()) {
-        
-        // ----- 1. RECEIVE DATA -----
-        LOG_CLIENT_DEBUG("Receiving data from socket " << client_socket);
-        std::vector<uint8_t> received_bytes = receive_tcp_message_framed(client_socket);
-        
-        if (received_bytes.empty()) {
-            break; // Connection closed or error
+            if (bytes == 0) { peer_closed = true; break; }
+            
+#ifdef _WIN32
+            if (WSAGetLastError() == WSAEWOULDBLOCK) break;
+#else
+            if (errno == EAGAIN || errno == EWOULDBLOCK) break;
+#endif
+            peer_closed = true;
+            break;
         }
         
-        // ----- 2. DECRYPT IF NEEDED -----
-        // Use vector directly to avoid unnecessary string conversions
-        std::vector<uint8_t> data;
+        if (peer_closed && recv_buf.empty()) return true;
         
-        if (noise_handshake_done) {
-            std::string current_peer_id;
-            rats::NoiseCipherState* recv_cipher = nullptr;
+        // Parse length-prefixed frames:  [4-byte network-order length][payload]
+        while (recv_buf.size() >= 4) {
+            uint32_t net_len;
+            memcpy(&net_len, recv_buf.data(), 4);
+            uint32_t msg_len = ntohl(net_len);
             
-            {
-                std::lock_guard<std::mutex> lock(peers_mutex_);
-                auto sock_it = socket_to_peer_id_.find(client_socket);
-                if (sock_it != socket_to_peer_id_.end()) {
-                    auto peer_it = peers_.find(sock_it->second);
-                    if (peer_it != peers_.end() && peer_it->second.is_noise_encrypted()) {
-                        recv_cipher = peer_it->second.recv_cipher.get();
-                        current_peer_id = peer_it->second.peer_id;
-                    }
-                }
+            if (msg_len > MAX_FRAME_SIZE) {
+                LOG_CLIENT_ERROR("Frame too large (" << msg_len << " bytes) from " << peer.peer_id);
+                return true;
             }
+            if (recv_buf.size() < 4 + msg_len) break; // incomplete frame
             
-            if (recv_cipher) {
-                if (received_bytes.size() < rats::NOISE_TAG_SIZE) {
-                    LOG_CLIENT_ERROR("Received encrypted message too small from " << current_peer_id);
-                    break;
-                }
-                
-                std::vector<uint8_t> plaintext(received_bytes.size());
-                size_t pt_len = recv_cipher->decrypt_with_ad(
-                    nullptr, 0,
-                    received_bytes.data(), received_bytes.size(),
-                    plaintext.data()
-                );
+            // Handle Noise handshake messages inline (fast crypto, no callbacks)
+            if (peer.handshake_state == RatsPeer::HandshakeState::NOISE_PENDING) {
+                if (!handle_noise_frame(peer)) return true;
+                recv_buf.consume(4 + msg_len);
                 
-                if (pt_len == 0) {
-                    LOG_CLIENT_ERROR("Failed to decrypt message from " << current_peer_id << " - closing connection");
-                    break;
+                // Check if Noise just completed
+                if (peer.handshake_state == RatsPeer::HandshakeState::COMPLETED) {
+                    need_post_handshake = true;
+                    peer_copy_for_post_handshake = peer;
                 }
-                
-                plaintext.resize(pt_len);
-                data = std::move(plaintext);
-                LOG_CLIENT_DEBUG("Decrypted message from " << current_peer_id << " (" << pt_len << " bytes)");
-            } else {
-                data = std::move(received_bytes);
-            }
-        } else {
-            data = std::move(received_bytes);
-        }
-        
-        // Log first 50 bytes for debugging
-        size_t log_len = (std::min)(data.size(), static_cast<size_t>(50));
-        LOG_CLIENT_DEBUG("Received data from " << peer_hash_id << ": " << std::string(data.begin(), data.begin() + log_len) << (data.size() > 50 ? "..." : ""));
-        
-        // ----- 3. CONNECTION STATE CHECK (during handshake phase only) -----
-        if (!handshake_completed) {
-            auto now = std::chrono::steady_clock::now();
-            if (now - last_timeout_check >= std::chrono::seconds(1)) {
-                check_handshake_timeouts();
-                last_timeout_check = now;
+                continue;
             }
             
-            // Check for handshake failure
-            bool handshake_failed = false;
-            {
-                std::lock_guard<std::mutex> lock(peers_mutex_);
-                auto sock_it = socket_to_peer_id_.find(client_socket);
-                if (sock_it != socket_to_peer_id_.end()) {
-                    auto peer_it = peers_.find(sock_it->second);
-                    if (peer_it != peers_.end() && peer_it->second.is_handshake_failed()) {
-                        handshake_failed = true;
-                    }
-                }
-            }
+            // Snapshot state for out-of-lock processing
+            PendingFrame pf;
+            pf.data.assign(recv_buf.data() + 4, recv_buf.data() + 4 + msg_len);
+            pf.state = peer.handshake_state;
+            pf.peer_id = peer.peer_id;
+            pf.noise_encrypted = peer.is_noise_encrypted();
+            if (pf.noise_encrypted) pf.recv_cipher = peer.recv_cipher;
             
-            if (handshake_failed) {
-                LOG_CLIENT_ERROR("Handshake failed for peer " << peer_hash_id);
-                break;
-            }
+            frames.push_back(std::move(pf));
+            recv_buf.consume(4 + msg_len);
         }
         
-        // ----- 4. HANDSHAKE PHASE -----
-        // Only check for handshake messages BEFORE handshake is completed
-        // This avoids expensive JSON parsing on every message after handshake
-        if (!handshake_completed && is_handshake_message(data)) {
-            if (!handle_handshake_message(client_socket, peer_hash_id, data)) {
-                LOG_CLIENT_ERROR("Failed to handle handshake message from " << peer_hash_id);
-                break;
-            }
-            
-            // Check if rats handshake just completed (COMPLETED or NOISE_PENDING state)
-            if (!handshake_completed) {
-                RatsPeer peer_copy;
-                bool rats_handshake_done = false;
-                bool needs_noise_handshake = false;
+        // Compact if >32KB wasted at front
+        if (recv_buf.front_waste() > 32768) recv_buf.normalize();
+    }
+    // ── peers_mutex_ released ────────────────────────────────────────────
+    
+    // Deferred post-handshake completion (includes callbacks – must be outside mutex)
+    if (need_post_handshake) {
+        handle_post_handshake_completion(socket, peer_copy_for_post_handshake);
+    }
+    
+    // ── Phase 2: process frames outside lock ─────────────────────────────
+    for (auto& pf : frames) {
+        // Handshake phase – RATS JSON handshake messages
+        if (pf.state != RatsPeer::HandshakeState::COMPLETED) {
+            if (is_handshake_message(pf.data)) {
+                if (!handle_handshake_message(socket, pf.peer_id, pf.data)) {
+                    return true;
+                }
                 
+                // Check if handshake just completed and handle Noise / post-handshake
+                bool do_post_handshake = false;
+                RatsPeer post_hs_copy;
                 {
                     std::lock_guard<std::mutex> lock(peers_mutex_);
-                    auto sock_it = socket_to_peer_id_.find(client_socket);
-                    if (sock_it != socket_to_peer_id_.end()) {
-                        auto peer_it = peers_.find(sock_it->second);
-                        if (peer_it != peers_.end()) {
-                            // Check if rats handshake completed (either COMPLETED or NOISE_PENDING)
-                            if (peer_it->second.is_handshake_completed()) {
-                                rats_handshake_done = true;
-                                peer_copy = peer_it->second;
-                            } else if (peer_it->second.handshake_state == RatsPeer::HandshakeState::NOISE_PENDING) {
-                                rats_handshake_done = true;
-                                needs_noise_handshake = true;
-                                peer_copy = peer_it->second;
-                            }
-                        }
-                    }
-                }
-                
-                // ----- POST-HANDSHAKE ACTIONS -----
-                if (rats_handshake_done) {
-                    LOG_CLIENT_INFO("Rats handshake completed for peer " << peer_hash_id << " (peer_id: " << peer_copy.peer_id << ")");
-                    
-                    // Remove from reconnection queue if present (successful connection)
-                    remove_from_reconnect_queue(peer_copy.peer_id);
-                    
-                    // Noise encryption handshake - only if BOTH sides support encryption
-                    // peer_copy.encryption_enabled is already negotiated in handle_handshake_message()
-                    if (needs_noise_handshake) {
-                        LOG_CLIENT_INFO("Starting Noise handshake for peer " << peer_copy.peer_id);
-                        if (perform_noise_handshake(client_socket, peer_copy.peer_id, peer_copy.is_outgoing)) {
-                            noise_handshake_done = true;
-                            LOG_CLIENT_INFO("Noise handshake successful for peer " << peer_copy.peer_id);
-                            
-                            // Update state to COMPLETED after successful Noise handshake
-                            {
-                                std::lock_guard<std::mutex> lock(peers_mutex_);
-                                auto sock_it = socket_to_peer_id_.find(client_socket);
-                                if (sock_it != socket_to_peer_id_.end()) {
-                                    auto peer_it = peers_.find(sock_it->second);
-                                    if (peer_it != peers_.end()) {
-                                        peer_it->second.handshake_state = RatsPeer::HandshakeState::COMPLETED;
-                                        log_handshake_completion_unlocked(peer_it->second);
-                                    }
-                                }
-                            }
-                        } else {
-                            LOG_CLIENT_ERROR("Noise handshake failed for peer " << peer_copy.peer_id);
-                            // Connection will be closed due to failed Noise handshake
-                            break;
-                        }
-                    }
-                    
-                    handshake_completed = true;
+                    auto peer_it = find_peer_by_socket_unlocked(socket);
+                    if (peer_it == peers_.end()) return true;
+                    RatsPeer& peer = peer_it->second;
                     
-                    // Connection callback
-                    if (connection_callback_) {
-                        connection_callback_(client_socket, peer_copy.peer_id);
-                    }
-                    
-                    // GossipSub notification
-                    if (gossipsub_) {
-                        gossipsub_->handle_peer_connected(peer_copy.peer_id);
-                    }
-                    
-#ifdef RATS_STORAGE
-                    // Storage manager notification
-                    if (storage_manager_) {
-                        storage_manager_->on_peer_connected(peer_copy.peer_id);
-                    }
-#endif
-                    
-                    // Peer exchange broadcast
-                    broadcast_peer_exchange_message(peer_copy);
-                    
-                    // Request peers from newly connected peer (outgoing only)
-                    if (peer_copy.is_outgoing) {
-                        send_peers_request(client_socket, peer_copy.peer_id);
-                    }
-                    
-                    // Save configuration
-                    if (running_.load()) {
-                        add_managed_thread(std::thread([this]() {
-                            if (running_.load()) {
-                                save_configuration();
-                            }
-                        }), "config-save");
+                    if (peer.handshake_state == RatsPeer::HandshakeState::NOISE_PENDING) {
+                        start_noise_handshake_async(peer);
+                    } else if (peer.handshake_state == RatsPeer::HandshakeState::COMPLETED) {
+                        post_hs_copy = peer;
+                        do_post_handshake = true;
                     }
                 }
+                // peers_mutex_ released – safe to invoke callbacks
+                if (do_post_handshake) {
+                    handle_post_handshake_completion(socket, post_hs_copy);
+                }
+            } else {
+                LOG_CLIENT_WARN("Non-handshake data from " << pf.peer_id << " before handshake – ignoring");
             }
-            
             continue;
         }
         
-        // ----- 5. DATA PROCESSING PHASE -----
-        if (!handshake_completed) {
-            LOG_CLIENT_WARN("Received non-handshake data from " << peer_hash_id << " before handshake completion - ignoring");
-            continue;
+        // Data phase – decrypt if needed, then dispatch
+        std::vector<uint8_t> plaintext;
+        if (pf.noise_encrypted && pf.recv_cipher) {
+            if (pf.data.size() < rats::NOISE_TAG_SIZE) {
+                LOG_CLIENT_ERROR("Encrypted frame too small from " << pf.peer_id);
+                return true;
+            }
+            plaintext.resize(pf.data.size());
+            size_t pt_len = pf.recv_cipher->decrypt_with_ad(
+                nullptr, 0, pf.data.data(), pf.data.size(), plaintext.data());
+            if (pt_len == 0) {
+                LOG_CLIENT_ERROR("Decryption failed from " << pf.peer_id);
+                return true;
+            }
+            plaintext.resize(pt_len);
+        } else {
+            plaintext = std::move(pf.data);
         }
         
