feat(client): add rendezvous traversal coordinators (#12)

Closes #11

docs/api/rendezvous-v1.json

@@ -1054,6 +1054,7 @@
           "attemptId",
           "mediationHandle",
           "clientPunchCapability",
+          "connectionTicketDigest",
           "expiresAt"
         ],
         "type": "object",
@@ -1071,6 +1072,9 @@
           "clientPunchCapability": {
             "type": "string"
           },
+          "connectionTicketDigest": {
+            "type": "string"
+          },
           "expiresAt": {
             "type": "string",
             "format": "date-time"
@@ -1146,6 +1150,8 @@
           "attemptId",
           "mediationHandle",
           "hostPunchCapability",
+          "connectionTicketDigest",
+          "isCancelled",
           "expiresAt"
         ],
         "type": "object",
@@ -1159,6 +1165,12 @@
           "hostPunchCapability": {
             "type": "string"
           },
+          "connectionTicketDigest": {
+            "type": "string"
+          },
+          "isCancelled": {
+            "type": "boolean"
+          },
           "expiresAt": {
             "type": "string",
             "format": "date-time"

docs/architecture/0005-session-lease-lifecycle.md

@@ -60,12 +60,14 @@ the supplied ID.
 
 ### UDP presence
 
-Only a structurally valid `HostPresence` datagram with the issued capability can
-refresh presence. The public endpoint is the UDP packet's observed source on the
-host's gameplay socket; the HTTP API never accepts one. The bounded local candidate
-comes from the authenticated datagram. Invalid, unknown, or client-presence packets
-receive no response. Presence expiry demotes public visibility but keeps the lease,
-so the same handle can restore visibility without changing session identity.
+Only a structurally valid frozen `HostPresence` envelope or native LiteNetLib
+host-presence request with the issued capability can refresh presence. The public
+endpoint is the UDP packet's observed source on the host's gameplay socket; the
+HTTP API never accepts one. The bounded local candidate comes from the authenticated
+packet. Invalid or unknown inputs receive no response. ADR 0009 defines the later
+attempt-role use of frozen `ClientPresence` and native host/client requests.
+Presence expiry demotes public visibility but keeps the lease, so the same handle
+can restore visibility without changing session identity.
 
 Public listing responses contain bounded listing data only. They never contain
 public/local endpoints, lease tokens, presence capabilities, fingerprints, store

docs/architecture/0008-scoped-join-attempts-and-tickets.md

@@ -24,18 +24,24 @@ credentials plus opaque attempt and mediation IDs from a process-ephemeral HMAC
 key, the client subject, the complete canonical request fingerprint, a fresh salt,
 and a purpose/role label. Credentials are 32-byte base64url values (43 characters),
 below both the 192-character Rendezvous capability ceiling and LiteNetLib's
-256-character NAT token ceiling. State retains keyed credential fingerprints,
-derivation inputs, and salt—not issued plaintext. All diagnostic string
-representations redact credentials and derivation material.
+256-character NAT token ceiling. The connection ticket uses half of that payload
+for its attempt ID and half for an independently derived 128-bit authenticator, so
+the SDK can correlate concurrent introductions without increasing UDP response
+size. State retains keyed credential fingerprints, derivation inputs, and salt—not
+issued plaintext. All diagnostic string representations redact credentials and
+derivation material.
 
 The client receives only its punch capability. A host polls its own listing with
 the lease token in `X-Rendezvous-Lease-Token` and receives only host-role
 capabilities through a signed, listing-bound, five-minute cursor. Replaying an
 identical join request returns the same live attempt; changing the request under
 the same owner/key conflicts. A client may cancel with its punch capability in
-`X-Rendezvous-Client-Punch-Capability`; cancellation atomically removes the
-attempt. Listing deletion, expiry, revocation, or process restart removes every
-associated attempt and credential fingerprint.
+`X-Rendezvous-Client-Punch-Capability`; cancellation atomically marks the attempt
+and retains a bounded tombstone until its original expiry. Host polling returns
+that tombstone so a coordinator can revoke any local ticket authorization, while
+endpoint binding, introduction, ticket issuance, and ticket consumption all
+reject the cancelled attempt. Listing deletion, expiry, revocation, or process
+restart removes every associated attempt and credential fingerprint.
 
 Endpoint binding remains role- and capability-specific. The first endpoint
 observed for a role wins atomically; an exact UDP duplicate is idempotent, while
@@ -50,8 +56,14 @@ fingerprint-consumption seam for mediator tests and revocation. On the game host
 the SDK's bounded `ConnectionTicketValidator` stores a process-keyed digest,
 accepts an exact ticket once under a lock, rejects altered/cross-attempt/expired/
 revoked/replayed tickets, and zeroes retained digests and key material on disposal.
-Issue #11 carries the ticket in the authenticated introduction; issue #12 wires
-authorization and consumption into the caller-owned LiteNetLib coordinator.
+Issue #11 carries the fixed-size ticket in the authenticated introduction. Issue
+#12 extracts its embedded attempt ID, bounds the host's local authorization window
+by both the host-polled attempt expiry and the configured ticket lifetime, then
+wires one-time consumption into the caller-owned coordinator. Both peers receive
+a digest of the exact expected ticket over HTTP and reject any syntactically valid
+but unauthenticated introduction token. Embedding the ID prevents concurrent or
+late introductions from cross-binding a valid ticket while preserving the
+mediator's 2.0 response-byte amplification ceiling.
 