-        // Use data directly - no need for extra copy
-        MessageHeader header;
-        std::vector<uint8_t> payload;
+        process_message(socket, plaintext, pf.peer_id);
+    }
+    
+    return peer_closed;
+}
+
+// ---------------------------------------------------------------------------
+// handle_writable – flush the peer's send buffer to the kernel
+// Returns true if the peer should be disconnected.
+// ---------------------------------------------------------------------------
+bool RatsClient::handle_writable(socket_t socket) {
+    std::lock_guard<std::mutex> lock(peers_mutex_);
+    auto peer_it = find_peer_by_socket_unlocked(socket);
+    if (peer_it == peers_.end()) return true;
+    
+    auto& send_buf = peer_it->second.io_.send_buffer;
+    
+    while (!send_buf.empty()) {
+        int bytes = ::send(socket,
+                            reinterpret_cast<const char*>(send_buf.front_data()),
+                            static_cast<int>(send_buf.front_size()),
+#ifdef _WIN32
+                            0
+#else
+                            MSG_NOSIGNAL
+#endif
+        );
         
-        if (!parse_message_with_header(data, header, payload)) {
-            LOG_CLIENT_WARN("No header found in message from " << peer_hash_id);
+        if (bytes > 0) {
+            send_buf.pop_front(static_cast<size_t>(bytes));
             continue;
         }
         
-        std::string peer_id = get_peer_id(client_socket);
-        
-        switch (header.type) {
-            case MessageDataType::BINARY: {
-                LOG_CLIENT_DEBUG("Received BINARY message from " << peer_id << " (payload size: " << payload.size() << ")");
-                bool handled = false;
-                if (file_transfer_manager_) {
-                    handled = file_transfer_manager_->handle_binary_data(peer_id, payload);
-                }
-                if (!handled && binary_data_callback_) {
-                    binary_data_callback_(client_socket, peer_id, payload);
-                }
-                break;
-            }
-            
-            case MessageDataType::STRING: {
-                LOG_CLIENT_DEBUG("Received STRING message from " << peer_id << " (payload size: " << payload.size() << ")");
-                if (string_data_callback_) {
-                    std::string string_data(payload.begin(), payload.end());
-                    string_data_callback_(client_socket, peer_id, string_data);
-                }
-                break;
-            }
-            
-            case MessageDataType::JSON: {
-                LOG_CLIENT_DEBUG("Received JSON message from " << peer_id << " (payload size: " << payload.size() << ")");
-                std::string json_string(payload.begin(), payload.end());
-                nlohmann::json json_msg;
-                if (parse_json_message(json_string, json_msg)) {
-                    if (json_msg.contains("rats_protocol") && json_msg["rats_protocol"] == true) {
-                        handle_rats_message(client_socket, peer_id, json_msg);
-                    } else if (json_data_callback_) {
-                        json_data_callback_(client_socket, peer_id, json_msg);
-                    }
-                } else {
-                    LOG_CLIENT_ERROR("Received invalid JSON in JSON message from " << peer_id);
-                }
-                break;
-            }
-            
-            default:
-                LOG_CLIENT_WARN("Received message with unknown data type " << static_cast<int>(header.type) << " from " << peer_id);
-                break;
+        if (bytes < 0) {
+#ifdef _WIN32
+            if (WSAGetLastError() == WSAEWOULDBLOCK) break;
+#else
+            if (errno == EAGAIN || errno == EWOULDBLOCK) break;
+#endif
+            LOG_CLIENT_ERROR("Send error on socket " << socket);
+            return true;
         }
         
-    } // end while
+        // bytes == 0 — shouldn't happen on a stream socket
+        break;
+    }
     
-    // ===== CLEANUP =====
-    std::string current_peer_id = get_peer_id(client_socket);
+    // If buffer fully flushed, stop watching for PollOut
+    if (send_buf.empty()) {
+        std::lock_guard<std::mutex> io_lock(io_mutex_);
+        if (poller_) poller_->modify(socket, PollIn);
+    }
     
-    // Save peer info for potential reconnection BEFORE removing from peers list
+    return false;
+}
+
+// ---------------------------------------------------------------------------
+// handle_disconnect – clean up peer on error / hangup / close
+// ---------------------------------------------------------------------------
+void RatsClient::handle_disconnect(socket_t socket) {
+    // Gather info before removing
+    std::string peer_id;
+    bool was_validated = false;
     RatsPeer peer_copy_for_reconnect;
     bool should_schedule_reconnect = false;
     
-    if (handshake_completed) {
+    {
         std::lock_guard<std::mutex> lock(peers_mutex_);
-        auto sock_it = socket_to_peer_id_.find(client_socket);
-        if (sock_it != socket_to_peer_id_.end()) {
-            auto peer_it = peers_.find(sock_it->second);
-            if (peer_it != peers_.end()) {
-                peer_copy_for_reconnect = peer_it->second;
-                should_schedule_reconnect = true;
-            }
+        auto peer_it = find_peer_by_socket_unlocked(socket);
+        if (peer_it == peers_.end()) {
+            // Already removed
+            poller_remove(socket);
+            close_socket(socket);
+            return;
+        }
+        peer_id = peer_it->second.peer_id;
+        was_validated = peer_it->second.is_handshake_completed();
+        if (was_validated) {
+            peer_copy_for_reconnect = peer_it->second;
+            should_schedule_reconnect = true;
         }
     }
     
-    remove_peer(client_socket);
-    close_socket(client_socket);
+    // Remove from poller, peers map, close socket
+    poller_remove(socket);
+    remove_peer(socket);
+    close_socket(socket);
     
-    if (handshake_completed) {
+    if (was_validated) {
         if (disconnect_callback_) {
-            disconnect_callback_(client_socket, current_peer_id);
+            disconnect_callback_(socket, peer_id);
         }
-        
         if (gossipsub_) {
-            gossipsub_->handle_peer_disconnected(current_peer_id);
+            gossipsub_->handle_peer_disconnected(peer_id);
         }
-        
-        // Schedule reconnection if we have valid peer info
         if (should_schedule_reconnect && running_.load()) {
             schedule_reconnect(peer_copy_for_reconnect);
         }
-        
         if (running_.load()) {
             add_managed_thread(std::thread([this]() {
-                if (running_.load()) {
-                    save_configuration();
-                }
+                if (running_.load()) save_configuration();
             }), "config-save-disconnect");
         }
     }
     
-    LOG_CLIENT_INFO("Client disconnected: " << peer_hash_id);
+    LOG_CLIENT_INFO("Peer disconnected: " << peer_id);
+}
+
+// ---------------------------------------------------------------------------
+// Poller registration helpers (thread-safe via io_mutex_)
+// ---------------------------------------------------------------------------
+void RatsClient::poller_add(socket_t fd, uint32_t events) {
+    std::lock_guard<std::mutex> lock(io_mutex_);
+    if (poller_) poller_->add(fd, events);
+}
+
+void RatsClient::poller_modify(socket_t fd, uint32_t events) {
+    std::lock_guard<std::mutex> lock(io_mutex_);
+    if (poller_) poller_->modify(fd, events);
+}
+
+void RatsClient::poller_remove(socket_t fd) {
+    std::lock_guard<std::mutex> lock(io_mutex_);
+    if (poller_) poller_->remove(fd);
+}
+
+// ---------------------------------------------------------------------------
+// enqueue_message – build a length-prefixed frame and append to send buffer
+// ---------------------------------------------------------------------------
+bool RatsClient::enqueue_message(socket_t socket, const std::vector<uint8_t>& data) {
+    std::lock_guard<std::mutex> lock(peers_mutex_);
+    auto peer_it = find_peer_by_socket_unlocked(socket);
+    if (peer_it == peers_.end()) return false;
+    return enqueue_message_unlocked(peer_it->second, data);
+}
+
+bool RatsClient::enqueue_message_unlocked(RatsPeer& peer, const std::vector<uint8_t>& data) {
+    // Build length-prefixed frame:  [4-byte network-order length][payload]
+    uint32_t net_len = htonl(static_cast<uint32_t>(data.size()));
+    
+    std::vector<uint8_t> frame;
+    frame.reserve(4 + data.size());
+    frame.insert(frame.end(),
+                 reinterpret_cast<const uint8_t*>(&net_len),
+                 reinterpret_cast<const uint8_t*>(&net_len) + 4);
+    frame.insert(frame.end(), data.begin(), data.end());
+    
+    peer.io_.send_buffer.append(std::move(frame));
+    
+    // Arm PollOut so io_loop flushes the buffer
+    {
+        std::lock_guard<std::mutex> io_lock(io_mutex_);
+        if (poller_) poller_->modify(peer.socket, PollIn | PollOut);
+    }
+    
+    return true;
+}
+
+void RatsClient::management_loop() {
+    LOG_CLIENT_INFO("Management loop started");
+    
+    auto last_thread_cleanup = std::chrono::steady_clock::now();
+    const auto thread_cleanup_interval = std::chrono::seconds(THREAD_CLEANUP_INTERVAL_SECONDS);
+    
+    while (running_.load()) {
+        // Wait for interval or until shutdown (for responsive reconnection processing)
+        {
+            std::unique_lock<std::mutex> lock(shutdown_mutex_);
+            if (shutdown_cv_.wait_for(lock, std::chrono::seconds(MANAGEMENT_LOOP_INTERVAL_SECONDS), [this] { return !running_.load(); })) {
+                break; // Exit if shutdown requested
+            }
+        }
+        
+        // Check handshake timeouts (centralized, runs once for all peers)
+        try {
+            check_handshake_timeouts();
+        } catch (const std::exception& e) {
+            LOG_CLIENT_ERROR("Exception during handshake timeout check: " << e.what());
+        }
+        
+        // Process reconnection queue
+        try {
+            process_reconnect_queue();
+        } catch (const std::exception& e) {
+            LOG_CLIENT_ERROR("Exception during reconnect queue processing: " << e.what());
+        }
+        
+        // Periodically cleanup finished threads (every 30 seconds)
+        auto now = std::chrono::steady_clock::now();
+        if (now - last_thread_cleanup >= thread_cleanup_interval) {
+            try {
+                cleanup_finished_threads();
+                LOG_CLIENT_DEBUG("Periodic thread cleanup completed. Active threads: " << get_active_thread_count());
+            } catch (const std::exception& e) {
+                LOG_CLIENT_ERROR("Exception during thread cleanup: " << e.what());
+            }
+            last_thread_cleanup = now;
+        }
+    }
+    
+    LOG_CLIENT_INFO("Management loop ended");
+}
+
+void RatsClient::handle_post_handshake_completion(socket_t socket, const RatsPeer& peer_copy) {
+    // Remove from reconnection queue (successful connection)
+    remove_from_reconnect_queue(peer_copy.peer_id);
+    
+    // Connection callback
+    if (connection_callback_) {
+        connection_callback_(socket, peer_copy.peer_id);
+    }
+    
+    // GossipSub notification
+    if (gossipsub_) {
+        gossipsub_->handle_peer_connected(peer_copy.peer_id);
+    }
+    
+#ifdef RATS_STORAGE
+    // Storage manager notification
+    if (storage_manager_) {
+        storage_manager_->on_peer_connected(peer_copy.peer_id);
+    }
+#endif
+    
+    // Peer exchange broadcast
+    broadcast_peer_exchange_message(peer_copy);
+    
+    // Request peers from newly connected peer (outgoing only)
+    if (peer_copy.is_outgoing) {
+        send_peers_request(socket, peer_copy.peer_id);
+    }
+    
+    // Save configuration
+    if (running_.load()) {
+        add_managed_thread(std::thread([this]() {
+            if (running_.load()) {
+                save_configuration();
+            }
+        }), "config-save");
+    }
+}
+
+void RatsClient::process_message(socket_t socket, const std::vector<uint8_t>& data, const std::string& initial_peer_id) {
+    MessageHeader header;
+    std::vector<uint8_t> payload;
+    
+    if (!parse_message_with_header(data, header, payload)) {
+        LOG_CLIENT_WARN("No header found in message from " << initial_peer_id);
+        return;
+    }
+    
+    std::string peer_id = get_peer_id(socket);
+    
+    switch (header.type) {
+        case MessageDataType::BINARY: {
+            LOG_CLIENT_DEBUG("Received BINARY message from " << peer_id << " (payload size: " << payload.size() << ")");
+            bool handled = false;
+            if (file_transfer_manager_) {
+                handled = file_transfer_manager_->handle_binary_data(peer_id, payload);
+            }
+            if (!handled && binary_data_callback_) {
+                binary_data_callback_(socket, peer_id, payload);
+            }
+            break;
+        }
+        
+        case MessageDataType::STRING: {
+            LOG_CLIENT_DEBUG("Received STRING message from " << peer_id << " (payload size: " << payload.size() << ")");
+            if (string_data_callback_) {
+                std::string string_data(payload.begin(), payload.end());
+                string_data_callback_(socket, peer_id, string_data);
+            }
+            break;
+        }
+        
+        case MessageDataType::JSON: {
+            LOG_CLIENT_DEBUG("Received JSON message from " << peer_id << " (payload size: " << payload.size() << ")");
+            try {
+                nlohmann::json json_msg = nlohmann::json::parse(payload.begin(), payload.end());
+                if (json_msg.contains("rats_protocol") && json_msg["rats_protocol"] == true) {
+                    handle_rats_message(socket, peer_id, json_msg);
+                } else if (json_data_callback_) {
+                    json_data_callback_(socket, peer_id, json_msg);
+                }
+            } catch (const nlohmann::json::exception& e) {
+                LOG_CLIENT_ERROR("Received invalid JSON in JSON message from " << peer_id << ": " << e.what());
+            }
+            break;
+        }
+        
+        default:
+            LOG_CLIENT_WARN("Received message with unknown data type " << static_cast<int>(header.type) << " from " << peer_id);
+            break;
+    }
 }
 
 // Handshake protocol implementation
@@ -844,9 +945,8 @@ bool RatsClient::validate_handshake_message(const HandshakeMessage& msg) const {
         auto now = std::chrono::high_resolution_clock::now();
         auto current_timestamp = std::chrono::duration_cast<std::chrono::milliseconds>(now.time_since_epoch()).count();
         int64_t time_diff = std::abs(current_timestamp - msg.timestamp);
-        const int64_t allowed_skew_ms = 10LL * 60LL * 1000LL; // 10 minutes tolerance
-        if (time_diff > allowed_skew_ms) {
-            LOG_CLIENT_WARN("Handshake timestamp skew " << time_diff << "ms exceeds " << allowed_skew_ms << "ms; accepting to be tolerant of clock skew");
+        if (time_diff > TIMESTAMP_SKEW_TOLERANCE_MS) {
+            LOG_CLIENT_WARN("Handshake timestamp skew " << time_diff << "ms exceeds " << TIMESTAMP_SKEW_TOLERANCE_MS << "ms; accepting to be tolerant of clock skew");
         }
     }
     
@@ -882,52 +982,32 @@ bool RatsClient::is_handshake_message(const std::vector<uint8_t>& data) const {
     }
 }
 
-// Add this private helper function before send_handshake
-bool RatsClient::send_handshake_unlocked(socket_t socket, const std::string& our_peer_id) {
+bool RatsClient::send_handshake_unlocked(RatsPeer& peer, const std::string& our_peer_id) {
     std::string handshake_msg = create_handshake_message("handshake", our_peer_id);
-    LOG_CLIENT_DEBUG("Sending handshake to socket " << socket << ": " << handshake_msg);
+    LOG_CLIENT_DEBUG("Sending handshake to " << peer.peer_id << ": " << handshake_msg);
     
-    // Send handshake directly without going through send_binary_to_peer
-    // (which would cause deadlock by trying to lock peers_mutex_ again).
-    // Handshakes are always unencrypted since they happen before noise handshake.
+    // Handshakes are always unencrypted – enqueue into the peer's send buffer
     std::vector<uint8_t> binary_data(handshake_msg.begin(), handshake_msg.end());
     std::vector<uint8_t> message_with_header = create_message_with_header(binary_data, MessageDataType::STRING);
     
-    // Get socket-specific mutex for thread-safe sending
-    auto socket_mutex = get_socket_send_mutex(socket);
-    std::lock_guard<std::mutex> send_lock(*socket_mutex);
-    
-    int sent = send_tcp_message_framed(socket, message_with_header);
-    if (sent <= 0) {
-        LOG_CLIENT_ERROR("Failed to send handshake to socket " << socket);
+    if (!enqueue_message_unlocked(peer, message_with_header)) {
+        LOG_CLIENT_ERROR("Failed to enqueue handshake for " << peer.peer_id);
         return false;
     }
     
-    // Update peer state (assumes peers_mutex_ is already locked)
-    auto it = socket_to_peer_id_.find(socket);
-    if (it != socket_to_peer_id_.end()) {
-        auto peer_it = peers_.find(it->second);
-        if (peer_it != peers_.end()) {
-            peer_it->second.handshake_state = RatsPeer::HandshakeState::SENT;
-            peer_it->second.handshake_start_time = std::chrono::steady_clock::now();
-        }
-    }
+    peer.handshake_state = RatsPeer::HandshakeState::SENT;
+    peer.handshake_start_time = std::chrono::steady_clock::now();
     
     return true;
 }
 
-bool RatsClient::send_handshake(socket_t socket, const std::string& our_peer_id) {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    return send_handshake_unlocked(socket, our_peer_id);
-}
-
-bool RatsClient::handle_handshake_message(socket_t socket, const std::string& peer_hash_id, const std::vector<uint8_t>& data) {
+bool RatsClient::handle_handshake_message(socket_t socket, const std::string& initial_peer_id, const std::vector<uint8_t>& data) {
     // Extract JSON payload from message header
     MessageHeader header;
     std::vector<uint8_t> payload;
     
     if (!parse_message_with_header(data, header, payload)) {
-        LOG_CLIENT_ERROR("Failed to parse handshake message header from " << peer_hash_id);
+        LOG_CLIENT_ERROR("Failed to parse handshake message header from " << initial_peer_id);
         return false;
     }
     
@@ -940,12 +1020,12 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
     // Parse handshake message directly from payload (no string conversion)
     HandshakeMessage handshake_msg;
     if (!parse_handshake_message(payload, handshake_msg)) {
-        LOG_CLIENT_ERROR("Failed to parse handshake message from " << peer_hash_id);
+        LOG_CLIENT_ERROR("Failed to parse handshake message from " << initial_peer_id);
         return false;
     }
     
     if (!validate_handshake_message(handshake_msg)) {
-        LOG_CLIENT_ERROR("Invalid handshake message from " << peer_hash_id);
+        LOG_CLIENT_ERROR("Invalid handshake message from " << initial_peer_id);
         return false;
     }
 
@@ -954,19 +1034,13 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
         return false;
     }
     
-    LOG_CLIENT_INFO("Received valid handshake from " << peer_hash_id 
+    LOG_CLIENT_INFO("Received valid handshake from " << initial_peer_id 
                     << " (peer_id: " << handshake_msg.peer_id << ")");
     
     std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = socket_to_peer_id_.find(socket);
-    if (it == socket_to_peer_id_.end()) {
-        LOG_CLIENT_ERROR("Socket " << socket << " not found in peer mapping");
-        return false;
-    }
-    
-    auto peer_it = peers_.find(it->second);
+    auto peer_it = find_peer_by_socket_unlocked(socket);
     if (peer_it == peers_.end()) {
-        LOG_CLIENT_ERROR("Peer " << peer_hash_id << " not found in peers");
+        LOG_CLIENT_ERROR("Peer " << initial_peer_id << " not found for socket " << socket);
         return false;
     }
 
@@ -982,22 +1056,18 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
     
     // Update peer mappings with new peer_id if it changed
     if (old_peer_id != handshake_msg.peer_id) {
-        // Create a copy of the peer object before erasing it.
-        RatsPeer peer_copy = peer_it->second;
-        
-        // Erase the old entry from the main peers map.
+        // Move the peer (preserves io_ context with send/recv buffers)
+        RatsPeer peer_moved = std::move(peer_it->second);
         peers_.erase(peer_it);
         
-        // Update the peer_id within the copied object.
-        peer_copy.peer_id = handshake_msg.peer_id;
+        peer_moved.peer_id = handshake_msg.peer_id;
         
-        // Insert the updated peer object back into the maps with the new peer_id.
-        peers_[peer_copy.peer_id] = peer_copy;
-        socket_to_peer_id_[socket] = peer_copy.peer_id;
-        address_to_peer_id_[peer_copy.normalized_address] = peer_copy.peer_id;
-
-        // Find the iterator for the newly inserted peer.
-        peer_it = peers_.find(peer_copy.peer_id);
+        // Use emplace to avoid extra copy/move
+        auto [new_it, ok] = peers_.emplace(peer_moved.peer_id, std::move(peer_moved));
+        socket_to_peer_id_[socket] = new_it->second.peer_id;
+        address_to_peer_id_[new_it->second.normalized_address] = new_it->second.peer_id;
+        
+        peer_it = new_it;
     }
 
     RatsPeer& peer = peer_it->second;
@@ -1034,14 +1104,15 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
     // Simplified handshake logic - just one message type
     if (peer.handshake_state == RatsPeer::HandshakeState::PENDING) {
         // This is an incoming handshake - send our handshake back
-        if (send_handshake_unlocked(socket, get_our_peer_id())) {
+        if (send_handshake_unlocked(peer, get_our_peer_id())) {
             // If encryption is enabled, we need to do Noise handshake first
             // Set NOISE_PENDING to prevent other threads from sending messages
             if (peer.encryption_enabled) {
                 peer.handshake_state = RatsPeer::HandshakeState::NOISE_PENDING;
-                LOG_CLIENT_DEBUG("Rats handshake done, entering NOISE_PENDING state for " << peer_hash_id);
+                LOG_CLIENT_DEBUG("Rats handshake done, entering NOISE_PENDING state for " << initial_peer_id);
             } else {
                 peer.handshake_state = RatsPeer::HandshakeState::COMPLETED;
+                validated_peer_count_.fetch_add(1, std::memory_order_relaxed);
                 log_handshake_completion_unlocked(peer);
             }
             
@@ -1051,7 +1122,7 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
             return true;
         } else {
             peer.handshake_state = RatsPeer::HandshakeState::FAILED;
-            LOG_CLIENT_ERROR("Failed to send handshake response to " << peer_hash_id);
+            LOG_CLIENT_ERROR("Failed to send handshake response to " << initial_peer_id);
             return false;
         }
     } else if (peer.handshake_state == RatsPeer::HandshakeState::SENT) {
@@ -1060,9 +1131,10 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
         // Set NOISE_PENDING to prevent other threads from sending messages
         if (peer.encryption_enabled) {
             peer.handshake_state = RatsPeer::HandshakeState::NOISE_PENDING;
-            LOG_CLIENT_DEBUG("Rats handshake done, entering NOISE_PENDING state for " << peer_hash_id);
+            LOG_CLIENT_DEBUG("Rats handshake done, entering NOISE_PENDING state for " << initial_peer_id);
         } else {
             peer.handshake_state = RatsPeer::HandshakeState::COMPLETED;
+            validated_peer_count_.fetch_add(1, std::memory_order_relaxed);
             log_handshake_completion_unlocked(peer);
         }
         
@@ -1071,7 +1143,7 @@ bool RatsClient::handle_handshake_message(socket_t socket, const std::string& pe
         
         return true;
     } else {
-        LOG_CLIENT_WARN("Received handshake from " << peer_hash_id << " but handshake state is " << static_cast<int>(peer.handshake_state));
+        LOG_CLIENT_WARN("Received handshake from " << initial_peer_id << " but handshake state is " << static_cast<int>(peer.handshake_state));
         return false;
     }
 }
@@ -1105,8 +1177,8 @@ void RatsClient::check_handshake_timeouts() {
             socket_t socket = peer_it->second.socket;
             LOG_CLIENT_INFO("Disconnecting peer " << peer_id << " due to handshake timeout");
             
-            // Clean up peer data
             remove_peer_by_id_unlocked(peer_id);
+            poller_remove(socket);
             close_socket(socket);
         }
     }
@@ -1143,70 +1215,108 @@ bool RatsClient::connect_to_peer(const std::string& host, int port) {
         return false;
     }
     
-    // Create TCP connection with timeout
-    socket_t client_socket = create_tcp_client(host, port, 10000);  // 10 second timeout
-    if (!is_valid_socket(client_socket)) {
-        LOG_CLIENT_DEBUG("Failed to connect to " << host << ":" << port);
-        return false;
-    }
-    
-    LOG_CLIENT_INFO("Successfully connected to " << host << ":" << port);
-    
-    // Generate peer hash ID
-    std::string peer_hash_id = generate_peer_hash_id(client_socket, normalized_address);
-    
-    // Create RatsPeer object for outgoing connection
-    {
-        std::lock_guard<std::mutex> lock(peers_mutex_);
-        RatsPeer new_peer(peer_hash_id, host, static_cast<uint16_t>(port), client_socket, normalized_address, true); // true = outgoing connection
-        new_peer.encryption_enabled = is_encryption_enabled();
-        add_peer_unlocked(new_peer);
-    }
-    
-    // Start a thread to handle this client
-    LOG_CLIENT_DEBUG("Starting thread for outgoing connection " << peer_hash_id);
-    add_managed_thread(std::thread(&RatsClient::handle_client, this, client_socket, peer_hash_id), 
-                      "client-handler-" + peer_hash_id.substr(0, 8));
+    // Create TCP connection with timeout (blocking connect is done on a managed thread
+    // to avoid blocking the caller, then the connected socket is handed to the IO loop).
+    add_managed_thread(std::thread([this, host, port, normalized_address]() {
+        socket_t client_socket = create_tcp_client(host, port, TCP_CONNECT_TIMEOUT_MS);
+        if (!is_valid_socket(client_socket)) {
+            LOG_CLIENT_DEBUG("Failed to connect to " << host << ":" << port);
+            return;
+        }
+        
+        LOG_CLIENT_INFO("TCP connected to " << host << ":" << port);
+        
+        // Switch to non-blocking for the IO poller
+        set_socket_nonblocking(client_socket);
+        
+        std::string initial_peer_id = generate_temporary_peer_id(client_socket, normalized_address);
+        
+        {
+            std::lock_guard<std::mutex> lock(peers_mutex_);
+            
+            // Re-check peer limit and duplicate (could have changed while connecting)
+            // NOTE: Use unlocked variant — peers_mutex_ is already held!
+            if (get_peer_count_unlocked() >= max_peers_) {
+                LOG_CLIENT_DEBUG("connect_to_peer: peer limit reached after TCP connect, aborting fd=" << client_socket);
+                close_socket(client_socket);
+                return;
+            }
+            if (address_to_peer_id_.find(normalized_address) != address_to_peer_id_.end()) {
+                LOG_CLIENT_DEBUG("connect_to_peer: duplicate address " << normalized_address << " after TCP connect, aborting fd=" << client_socket);
+                close_socket(client_socket);
+                return;
+            }
+            
+            RatsPeer new_peer(initial_peer_id, host, static_cast<uint16_t>(port), 
+                              client_socket, normalized_address, true);
+            new_peer.encryption_enabled = is_encryption_enabled();
+            add_peer_unlocked(new_peer);
+            
+            // Send initial handshake (enqueued into send buffer)
+            auto peer_it = peers_.find(initial_peer_id);
+            if (peer_it != peers_.end()) {
+                if (!send_handshake_unlocked(peer_it->second, get_our_peer_id())) {
+                    LOG_CLIENT_ERROR("Failed to enqueue handshake for outgoing connection to " << host << ":" << port);
+                    remove_peer_by_id_unlocked(initial_peer_id);
+                    close_socket(client_socket);
+                    return;
+                }
+            }
+        }
+        
+        // Register with poller – PollIn for reads, PollOut to flush the queued handshake
+        poller_add(client_socket, PollIn | PollOut);
+        
+        LOG_CLIENT_INFO("Outgoing connection to " << host << ":" << port << " registered with IO poller");
+    }), "connect-" + host + ":" + std::to_string(port));
     
     return true;
 }
 
+void RatsClient::mark_manual_disconnect(const std::string& peer_id) {
+    std::lock_guard<std::mutex> lock(reconnect_mutex_);
+    manual_disconnect_peers_.insert(peer_id);
+    reconnect_queue_.erase(peer_id);
+}
+
 void RatsClient::disconnect_peer(socket_t socket) {
-    // Mark as manually disconnected to prevent auto-reconnection
     std::string peer_id = get_peer_id(socket);
     if (!peer_id.empty()) {
-        std::lock_guard<std::mutex> lock(reconnect_mutex_);
-        manual_disconnect_peers_.insert(peer_id);
-        // Also remove from reconnection queue if present
-        reconnect_queue_.erase(peer_id);
+        mark_manual_disconnect(peer_id);
     }
-    
+    poller_remove(socket);
     remove_peer(socket);
     close_socket(socket);
 }
 
 void RatsClient::disconnect_peer_by_id(const std::string& peer_id) {
-    // Mark as manually disconnected to prevent auto-reconnection
-    {
-        std::lock_guard<std::mutex> lock(reconnect_mutex_);
-        manual_disconnect_peers_.insert(peer_id);
-        // Also remove from reconnection queue if present
-        reconnect_queue_.erase(peer_id);
-    }
-    
+    mark_manual_disconnect(peer_id);
     socket_t socket = get_peer_socket_by_id(peer_id);
     if (is_valid_socket(socket)) {
+        poller_remove(socket);
         remove_peer(socket);
         close_socket(socket);
     }
 }
 
-// Helper methods for peer management
-void RatsClient::add_peer(const RatsPeer& peer) {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    add_peer_unlocked(peer);
+// Peer lookup helpers (assumes peers_mutex_ is already locked)
+std::unordered_map<std::string, RatsPeer>::iterator RatsClient::find_peer_by_socket_unlocked(socket_t socket) {
+    auto sock_it = socket_to_peer_id_.find(socket);
+    if (sock_it != socket_to_peer_id_.end()) {
+        return peers_.find(sock_it->second);
+    }
+    return peers_.end();
 }
 
+std::unordered_map<std::string, RatsPeer>::const_iterator RatsClient::find_peer_by_socket_unlocked(socket_t socket) const {
+    auto sock_it = socket_to_peer_id_.find(socket);
+    if (sock_it != socket_to_peer_id_.end()) {
+        return peers_.find(sock_it->second);
+    }
+    return peers_.end();
+}
+
+// Helper methods for peer management
 void RatsClient::add_peer_unlocked(const RatsPeer& peer) {
     // Assumes peers_mutex_ is already locked
     peers_[peer.peer_id] = peer;
@@ -1216,17 +1326,12 @@ void RatsClient::add_peer_unlocked(const RatsPeer& peer) {
 
 void RatsClient::remove_peer(socket_t socket) {
     std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = socket_to_peer_id_.find(socket);
-    if (it != socket_to_peer_id_.end()) {
-        remove_peer_by_id_unlocked(it->second);
+    auto peer_it = find_peer_by_socket_unlocked(socket);
+    if (peer_it != peers_.end()) {
+        remove_peer_by_id_unlocked(peer_it->second.peer_id);
     }
 }
 
-void RatsClient::remove_peer_by_id(const std::string& peer_id) {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    remove_peer_by_id_unlocked(peer_id);
-}
-
 void RatsClient::remove_peer_by_id_unlocked(const std::string& peer_id) {
     // Assumes peers_mutex_ is already locked
     
@@ -1235,6 +1340,11 @@ void RatsClient::remove_peer_by_id_unlocked(const std::string& peer_id) {
     
     auto it = peers_.find(peer_id_copy);
     if (it != peers_.end()) {
+        // Decrement validated peer count if this peer had completed handshake
+        if (it->second.is_handshake_completed()) {
+            validated_peer_count_.fetch_sub(1, std::memory_order_relaxed);
+        }
+        
         // Copy the values we need before erasing to avoid use-after-free
         socket_t peer_socket = it->second.socket;
         std::string peer_normalized_address = it->second.normalized_address;
@@ -1242,9 +1352,6 @@ void RatsClient::remove_peer_by_id_unlocked(const std::string& peer_id) {
         socket_to_peer_id_.erase(peer_socket);
         address_to_peer_id_.erase(peer_normalized_address);
         peers_.erase(it);
-        
-        // Clean up socket-specific mutex
-        cleanup_socket_send_mutex(peer_socket);
     }
 }
 
@@ -1256,9 +1363,8 @@ bool RatsClient::is_already_connected_to_address(const std::string& normalized_a
 void RatsClient::add_ignored_address(const std::string& ip_address) {
     std::lock_guard<std::mutex> lock(local_addresses_mutex_);
     
-    // Check if already in the list
-    if (std::find(local_interface_addresses_.begin(), local_interface_addresses_.end(), ip_address) == local_interface_addresses_.end()) {
-        local_interface_addresses_.push_back(ip_address);
+    auto [it, inserted] = local_interface_addresses_.insert(ip_address);
+    if (inserted) {
         LOG_CLIENT_INFO("Added " << ip_address << " to ignore list");
     } else {
         LOG_CLIENT_DEBUG("IP address " << ip_address << " already in ignore list");
@@ -1266,7 +1372,7 @@ void RatsClient::add_ignored_address(const std::string& ip_address) {
 }
 
 //common localhost addresses
-static constexpr std::array<std::string_view,4> localhost_addrs{"127.0.0.1", "::1", "0.0.0.0", "::"};
+static constexpr std::array<std::string_view,5> localhost_addrs{"127.0.0.1", "::1", "0.0.0.0", "::", "localhost"};
 
 // Local interface address blocking methods
 void RatsClient::initialize_local_addresses() {
@@ -1275,13 +1381,12 @@ void RatsClient::initialize_local_addresses() {
     std::lock_guard<std::mutex> lock(local_addresses_mutex_);
     
     // Get all local interface addresses using network_utils
-    local_interface_addresses_ = network_utils::get_local_interface_addresses();
+    auto addrs = network_utils::get_local_interface_addresses();
+    local_interface_addresses_.insert(addrs.begin(), addrs.end());
     
-    // Add common localhost addresses if not already present
+    // Add common localhost addresses
     for (const auto& addr : localhost_addrs) {
-        if (std::find(local_interface_addresses_.begin(), local_interface_addresses_.end(), addr) == local_interface_addresses_.end()) {
-            local_interface_addresses_.emplace_back(addr);
-        }
+        local_interface_addresses_.emplace(std::string(addr));
     }
     
     LOG_CLIENT_INFO("Found " << local_interface_addresses_.size() << " local addresses to block:");
@@ -1290,36 +1395,47 @@ void RatsClient::initialize_local_addresses() {
     }
 }
 
-
 bool RatsClient::is_blocked_address(const std::string& ip_address) const {
     std::lock_guard<std::mutex> lock(local_addresses_mutex_);
+    return local_interface_addresses_.count(ip_address) > 0;
+}
+
+bool RatsClient::can_connect_to_peer(const std::string& ip, int port) const {
+    if (should_ignore_peer(ip, port)) {
+        LOG_CLIENT_DEBUG("Ignoring peer " << ip << ":" << port << " - blocked address");
+        return false;
+    }
     
-    // Check against our stored local addresses
-    for (const auto& local_addr : local_interface_addresses_) {
-        if (local_addr == ip_address) {
-            return true;
-        }
+    std::string normalized_address = normalize_peer_address(ip, port);
+    if (is_already_connected_to_address(normalized_address)) {
+        LOG_CLIENT_DEBUG("Already connected to " << normalized_address);
+        return false;
     }
     
-    return false;
+    if (is_peer_limit_reached()) {
+        LOG_CLIENT_DEBUG("Peer limit reached, cannot connect to " << ip << ":" << port);
+        return false;
+    }
+    
+    return true;
 }
 
 bool RatsClient::should_ignore_peer(const std::string& ip, int port) const {
-    // Always block connections to ourselves (same port)
-    if (port == listen_port_) {
-        if (ip == "127.0.0.1" || ip == "::1" || ip == "localhost" || ip == "0.0.0.0" || ip == "::") {
+    // Check if this is a well-known localhost address
+    bool is_localhost = std::find(localhost_addrs.begin(), localhost_addrs.end(), ip) != localhost_addrs.end();
+    
+    if (is_localhost) {
+        // Block self-connections (same port on localhost)
+        if (port == listen_port_) {
             LOG_CLIENT_DEBUG("Ignoring peer " << ip << ":" << port << " - localhost with same port");
             return true;
         }
-    }
-    
-    // For localhost addresses on different ports, allow the connection (for testing)
-    if (ip == "127.0.0.1" || ip == "::1" || ip == "localhost") {
+        // Allow localhost on different ports (for testing)
         LOG_CLIENT_DEBUG("Allowing localhost peer " << ip << ":" << port << " on different port");
         return false;
     }
     
-    // Check if the IP is a non-localhost local interface address
+    // Block non-localhost local interface addresses
     if (is_blocked_address(ip)) {
         LOG_CLIENT_DEBUG("Ignoring peer " << ip << ":" << port << " - matches local interface address");
         return true;
@@ -1372,30 +1488,25 @@ bool RatsClient::parse_message_with_header(const std::vector<uint8_t>& message,
     // Extract payload
     payload.assign(message.begin() + MessageHeader::HEADER_SIZE, message.end());
     
-    LOG_CLIENT_DEBUG("Parsed message header: type=" << static_cast<int>(header.type) << ", payload_size=" << payload.size());
     return true;
 }
 
-// Unlocked version - assumes peers_mutex_ is already locked or peer data is cached
-// Takes pre-cached encryption data to avoid locking peers_mutex_ inside
+// Async send – enqueues header + (optionally encrypted) payload into the peer's
+// ChainedSendBuffer.  Does NOT require peers_mutex_; caller passes cached peer data.
+// The shared_ptr keeps the cipher alive even if the peer is removed concurrently.
 bool RatsClient::send_binary_to_peer_unlocked(socket_t socket, const std::vector<uint8_t>& data, 
                                                MessageDataType message_type,
-                                               rats::NoiseCipherState* send_cipher,
+                                               std::shared_ptr<rats::NoiseCipherState> send_cipher,
                                                const std::string& peer_id_for_logging) {
     if (!running_.load()) {
         return false;
     }
     
-    // Get socket-specific mutex for thread-safe sending
-    // Prevent framed messages corruption (like two-times sending the number of bytes instead number of bytes + message)
-    auto socket_mutex = get_socket_send_mutex(socket);
-    std::lock_guard<std::mutex> send_lock(*socket_mutex);
-    
     // Create message with specified header type
     std::vector<uint8_t> message_with_header = create_message_with_header(data, message_type);
     
     if (send_cipher) {
-        // Encrypt the message before sending
+        // Encrypt the message before enqueuing
         std::vector<uint8_t> ciphertext(message_with_header.size() + rats::NOISE_TAG_SIZE);
         size_t ct_len = send_cipher->encrypt_with_ad(
             nullptr, 0, 
@@ -1409,16 +1520,13 @@ bool RatsClient::send_binary_to_peer_unlocked(socket_t socket, const std::vector
         }
         
         ciphertext.resize(ct_len);
-        LOG_CLIENT_DEBUG("Sending encrypted message to " << peer_id_for_logging << " (" << ct_len << " bytes)");
+        LOG_CLIENT_DEBUG("Enqueuing encrypted message for " << peer_id_for_logging << " (" << ct_len << " bytes)");
         
-        // Send encrypted message using framed protocol
-        int sent = send_tcp_message_framed(socket, ciphertext);
-        return sent > 0;
+        return enqueue_message(socket, ciphertext);
     }
     
-    // Unencrypted path - use framed messages for reliable large message handling
-    int sent = send_tcp_message_framed(socket, message_with_header);
-    return sent > 0;
+    // Unencrypted path
+    return enqueue_message(socket, message_with_header);
 }
 
 bool RatsClient::send_binary_to_peer(socket_t socket, const std::vector<uint8_t>& data, MessageDataType message_type) {
@@ -1426,25 +1534,22 @@ bool RatsClient::send_binary_to_peer(socket_t socket, const std::vector<uint8_t>
         return false;
     }
     
-    // Cache peer encryption data under lock, then release lock before sending
+    // Cache peer data under lock, then release lock before sending
     std::string peer_id;
-    rats::NoiseCipherState* send_cipher = nullptr;
+    std::shared_ptr<rats::NoiseCipherState> send_cipher;
     
     {
         std::lock_guard<std::mutex> lock(peers_mutex_);
-        auto sock_it = socket_to_peer_id_.find(socket);
-        if (sock_it != socket_to_peer_id_.end()) {
-            auto peer_it = peers_.find(sock_it->second);
-            if (peer_it != peers_.end()) {
-                peer_id = peer_it->second.peer_id;
-                if (peer_it->second.is_noise_encrypted()) {
-                    send_cipher = peer_it->second.send_cipher.get();
-                }
+        auto peer_it = find_peer_by_socket_unlocked(socket);
+        if (peer_it != peers_.end()) {
+            peer_id = peer_it->second.peer_id;
+            if (peer_it->second.is_noise_encrypted()) {
+                send_cipher = peer_it->second.send_cipher; // shared_ptr copy keeps cipher alive
             }
         }
     }
     
-    // Call unlocked version with cached data (peers_mutex_ is released)
+    // peers_mutex_ released -- safe to do potentially slow TCP send
     return send_binary_to_peer_unlocked(socket, data, message_type, send_cipher, peer_id);
 }
 
@@ -1454,43 +1559,50 @@ bool RatsClient::send_string_to_peer(socket_t socket, const std::string& data) {
     return send_binary_to_peer(socket, binary_data, MessageDataType::STRING);
 }
 
+std::vector<uint8_t> RatsClient::json_to_binary(const nlohmann::json& data) {
+    std::string s = data.dump();
+    return {s.begin(), s.end()};
+}
+
 bool RatsClient::send_json_to_peer(socket_t socket, const nlohmann::json& data) {
     try {
-        // Serialize JSON and convert to binary, then use the primary send_binary_to_peer method
-        std::string json_string = data.dump();
-        std::vector<uint8_t> binary_data(json_string.begin(), json_string.end());
-        return send_binary_to_peer(socket, binary_data, MessageDataType::JSON);
+        return send_binary_to_peer(socket, json_to_binary(data), MessageDataType::JSON);
     } catch (const nlohmann::json::exception& e) {
         LOG_CLIENT_ERROR("Failed to serialize JSON message: " << e.what());
         return false;
     }
 }
 
-bool RatsClient::send_binary_to_peer_id(const std::string& peer_hash_id, const std::vector<uint8_t>& data, MessageDataType message_type) {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = peers_.find(peer_hash_id);
-    if (it == peers_.end() || !it->second.is_handshake_completed()) {
-        return false;
+bool RatsClient::send_binary_to_peer_id(const std::string& peer_id, const std::vector<uint8_t>& data, MessageDataType message_type) {
+    // Cache peer data under lock, then release before sending
+    socket_t socket;
+    std::shared_ptr<rats::NoiseCipherState> send_cipher;
+    
+    {
+        std::lock_guard<std::mutex> lock(peers_mutex_);
+        auto it = peers_.find(peer_id);
+        if (it == peers_.end() || !it->second.is_handshake_completed()) {
+            return false;
+        }
+        socket = it->second.socket;
+        if (it->second.is_noise_encrypted()) {
+            send_cipher = it->second.send_cipher; // shared_ptr copy keeps cipher alive
+        }
     }
     
-    // Use unlocked version since we already hold peers_mutex_
-    const RatsPeer& peer = it->second;
-    rats::NoiseCipherState* send_cipher = peer.is_noise_encrypted() ? peer.send_cipher.get() : nullptr;
-    return send_binary_to_peer_unlocked(peer.socket, data, message_type, send_cipher, peer.peer_id);
+    // peers_mutex_ released -- safe to do potentially slow TCP send
+    return send_binary_to_peer_unlocked(socket, data, message_type, send_cipher, peer_id);
 }
 
-bool RatsClient::send_string_to_peer_id(const std::string& peer_hash_id, const std::string& data) {
+bool RatsClient::send_string_to_peer_id(const std::string& peer_id, const std::string& data) {
     // Convert string to binary and use primary binary method with STRING type
     std::vector<uint8_t> binary_data(data.begin(), data.end());
-    return send_binary_to_peer_id(peer_hash_id, binary_data, MessageDataType::STRING);
+    return send_binary_to_peer_id(peer_id, binary_data, MessageDataType::STRING);
 }
 
-bool RatsClient::send_json_to_peer_id(const std::string& peer_hash_id, const nlohmann::json& data) {
+bool RatsClient::send_json_to_peer_id(const std::string& peer_id, const nlohmann::json& data) {
     try {
-        // Serialize JSON and convert to binary, then use primary binary method with JSON type
-        std::string json_string = data.dump();
-        std::vector<uint8_t> binary_data(json_string.begin(), json_string.end());
-        return send_binary_to_peer_id(peer_hash_id, binary_data, MessageDataType::JSON);
+        return send_binary_to_peer_id(peer_id, json_to_binary(data), MessageDataType::JSON);
     } catch (const nlohmann::json::exception& e) {
         LOG_CLIENT_ERROR("Failed to serialize JSON message: " << e.what());
         return false;
@@ -1499,10 +1611,7 @@ bool RatsClient::send_json_to_peer_id(const std::string& peer_hash_id, const nlo
 
 int RatsClient::broadcast_json_to_peers(const nlohmann::json& data) {
     try {
-        // Serialize JSON and convert to binary, then use primary binary method with JSON type
-        std::string json_string = data.dump();
-        std::vector<uint8_t> binary_data(json_string.begin(), json_string.end());
-        return broadcast_binary_to_peers(binary_data, MessageDataType::JSON);
+        return broadcast_binary_to_peers(json_to_binary(data), MessageDataType::JSON);
     } catch (const nlohmann::json::exception& e) {
         LOG_CLIENT_ERROR("Failed to serialize JSON message for broadcast: " << e.what());
         return 0;
@@ -1512,23 +1621,27 @@ int RatsClient::broadcast_json_to_peers(const nlohmann::json& data) {
 int RatsClient::broadcast_binary_to_peers(const std::vector<uint8_t>& data, MessageDataType message_type) {
     if (!running_.load()) {
         return 0;
-    }
-    
-    int sent_count = 0;
-    std::lock_guard<std::mutex> lock(peers_mutex_);
+    }
     
-    for (const auto& pair : peers_) {
-        const RatsPeer& peer = pair.second;
-        // Only send to peers that have completed handshake
-        if (peer.is_handshake_completed()) {
-            // Use unlocked version since we already hold peers_mutex_
-            rats::NoiseCipherState* send_cipher = peer.is_noise_encrypted() ? peer.send_cipher.get() : nullptr;
-            if (send_binary_to_peer_unlocked(peer.socket, data, message_type, send_cipher, peer.peer_id)) {
-                sent_count++;
+    // Collect targets under lock, then enqueue outside
+    std::vector<PeerSendTarget> targets;
+    {
+        std::lock_guard<std::mutex> lock(peers_mutex_);
+        targets.reserve(peers_.size());
+        for (const auto& [id, peer] : peers_) {
+            if (peer.is_handshake_completed()) {
+                targets.push_back({peer.socket, peer.peer_id,
+                    peer.is_noise_encrypted() ? peer.send_cipher : nullptr});
             }
         }
     }
     
+    int sent_count = 0;
+    for (const auto& t : targets) {
+        if (send_binary_to_peer_unlocked(t.socket, data, message_type, t.send_cipher, t.peer_id)) {
+            sent_count++;
+        }
+    }
     return sent_count;
 }
 
@@ -1538,35 +1651,6 @@ int RatsClient::broadcast_string_to_peers(const std::string& data) {
     return broadcast_binary_to_peers(binary_data, MessageDataType::STRING);
 }
 
-bool RatsClient::parse_json_message(const std::string& message, nlohmann::json& out_json) {
-    try {
-        out_json = nlohmann::json::parse(message);
-        return true;
-    } catch (const nlohmann::json::exception& e) {
-        LOG_CLIENT_ERROR("Failed to parse JSON message: " << e.what());
-        return false;
-    }
-}
-
-// Helpers
-
-// Per-socket synchronization helpers
-std::shared_ptr<std::mutex> RatsClient::get_socket_send_mutex(socket_t socket) {
-    std::lock_guard<std::mutex> lock(socket_send_mutexes_mutex_);
-    auto it = socket_send_mutexes_.find(socket);
-    if (it == socket_send_mutexes_.end()) {
-        // Create new mutex for this socket
-        socket_send_mutexes_[socket] = std::make_shared<std::mutex>();
-        return socket_send_mutexes_[socket];
-    }
-    return it->second;
-}
-
-void RatsClient::cleanup_socket_send_mutex(socket_t socket) {
-    std::lock_guard<std::mutex> lock(socket_send_mutexes_mutex_);
-    socket_send_mutexes_.erase(socket);
-}
-
 // =========================================================================
 // Peer Information and Management
 // =========================================================================
@@ -1576,32 +1660,18 @@ std::string RatsClient::get_our_peer_id() const {
 }
 
 int RatsClient::get_peer_count_unlocked() const {
-    // Assumes peers_mutex_ is already locked
-    int count = 0;
-    for (const auto& pair : peers_) {
-        if (pair.second.is_handshake_completed()) {
-            count++;
-        }
-    }
-    return count;
+    // Returns the cached validated peer count (O(1) instead of O(N) scan)
+    return validated_peer_count_.load(std::memory_order_relaxed);
 }
 
 int RatsClient::get_peer_count() const {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    return get_peer_count_unlocked();
+    return validated_peer_count_.load(std::memory_order_relaxed);
 }
 
 std::string RatsClient::get_peer_id(socket_t socket) const {
-    // Atomic operation - lock once and return copy to avoid race condition
     std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = socket_to_peer_id_.find(socket);
-    if (it != socket_to_peer_id_.end()) {
-        auto peer_it = peers_.find(it->second);
-        if (peer_it != peers_.end()) {
-            return peer_it->second.peer_id;
-        }
-    }
-    return "";
+    auto peer_it = find_peer_by_socket_unlocked(socket);
+    return (peer_it != peers_.end()) ? peer_it->second.peer_id : "";
 }
 
 socket_t RatsClient::get_peer_socket_by_id(const std::string& peer_id) const {
@@ -1639,7 +1709,6 @@ std::vector<RatsPeer> RatsClient::get_validated_peers() const {
     return result;
 }
 
-
 std::vector<RatsPeer> RatsClient::get_random_peers(int max_count, const std::string& exclude_peer_id) const {
     std::lock_guard<std::mutex> lock(peers_mutex_);
     
@@ -1670,23 +1739,24 @@ std::vector<RatsPeer> RatsClient::get_random_peers(int max_count, const std::str
     return selected_peers;
 }
 
-const RatsPeer* RatsClient::get_peer_by_id(const std::string& peer_id) const {
+std::optional<RatsPeer> RatsClient::get_peer_by_id(const std::string& peer_id) const {
     std::lock_guard<std::mutex> lock(peers_mutex_);
     auto it = peers_.find(peer_id);
-    return (it != peers_.end()) ? &it->second : nullptr;
+    if (it != peers_.end()) {
+        return it->second;
+    }
+    return std::nullopt;
 }
 
-const RatsPeer* RatsClient::get_peer_by_socket(socket_t socket) const {
+std::optional<RatsPeer> RatsClient::get_peer_by_socket(socket_t socket) const {
     std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = socket_to_peer_id_.find(socket);
-    if (it != socket_to_peer_id_.end()) {
-        auto peer_it = peers_.find(it->second);
-        return (peer_it != peers_.end()) ? &peer_it->second : nullptr;
+    auto peer_it = find_peer_by_socket_unlocked(socket);
+    if (peer_it != peers_.end()) {
+        return peer_it->second;
     }
-    return nullptr;
+    return std::nullopt;
 }
 
-
 // Peer limit management methods
 int RatsClient::get_max_peers() const {
     return max_peers_;
@@ -1699,15 +1769,10 @@ void RatsClient::set_max_peers(int max_peers) {
 
 bool RatsClient::is_peer_limit_reached() const {
     std::lock_guard<std::mutex> lock(peers_mutex_);
-    // Connected peers only enforcement (exclude handshake peers)
-    int connected_peers = get_peer_count_unlocked();
-    if (connected_peers >= max_peers_) {
-        return true;
-    }
-    return false;
+    return get_peer_count_unlocked() >= max_peers_;
 }
 
-std::string RatsClient::generate_peer_hash_id(socket_t socket, const std::string& connection_info) {
+std::string RatsClient::generate_temporary_peer_id(socket_t socket, const std::string& connection_info) {
     // Generate unique hash ID using timestamp, socket, connection info, and random component
     auto now = std::chrono::high_resolution_clock::now();
     auto timestamp = std::chrono::duration_cast<std::chrono::nanoseconds>(now.time_since_epoch()).count();
@@ -1758,7 +1823,7 @@ std::string RatsClient::normalize_peer_address(const std::string& ip, int port)
 
 // =========================================================================
 // Callback Registration
-// ========================================================================
+// =========================================================================
 
 void RatsClient::set_connection_callback(ConnectionCallback callback) {
     connection_callback_ = callback;
@@ -1780,298 +1845,6 @@ void RatsClient::set_disconnect_callback(DisconnectCallback callback) {
     disconnect_callback_ = callback;
 }
 
-// =========================================================================
-// Peer Discovery Methods
-// =========================================================================
-
-bool RatsClient::start_dht_discovery(int dht_port) {
-    if (dht_client_ && dht_client_->is_running()) {
-        LOG_CLIENT_WARN("DHT discovery is already running");
-        return true;
-    }
-    
-    LOG_CLIENT_INFO("Starting DHT discovery on port " << dht_port <<
-                   (bind_address_.empty() ? "" : " bound to " + bind_address_));
-    
-    dht_client_ = std::make_unique<DhtClient>(dht_port, bind_address_, data_directory_);
-    if (!dht_client_->start()) {
-        LOG_CLIENT_ERROR("Failed to start DHT client");
-        dht_client_.reset();
-        return false;
-    }
-    
-    // Bootstrap with default nodes
-    auto bootstrap_nodes = DhtClient::get_default_bootstrap_nodes();
-    if (!dht_client_->bootstrap(bootstrap_nodes)) {
-        LOG_CLIENT_WARN("Failed to bootstrap DHT");
-    }
-    
-    // Start automatic peer discovery
-    start_automatic_peer_discovery();
-    
-    LOG_CLIENT_INFO("DHT discovery started successfully");
-    return true;
-}
-
-void RatsClient::stop_dht_discovery() {
-    if (!dht_client_) {
-        return;
-    }
-    
-    LOG_CLIENT_INFO("Stopping DHT discovery");
-    
-    // Stop automatic peer discovery
-    stop_automatic_peer_discovery();
-    
-    dht_client_->stop();
-    dht_client_.reset();
-    LOG_CLIENT_INFO("DHT discovery stopped");
-}
-
-bool RatsClient::find_peers_by_hash(const std::string& content_hash, std::function<void(const std::vector<std::string>&)> callback) {
-    if (!dht_client_ || !dht_client_->is_running()) {
-        LOG_CLIENT_ERROR("DHT client not running");
-        return false;
-    }
-    
-    if (content_hash.length() != 40) {  // 160-bit hash as hex string
-        LOG_CLIENT_ERROR("Invalid content hash length: " << content_hash.length() << " (expected 40)");
-        return false;
-    }
-    
-    LOG_CLIENT_INFO("Finding peers for content hash: " << content_hash);
-    
-    InfoHash info_hash = hex_to_node_id(content_hash);
-    
-    return dht_client_->find_peers(info_hash, [this, callback](const std::vector<Peer>& peers, const InfoHash& info_hash) {
-        // Convert Peer to string addresses for callback
-        std::vector<std::string> peer_addresses;
-        for (const auto& peer : peers) {
-            peer_addresses.emplace_back(peer.ip + ":" + std::to_string(peer.port));
-        }
-        
-        if (callback) {
-            callback(peer_addresses);
-        }
-    });
-}
-
-bool RatsClient::announce_for_hash(const std::string& content_hash, uint16_t port,
-                                   std::function<void(const std::vector<std::string>&)> callback) {
-    if (!dht_client_ || !dht_client_->is_running()) {
-        LOG_CLIENT_ERROR("DHT client not running");
-        return false;
-    }
-    
-    if (content_hash.length() != 40) {  // 160-bit hash as hex string
-        LOG_CLIENT_ERROR("Invalid content hash length: " << content_hash.length() << " (expected 40)");
-        return false;
-    }
-    
-    if (port == 0) {
-        port = listen_port_;
-    }
-    
-    LOG_CLIENT_INFO("Announcing for content hash: " << content_hash << " on port " << port
-                   << (callback ? " with peer callback" : ""));
-    
-    InfoHash info_hash = hex_to_node_id(content_hash);
-    
-    // Create wrapper callback that converts Peer to string addresses (if callback provided)
-    PeerDiscoveryCallback peer_callback = nullptr;
-    if (callback) {
-        peer_callback = [callback](const std::vector<Peer>& peers, const InfoHash& hash) {
-            std::vector<std::string> peer_addresses;
-            peer_addresses.reserve(peers.size());
-            for (const auto& peer : peers) {
-                peer_addresses.push_back(peer.ip + ":" + std::to_string(peer.port));
-            }
-            callback(peer_addresses);
-        };
-    }
-    
-    return dht_client_->announce_peer(info_hash, port, peer_callback);
-}
-
-bool RatsClient::is_dht_running() const {
-    return dht_client_ && dht_client_->is_running();
-}
-
-size_t RatsClient::get_dht_routing_table_size() const {
-    if (!dht_client_) {
-        return 0;
-    }
-    return dht_client_->get_routing_table_size();
-}
-
-void RatsClient::handle_dht_peer_discovery(const std::vector<Peer>& peers, const InfoHash& info_hash) {
-    LOG_CLIENT_INFO("DHT discovered " << peers.size() << " peers for info hash: " << node_id_to_hex(info_hash));
-    
-    // Auto-connect to discovered peers (optional behavior)
-    for (const auto& peer : peers) {
-        // Check if this peer should be ignored (local interface)
-        if (should_ignore_peer(peer.ip, peer.port)) {
-            LOG_CLIENT_DEBUG("Ignoring discovered peer " << peer.ip << ":" << peer.port << " - local interface address");
-            continue;
-        }
-        
-        // Check if we're already connected to this peer
-        std::string normalized_peer_address = normalize_peer_address(peer.ip, peer.port);
-        bool already_connected = is_already_connected_to_address(normalized_peer_address);
-        
-        if (!already_connected) {
-            // Check if peer limit is reached
-            if (is_peer_limit_reached()) {
-                LOG_CLIENT_DEBUG("Peer limit reached, not connecting to DHT discovered peer " << peer.ip << ":" << peer.port);
-                continue;
-            }
-            
-            LOG_CLIENT_DEBUG("Attempting to connect to discovered peer: " << peer.ip << ":" << peer.port);
-            
-            // Try to connect to the peer (non-blocking)
-            std::thread([this, peer]() {
-                if (connect_to_peer(peer.ip, peer.port)) {
-                    LOG_CLIENT_INFO("Successfully connected to DHT discovered peer: " << peer.ip << ":" << peer.port);
-                } else {
-                    LOG_CLIENT_DEBUG("Failed to connect to DHT discovered peer: " << peer.ip << ":" << peer.port);
-                }
-            }).detach();
-        } else {
-            LOG_CLIENT_DEBUG("Already connected to discovered peer: " << normalized_peer_address);
-        }
-    }
-}
-
-void RatsClient::start_automatic_peer_discovery() {
-    if (auto_discovery_running_.load()) {
-        LOG_CLIENT_WARN("Automatic peer discovery is already running");
-        return;
-    }
-    
-    LOG_CLIENT_INFO("Starting automatic rats peer discovery");
-    auto_discovery_running_.store(true);
-    auto_discovery_thread_ = std::thread(&RatsClient::automatic_discovery_loop, this);
-}
-
-void RatsClient::stop_automatic_peer_discovery() {
-    if (!auto_discovery_running_.load()) {
-        return;
-    }
-    
-    LOG_CLIENT_INFO("Stopping automatic peer discovery");
-    auto_discovery_running_.store(false);
-    
-    if (auto_discovery_thread_.joinable()) {
-        auto_discovery_thread_.join();
-    }
-    
-    LOG_CLIENT_INFO("Automatic peer discovery stopped");
-}
-
-bool RatsClient::is_automatic_discovery_running() const {
-    return auto_discovery_running_.load();
-}
-
-void RatsClient::automatic_discovery_loop() {
-    LOG_CLIENT_INFO("Automatic peer discovery loop started");
-    
-    // Initial delay to let DHT bootstrap
-    {
-        std::unique_lock<std::mutex> lock(shutdown_mutex_);
-        if (shutdown_cv_.wait_for(lock, std::chrono::seconds(5), [this] { return !auto_discovery_running_.load() || !running_.load(); })) {
-            LOG_CLIENT_INFO("Automatic peer discovery loop stopped during initial delay");
-            return;
-        }
-    }
-
-    // Announce immediately - this also discovers peers during traversal
-    announce_rats_peer();
-
-    auto last_announce = std::chrono::steady_clock::now();
-    
-    while (auto_discovery_running_.load()) {
-        auto now = std::chrono::steady_clock::now();
-        
-        // Announce combines both announcing our presence and discovering peers
-        // Adjust frequency based on whether we have peers
-        auto interval = (get_peer_count() == 0) 
-            ? std::chrono::seconds(15)    // Aggressive when no peers
-            : std::chrono::minutes(10);   // Less aggressive when connected
-        
-        if (now - last_announce >= interval) {
-            announce_rats_peer();
-            last_announce = now;
-        }
-        
-        // Use conditional variable for responsive shutdown
-        {
-            std::unique_lock<std::mutex> lock(shutdown_mutex_);
-            if (shutdown_cv_.wait_for(lock, std::chrono::milliseconds(500), [this] { return !auto_discovery_running_.load() || !running_.load(); })) {
-                break;
-            }
-        }
-    }
-    
-    LOG_CLIENT_INFO("Automatic peer discovery loop stopped");
-}
-
-void RatsClient::announce_rats_peer() {
-    if (!dht_client_ || !dht_client_->is_running()) {
-        LOG_CLIENT_WARN("DHT client not running, cannot announce peer");
-        return;
-    }
-    
-    std::string discovery_hash = get_discovery_hash();
-    LOG_CLIENT_INFO("Announcing peer for discovery hash: " << discovery_hash << " on port " << listen_port_);
-    
-    InfoHash info_hash = hex_to_node_id(discovery_hash);
-
-    if (dht_client_->is_announce_active(info_hash)) {
-        LOG_CLIENT_WARN("Announce already in progress for info hash: " << node_id_to_hex(info_hash));
-        return;
-    }
-    
-    // Use announce with callback - combines announce and find_peers in one traversal
-    // Peers discovered during traversal will be returned through the callback
-    if (announce_for_hash(discovery_hash, listen_port_, [this, info_hash](const std::vector<std::string>& peer_addresses) {
-        LOG_CLIENT_INFO("Announce discovered " << peer_addresses.size() << " peers during traversal");
-        
-        // Convert peer addresses to Peer objects for handle_dht_peer_discovery()
-        std::vector<Peer> peers;
-        peers.reserve(peer_addresses.size());
-        for (const auto& peer_address : peer_addresses) {
-            std::string ip;
-            int port;
-            if (parse_address_string(peer_address, ip, port)) {
-                peers.push_back(Peer(ip, port));
-            }
-        }
-        
-        // Auto-connect to discovered peers
-        if (!peers.empty()) {
-            handle_dht_peer_discovery(peers, info_hash);
-        }
-    })) {
-        LOG_CLIENT_DEBUG("Successfully started announce with peer discovery for discovery hash");
-    } else {
-        LOG_CLIENT_WARN("Failed to announce peer for discovery");
-    }
-}
-
-
-std::string RatsClient::get_discovery_hash() const {
-    std::lock_guard<std::mutex> lock(protocol_config_mutex_);
-    // Generate discovery hash based on current protocol configuration
-    std::string discovery_string = custom_protocol_name_ + "_peer_discovery_v" + custom_protocol_version_;
-    return SHA1::hash(discovery_string);
-}
-
-std::string RatsClient::get_rats_peer_discovery_hash() {
-    // Well-known hash for rats peer discovery
-    // Compute SHA1 hash of "rats_peer_discovery_v1.0"
-    return SHA1::hash("rats_peer_discovery_v1.0");
-}
-
 // =========================================================================
 // Protocol Configuration
 // =========================================================================
@@ -2102,11 +1875,10 @@ std::string RatsClient::get_protocol_version() const {
 // Message Exchange API
 // =========================================================================
 
-
 void RatsClient::on(const std::string& message_type, MessageCallback callback) {
     std::lock_guard<std::mutex> lock(message_handlers_mutex_);
     message_handlers_[message_type].emplace_back(callback, false); // false = not once
-    LOG_CLIENT_INFO("Registered persistent handler for message type: " << message_type << " (total handlers: " << message_handlers_[message_type].size() << ")");
+    LOG_CLIENT_DEBUG("Registered handler for message type: " << message_type);
 }
 
 void RatsClient::once(const std::string& message_type, MessageCallback callback) {
@@ -2134,15 +1906,15 @@ void RatsClient::send(const std::string& message_type, const nlohmann::json& dat
         return;
     }
     
-    LOG_CLIENT_INFO("Sending broadcast message type '" << message_type << "' with data: " << data.dump());
+    LOG_CLIENT_DEBUG("Sending broadcast message type '" << message_type << "'");
     
     // Create rats message
     nlohmann::json message = create_rats_message(message_type, data, get_our_peer_id());
     
     // Broadcast to all validated peers
-    int sent_count = broadcast_rats_message_to_validated_peers(message);
+    int sent_count = broadcast_rats_message(message);
     
-    LOG_CLIENT_INFO("Broadcasted message type '" << message_type << "' to " << sent_count << " peers");
+    LOG_CLIENT_DEBUG("Broadcasted message type '" << message_type << "' to " << sent_count << " peers");
     
     if (callback) {
         if (sent_count > 0) {
@@ -2163,7 +1935,7 @@ void RatsClient::send(const std::string& peer_id, const std::string& message_typ
         return;
     }
     
-    LOG_CLIENT_INFO("Sending targeted message type '" << message_type << "' to peer " << peer_id << " with data: " << data.dump());
+    LOG_CLIENT_DEBUG("Sending targeted message type '" << message_type << "' to peer " << peer_id);
     
     // Create rats message
     nlohmann::json message = create_rats_message(message_type, data, get_our_peer_id());
@@ -2203,7 +1975,7 @@ void RatsClient::send(const std::string& peer_id, const std::string& message_typ
     
     bool success = send_json_to_peer(target_socket, message);
     
-    LOG_CLIENT_INFO("Sent message type '" << message_type << "' to peer " << peer_id << " - " << (success ? "success" : "failed"));
+    LOG_CLIENT_DEBUG("Sent message type '" << message_type << "' to peer " << peer_id << " - " << (success ? "success" : "failed"));
     
     if (callback) {
         if (success) {
@@ -2217,54 +1989,41 @@ void RatsClient::send(const std::string& peer_id, const std::string& message_typ
 // Message exchange system helpers
 void RatsClient::call_message_handlers(const std::string& message_type, const std::string& peer_id, const nlohmann::json& data) {
     std::vector<MessageHandler> handlers_to_call;
-    std::vector<MessageHandler> remaining_handlers;
     
-    LOG_CLIENT_INFO("Calling message handlers for type '" << message_type << "' from peer " << peer_id << " with data: " << data.dump());
-    
-    // Get handlers to call and identify once handlers
+    // Get handlers to call and remove once handlers atomically
     {
         std::lock_guard<std::mutex> lock(message_handlers_mutex_);
         auto it = message_handlers_.find(message_type);
-        if (it != message_handlers_.end()) {
-            handlers_to_call = it->second; // Copy handlers
-            
-            // Keep only non-once handlers for the remaining list
-            for (const auto& handler : it->second) {
-                if (!handler.is_once) {
-                    remaining_handlers.push_back(handler);
-                }
-            }
-            
-            // Update the handlers list (removes once handlers)
-            it->second = remaining_handlers;
-        } else {
-            LOG_CLIENT_WARN("No handlers registered for message type '" << message_type << "'");
+        if (it == message_handlers_.end()) {
+            LOG_CLIENT_DEBUG("No handlers registered for message type '" << message_type << "'");
+            return;
         }
+        
+        handlers_to_call = it->second;
+        
+        // Remove once handlers using erase-remove idiom
+        it->second.erase(
+            std::remove_if(it->second.begin(), it->second.end(),
+                [](const MessageHandler& h) { return h.is_once; }),
+            it->second.end());
     }
     
-    LOG_CLIENT_INFO("Found " << handlers_to_call.size() << " handlers for message type '" << message_type << "'");
+    LOG_CLIENT_DEBUG("Calling " << handlers_to_call.size() << " handlers for message type '" << message_type << "'");
     
     // Call handlers outside of mutex to avoid deadlock
     for (const auto& handler : handlers_to_call) {
         try {
-            LOG_CLIENT_INFO("Calling handler for message type '" << message_type << "'");
             handler.callback(peer_id, data);
-            LOG_CLIENT_INFO("Handler for message type '" << message_type << "' completed successfully");
         } catch (const std::exception& e) {
             LOG_CLIENT_ERROR("Exception in message handler for type '" << message_type << "': " << e.what());
         } catch (...) {
             LOG_CLIENT_ERROR("Unknown exception in message handler for type '" << message_type << "'");
         }
     }
-    
-    if (!handlers_to_call.empty()) {
-        LOG_CLIENT_INFO("Called " << handlers_to_call.size() << " handlers for message type '" << message_type << "'");
-    }
 }
 
-
 // =========================================================================
-// Rats messages protocol / Message handling system
+// Rats Protocol Message Handling
 // =========================================================================
 
 nlohmann::json RatsClient::create_rats_message(const std::string& type, const nlohmann::json& payload, const std::string& sender_peer_id) {
@@ -2279,26 +2038,26 @@ nlohmann::json RatsClient::create_rats_message(const std::string& type, const nl
     return message;
 }
 
-void RatsClient::handle_rats_message(socket_t socket, const std::string& peer_hash_id, const nlohmann::json& message) {
+void RatsClient::handle_rats_message(socket_t socket, const std::string& peer_id, const nlohmann::json& message) {
     try {
         std::string message_type = message.value("type", "");
         nlohmann::json payload = message.value("payload", nlohmann::json::object());
         std::string sender_peer_id = message.value("sender_peer_id", "");
         
-        LOG_CLIENT_DEBUG("Received rats message type '" << message_type << "' from " << peer_hash_id);
+        LOG_CLIENT_DEBUG("Received rats message type '" << message_type << "' from " << peer_id);
         
         // Call registered message handlers for all message types (including custom ones)
-        call_message_handlers(message_type, sender_peer_id.empty() ? peer_hash_id : sender_peer_id, payload);
+        call_message_handlers(message_type, sender_peer_id.empty() ? peer_id : sender_peer_id, payload);
         
         // Handle built-in message types for internal functionality
         if (message_type == "peer") {
-            handle_peer_exchange_message(socket, peer_hash_id, payload);
+            handle_peer_exchange_message(socket, peer_id, payload);
         } 
         else if (message_type == "peers_request") {
-            handle_peers_request_message(socket, peer_hash_id, payload);
+            handle_peers_request_message(socket, peer_id, payload);
         }
         else if (message_type == "peers_response") {
-            handle_peers_response_message(socket, peer_hash_id, payload);
+            handle_peers_response_message(socket, peer_id, payload);
         }
         // Custom message types are now handled by registered handlers above
         // No need for else clause - all message types are valid if they have registered handlers
@@ -2308,54 +2067,39 @@ void RatsClient::handle_rats_message(socket_t socket, const std::string& peer_ha
     }
 }
 
-void RatsClient::handle_peer_exchange_message(socket_t socket, const std::string& peer_hash_id, const nlohmann::json& payload) {
+void RatsClient::handle_peer_exchange_message(socket_t socket, const std::string& peer_id, const nlohmann::json& payload) {
     try {
-        std::string peer_ip = payload.value("ip", "");
-        int peer_port = payload.value("port", 0);
-        std::string peer_id = payload.value("peer_id", "");
-        
-        if (peer_ip.empty() || peer_port <= 0 || peer_id.empty()) {
-            LOG_CLIENT_WARN("Invalid peer exchange message from " << peer_hash_id);
-            return;
-        }
-        
-        LOG_CLIENT_INFO("Received peer exchange: " << peer_ip << ":" << peer_port << " (peer_id: " << peer_id << ")");
+        std::string exchanged_ip = payload.value("ip", "");
+        int exchanged_port = payload.value("port", 0);
+        std::string exchanged_peer_id = payload.value("peer_id", "");
         
-        // Check if we should ignore this peer (local interface)
-        if (should_ignore_peer(peer_ip, peer_port)) {
-            LOG_CLIENT_DEBUG("Ignoring exchanged peer " << peer_ip << ":" << peer_port << " - local interface address");
+        if (exchanged_ip.empty() || exchanged_port <= 0 || exchanged_peer_id.empty()) {
+            LOG_CLIENT_WARN("Invalid peer exchange message from " << peer_id);
             return;
         }
         
-        // Check if we're already connected to this peer
-        std::string normalized_peer_address = normalize_peer_address(peer_ip, peer_port);
-        if (is_already_connected_to_address(normalized_peer_address)) {
-            LOG_CLIENT_DEBUG("Already connected to exchanged peer " << normalized_peer_address);
-            return;
-        }
+        LOG_CLIENT_INFO("Received peer exchange: " << exchanged_ip << ":" << exchanged_port << " (peer_id: " << exchanged_peer_id << ")");
         
-        // Check if peer limit is reached
-        if (is_peer_limit_reached()) {
-            LOG_CLIENT_DEBUG("Peer limit reached, not connecting to exchanged peer " << peer_ip << ":" << peer_port);
+        if (!can_connect_to_peer(exchanged_ip, exchanged_port)) {
             return;
         }
         
         // Try to connect to the exchanged peer (non-blocking)
-        add_managed_thread(std::thread([this, peer_ip, peer_port, peer_id]() {
-            if (connect_to_peer(peer_ip, peer_port)) {
-                LOG_CLIENT_INFO("Successfully connected to exchanged peer: " << peer_ip << ":" << peer_port);
+        add_managed_thread(std::thread([this, exchanged_ip, exchanged_port, exchanged_peer_id]() {
+            if (connect_to_peer(exchanged_ip, exchanged_port)) {
+                LOG_CLIENT_INFO("Successfully connected to exchanged peer: " << exchanged_ip << ":" << exchanged_port);
             } else {
-                LOG_CLIENT_DEBUG("Failed to connect to exchanged peer: " << peer_ip << ":" << peer_port);
+                LOG_CLIENT_DEBUG("Failed to connect to exchanged peer: " << exchanged_ip << ":" << exchanged_port);
             }
-        }), "peer-exchange-connect-" + peer_id.substr(0, 8));
+        }), "peer-exchange-connect-" + exchanged_peer_id.substr(0, 8));
         
     } catch (const nlohmann::json::exception& e) {
         LOG_CLIENT_ERROR("Failed to handle peer exchange message: " << e.what());
     }
 }
 
-// General broadcasting functions
-int RatsClient::broadcast_rats_message(const nlohmann::json& message, const std::string& exclude_peer_id) {
+// General broadcasting function
+int RatsClient::broadcast_rats_message(const nlohmann::json& message, const std::string& exclude_peer_id, bool validated_only) {
     // Serialize JSON once before iterating
     std::string json_string;
     try {
@@ -2366,53 +2110,27 @@ int RatsClient::broadcast_rats_message(const nlohmann::json& message, const std:
     }
     std::vector<uint8_t> binary_data(json_string.begin(), json_string.end());
     
-    int sent_count = 0;
+    // Collect targets under lock, then enqueue outside
+    std::vector<PeerSendTarget> targets;
     {
         std::lock_guard<std::mutex> lock(peers_mutex_);
-        for (const auto& pair : peers_) {
-            const RatsPeer& peer = pair.second;
-            // Don't send to excluded peer
+        targets.reserve(peers_.size());
+        for (const auto& [id, peer] : peers_) {
             if (!exclude_peer_id.empty() && peer.peer_id == exclude_peer_id) {
                 continue;
             }
-            
-            // Use unlocked version since we already hold peers_mutex_
-            rats::NoiseCipherState* send_cipher = peer.is_noise_encrypted() ? peer.send_cipher.get() : nullptr;
-            if (send_binary_to_peer_unlocked(peer.socket, binary_data, MessageDataType::JSON, send_cipher, peer.peer_id)) {
-                sent_count++;
+            if (validated_only && !peer.is_handshake_completed()) {
+                continue;
             }
+            targets.push_back({peer.socket, peer.peer_id,
+                peer.is_noise_encrypted() ? peer.send_cipher : nullptr});
         }
     }
-    return sent_count;
-}
-
-int RatsClient::broadcast_rats_message_to_validated_peers(const nlohmann::json& message, const std::string& exclude_peer_id) {
-    // Serialize JSON once before iterating
-    std::string json_string;
-    try {
-        json_string = message.dump();
-    } catch (const nlohmann::json::exception& e) {
-        LOG_CLIENT_ERROR("Failed to serialize JSON message for broadcast: " << e.what());
-        return 0;
-    }
-    std::vector<uint8_t> binary_data(json_string.begin(), json_string.end());
     
     int sent_count = 0;
-    {
-        std::lock_guard<std::mutex> lock(peers_mutex_);
-        for (const auto& pair : peers_) {
-            const RatsPeer& peer = pair.second;
-            // Don't send to excluded peer and only send to peers with completed handshake
-            if ((!exclude_peer_id.empty() && peer.peer_id == exclude_peer_id) || 
-                !peer.is_handshake_completed()) {
-                continue;
-            }
-            
-            // Use unlocked version since we already hold peers_mutex_
-            rats::NoiseCipherState* send_cipher = peer.is_noise_encrypted() ? peer.send_cipher.get() : nullptr;
-            if (send_binary_to_peer_unlocked(peer.socket, binary_data, MessageDataType::JSON, send_cipher, peer.peer_id)) {
-                sent_count++;
-            }
+    for (const auto& t : targets) {
+        if (send_binary_to_peer_unlocked(t.socket, binary_data, MessageDataType::JSON, t.send_cipher, t.peer_id)) {
+            sent_count++;
         }
     }
     return sent_count;
@@ -2441,7 +2159,7 @@ void RatsClient::broadcast_peer_exchange_message(const RatsPeer& new_peer) {
     nlohmann::json message = create_peer_exchange_message(new_peer);
     
     // Broadcast to all validated peers except the new peer
-    int sent_count = broadcast_rats_message_to_validated_peers(message, new_peer.peer_id);
+    int sent_count = broadcast_rats_message(message, new_peer.peer_id);
     
     LOG_CLIENT_INFO("Broadcasted peer exchange message for " << new_peer.ip << ":" << new_peer.port 
                     << " to " << sent_count << " peers");
@@ -2450,7 +2168,7 @@ void RatsClient::broadcast_peer_exchange_message(const RatsPeer& new_peer) {
 // Peers request/response system implementation
 nlohmann::json RatsClient::create_peers_request_message(const std::string& sender_peer_id) {
     nlohmann::json payload;
-    payload["max_peers"] = 5;  // Request up to 5 peers
+    payload["max_peers"] = MAX_PEERS_REQUEST_COUNT;
     payload["requester_info"] = {
         {"listen_port", listen_port_},
         {"peer_count", get_peer_count()}
@@ -2464,39 +2182,38 @@ nlohmann::json RatsClient::create_peers_response_message(const std::vector<RatsP
     nlohmann::json peers_array = nlohmann::json::array();
     
     for (const auto& peer : peers) {
-        nlohmann::json peer_info;
-        peer_info["ip"] = peer.ip;
-        peer_info["port"] = peer.port;
-        peer_info["peer_id"] = peer.peer_id;
-        peer_info["connection_type"] = peer.is_outgoing ? "outgoing" : "incoming";
-        peers_array.push_back(peer_info);
+        peers_array.push_back({
+            {"ip", peer.ip},
+            {"port", peer.port},
+            {"peer_id", peer.peer_id},
+            {"connection_type", peer.is_outgoing ? "outgoing" : "incoming"}
+        });
     }
     
-    payload["peers"] = peers_array;
+    payload["peers"] = std::move(peers_array);
     payload["total_peers"] = get_peer_count();
     
     return create_rats_message("peers_response", payload, sender_peer_id);
 }
 
-
-void RatsClient::handle_peers_request_message(socket_t socket, const std::string& peer_hash_id, const nlohmann::json& payload) {
+void RatsClient::handle_peers_request_message(socket_t socket, const std::string& peer_id, const nlohmann::json& payload) {
     try {
-        int max_peers = payload.value("max_peers", 5);
+        int max_peers = payload.value("max_peers", MAX_PEERS_REQUEST_COUNT);
         
-        LOG_CLIENT_INFO("Received peers request from " << peer_hash_id << " for up to " << max_peers << " peers");
+        LOG_CLIENT_INFO("Received peers request from " << peer_id << " for up to " << max_peers << " peers");
         
         // Get random peers excluding the requester
-        std::vector<RatsPeer> random_peers = get_random_peers(max_peers, peer_hash_id);
+        std::vector<RatsPeer> random_peers = get_random_peers(max_peers, peer_id);
         
-        LOG_CLIENT_DEBUG("Sending " << random_peers.size() << " peers to " << peer_hash_id);
+        LOG_CLIENT_DEBUG("Sending " << random_peers.size() << " peers to " << peer_id);
         
         // Create and send peers response
-        nlohmann::json response_message = create_peers_response_message(random_peers, peer_hash_id);
+        nlohmann::json response_message = create_peers_response_message(random_peers, peer_id);
         
         if (!send_json_to_peer(socket, response_message)) {
-            LOG_CLIENT_ERROR("Failed to send peers response to " << peer_hash_id);
+            LOG_CLIENT_ERROR("Failed to send peers response to " << peer_id);
         } else {
-            LOG_CLIENT_DEBUG("Sent peers response with " << random_peers.size() << " peers to " << peer_hash_id);
+            LOG_CLIENT_DEBUG("Sent peers response with " << random_peers.size() << " peers to " << peer_id);
         }
         
     } catch (const nlohmann::json::exception& e) {
@@ -2504,55 +2221,39 @@ void RatsClient::handle_peers_request_message(socket_t socket, const std::string
     }
 }
 
-void RatsClient::handle_peers_response_message(socket_t socket, const std::string& peer_hash_id, const nlohmann::json& payload) {
+void RatsClient::handle_peers_response_message(socket_t socket, const std::string& peer_id, const nlohmann::json& payload) {
     try {
         nlohmann::json peers_array = payload.value("peers", nlohmann::json::array());
         int total_peers = payload.value("total_peers", 0);
         
-        LOG_CLIENT_INFO("Received peers response from " << peer_hash_id << " with " << peers_array.size() 
+        LOG_CLIENT_INFO("Received peers response from " << peer_id << " with " << peers_array.size() 
                         << " peers (total: " << total_peers << ")");
         
         // Process each peer in the response
         for (const auto& peer_info : peers_array) {
-            std::string peer_ip = peer_info.value("ip", "");
-            int peer_port = peer_info.value("port", 0);
-            std::string peer_id = peer_info.value("peer_id", "");
-            
-            if (peer_ip.empty() || peer_port <= 0 || peer_id.empty()) {
-                LOG_CLIENT_WARN("Invalid peer info in peers response from " << peer_hash_id);
-                continue;
-            }
+            std::string resp_ip = peer_info.value("ip", "");
+            int resp_port = peer_info.value("port", 0);
+            std::string resp_peer_id = peer_info.value("peer_id", "");
             
-            LOG_CLIENT_DEBUG("Processing peer from response: " << peer_ip << ":" << peer_port << " (peer_id: " << peer_id << ")");
-            
-            // Check if we should ignore this peer (local interface)
-            if (should_ignore_peer(peer_ip, peer_port)) {
-                LOG_CLIENT_DEBUG("Ignoring peer from response " << peer_ip << ":" << peer_port << " - local interface address");
+            if (resp_ip.empty() || resp_port <= 0 || resp_peer_id.empty()) {
+                LOG_CLIENT_WARN("Invalid peer info in peers response from " << peer_id);
                 continue;
             }
             
-            // Check if we're already connected to this peer
-            std::string normalized_peer_address = normalize_peer_address(peer_ip, peer_port);
-            if (is_already_connected_to_address(normalized_peer_address)) {
-                LOG_CLIENT_DEBUG("Already connected to peer from response " << normalized_peer_address);
-                continue;
-            }
+            LOG_CLIENT_DEBUG("Processing peer from response: " << resp_ip << ":" << resp_port << " (peer_id: " << resp_peer_id << ")");
             
-            // Check if peer limit is reached
-            if (is_peer_limit_reached()) {
-                LOG_CLIENT_DEBUG("Peer limit reached, not connecting to peer from response " << peer_ip << ":" << peer_port);
+            if (!can_connect_to_peer(resp_ip, resp_port)) {
                 continue;
             }
             
-            // Try to connect to the peer (non-blocking)
-            LOG_CLIENT_INFO("Attempting to connect to peer from response: " << peer_ip << ":" << peer_port);
-            add_managed_thread(std::thread([this, peer_ip, peer_port, peer_id]() {
-                if (connect_to_peer(peer_ip, peer_port)) {
-                    LOG_CLIENT_INFO("Successfully connected to peer from response: " << peer_ip << ":" << peer_port);
+            LOG_CLIENT_DEBUG("Attempting to connect to peer from response: " << resp_ip << ":" << resp_port);
+            add_managed_thread(std::thread([this, resp_ip, resp_port, resp_peer_id]() {
+                if (connect_to_peer(resp_ip, resp_port)) {
+                    LOG_CLIENT_INFO("Successfully connected to peer from response: " << resp_ip << ":" << resp_port);
                 } else {
-                    LOG_CLIENT_DEBUG("Failed to connect to peer from response: " << peer_ip << ":" << peer_port);
+                    LOG_CLIENT_DEBUG("Failed to connect to peer from response: " << resp_ip << ":" << resp_port);
                 }
-            }), "peer-response-connect-" + peer_id.substr(0, 8));
+            }), "peer-response-connect-" + resp_peer_id.substr(0, 8));
         }
         
     } catch (const nlohmann::json::exception& e) {
@@ -2571,49 +2272,7 @@ void RatsClient::send_peers_request(socket_t socket, const std::string& our_peer
 }
 
 // =========================================================================
-// Statistics and Information
-// =========================================================================
-
-nlohmann::json RatsClient::get_connection_statistics() const {
-    nlohmann::json stats;
-    
-    {
-        std::lock_guard<std::mutex> lock(peers_mutex_);
-        stats["total_peers"] = peers_.size();
-        stats["validated_peers"] = get_peer_count_unlocked();
-        stats["max_peers"] = max_peers_;
-    }
-    
-    stats["running"] = is_running();
-    stats["listen_port"] = listen_port_;
-    stats["our_peer_id"] = get_our_peer_id();
-    stats["encryption_enabled"] = is_encryption_enabled();
-    
-    // DHT statistics
-    if (dht_client_ && dht_client_->is_running()) {
-        stats["dht_running"] = true;
-        stats["dht_routing_table_size"] = get_dht_routing_table_size();
-    } else {
-        stats["dht_running"] = false;
-    }
-    
-    // mDNS statistics
-    stats["mdns_running"] = is_mdns_running();
-    
-    // Reconnection statistics
-    {
-        std::lock_guard<std::mutex> lock(reconnect_mutex_);
-        stats["reconnect_enabled"] = reconnect_config_.enabled;
-        stats["reconnect_queue_size"] = reconnect_queue_.size();
-        stats["reconnect_max_attempts"] = reconnect_config_.max_attempts;
-    }
-    
-    return stats;
-}
-
-
-// =========================================================================
-// Helper functions
+// Helper Functions
 // =========================================================================
 
 std::unique_ptr<RatsClient> create_rats_client(int listen_port) {
@@ -2683,52 +2342,4 @@ bool RatsClient::parse_address_string(const std::string& address_str, std::strin
     return !out_ip.empty() && out_port > 0 && out_port <= 65535;
 }
 
-// Cached formatting helpers - computed once on first use
-static const std::string& get_box_separator() {
-    static const std::string separator = supports_unicode() ? 
-        "════════════════════════════════════════════════════════════════════" :
-        "=====================================================================";
-    return separator;
-}
-
-static const std::string& get_box_vertical() {
-    static const std::string vertical = supports_unicode() ? "│" : "|";
-    return vertical;
-}
-
-static const std::string& get_checkmark() {
-    static const std::string checkmark = supports_unicode() ? "✓" : "[*]";
-    return checkmark;
-}
-
-void RatsClient::log_handshake_completion_unlocked(const RatsPeer& peer) {
-    // Calculate connection duration
-    auto now = std::chrono::steady_clock::now();
-    auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(now - peer.connected_at);
-    
-    // Get current peer count (assumes peers_mutex_ is already locked)
-    int current_peer_count = get_peer_count_unlocked();
-    
-    // Create visually appealing log output
-    std::string connection_type = peer.is_outgoing ? "OUTGOING" : "INCOMING";
-    const std::string& separator = get_box_separator();
-    const std::string& vertical = get_box_vertical();
-    const std::string& checkmark = get_checkmark();
-    
-    LOG_CLIENT_INFO("");
-    LOG_CLIENT_INFO(separator);
-    LOG_CLIENT_INFO(checkmark << " HANDSHAKE COMPLETED - NEW PEER CONNECTED");
-    LOG_CLIENT_INFO(separator);
-    LOG_CLIENT_INFO(vertical << " Peer ID       : " << peer.peer_id);
-    LOG_CLIENT_INFO(vertical << " Address       : " << peer.ip << ":" << peer.port);
-    LOG_CLIENT_INFO(vertical << " Connection    : " << connection_type);
-    LOG_CLIENT_INFO(vertical << " Protocol Ver. : " << peer.version);
-    LOG_CLIENT_INFO(vertical << " Socket        : " << peer.socket);
-    LOG_CLIENT_INFO(vertical << " Duration      : " << duration.count() << "ms");
-    LOG_CLIENT_INFO(vertical << " Network Peers : " << current_peer_count << "/" << max_peers_);
-    
-    LOG_CLIENT_INFO(separator);
-    LOG_CLIENT_INFO("");
-}
-
 } // namespace librats