 ## Consequences
 

docs/architecture/0009-authenticated-litenet-nat-mediator.md

@@ -0,0 +1,68 @@
+# ADR 0009: authenticated bounded LiteNetLib NAT mediator
+
+- Status: Accepted
+- Date: 2026-07-16
+- Tracking: #11
+
+## Decision
+
+The server owns one LiteNetLib `NetManager` and its `NatPunchModule` on the
+configured UDP endpoint. It runs in manual mode with a configured maximum number
+of datagrams per poll and a short caller-owned poll interval. LiteNetLib events
+are unsynchronized so authenticated requests are processed immediately on that
+single polling path rather than accumulated in an unbounded event queue. The
+mediator never accepts a LiteNetLib gameplay connection or handles application
+payloads.
+
+The packet layer also consumes the frozen v1 presence envelope on the same
+socket. Native NAT requests use a canonical fixed-size 192-character token that
+binds a role (`HostPresence`, attempt `Host`, or attempt `Client`), mediation
+handle, and the already-issued capability. Both transports enter one processor
+and the same atomic store operations. No transport-supplied public address is
+trusted; the socket source is authoritative.
+
+LiteNetLib's native NAT packet family also contains introduction-response and
+punch frames that are appropriate for peers but unsafe on a public mediator: a
+forged response can name arbitrary destinations. The packet layer therefore
+decodes only the pinned `NatIntroduceRequest` wire shape and consumes every
+inbound packet before `NatPunchModule` sees it. The module is outbound-only and
+may send introductions solely from a completed authorized plan.
+
+Listing presence refreshes authorize no response. Attempt contributions bind the
+first observed endpoint for exactly one capability role. Exact duplicates are
+idempotent; a different endpoint, the opposite role, an expired/cancelled
+attempt, or a stale listing presence cannot replace it. The introduction is
+consumed atomically only after both roles bind and their observed address
+families match, preventing concurrent attempts for one listing from cross-wiring.
+
+A reported local candidate is eligible only when it is RFC 1918 IPv4 or IPv6
+unique-local unicast, matches the observed family, and both peers have the same
+observed public address. Otherwise `NatIntroduce` receives the observed public
+endpoint in the local slot. Loopback, link-local, multicast, unspecified,
+documentation IPv6, global-address claims, and cross-family claims are never
+disclosed as local targets. IPv4 is required; observed global IPv6 can be used
+when both peers contribute IPv6, without claiming guaranteed IPv6 NAT traversal.
+
+The introduction carries only the distinct connection ticket and is emitted at
+most once to each verified observed endpoint. The fixed authenticated native
+request and bounded frozen envelope keep the combined response bytes within the
+2.0 verified amplification budget; unauthenticated inputs receive zero bytes.
+Malformed, truncated, oversized, spoofed, or unrelated LiteNetLib packets do not
+grow Rendezvous state. Raw endpoints and credentials are never logged or exposed
+through diagnostic string representations.
+
+Frozen IPv6 listing-presence refresh remains valid because it emits no response.
+IPv6 attempt roles require the fixed-size native LiteNetLib request; accepting the
+short frozen envelope would exceed the 2.0 byte budget for two IPv6 introduction
+frames. The required IPv4 listen address and optional IPv6 listen address are
+configured separately so enabling one family never widens the other family to a
+wildcard bind.
+
+## Consequences
+
+- Hosts refresh listing presence and answer invitations from their actual
+  gameplay socket; a separate mediator socket would observe the wrong mapping.
+- Caller-owned SDK coordination in #12 must poll the host invitation endpoint,
+  send the corresponding native role token, and consume the returned ticket.
+- UDP loss can prevent traversal, but it cannot cause an arbitrary destination,
+  replay, role substitution, or cross-attempt introduction.

docs/architecture/README.md

@@ -11,6 +11,7 @@ decision requires a superseding ADR and corresponding contract/test updates.
 - [ADR 0006: bounded compatible session browser](0006-compatible-session-browser.md)
 - [ADR 0007: caller-owned .NET publisher and browser SDK](0007-caller-owned-dotnet-client-sdk.md)
 - [ADR 0008: scoped join attempts and one-time connection tickets](0008-scoped-join-attempts-and-tickets.md)
+- [ADR 0009: authenticated bounded LiteNetLib NAT mediator](0009-authenticated-litenet-nat-mediator.md)
 - [Threat model](../security/threat-model.md)
 - [Security promise and test matrix](../security/control-matrix.md)
 - [Versioned HTTP and UDP contracts](../contracts/README.md)

docs/contracts/udp-v1.md

@@ -1,11 +1,11 @@
-# UDP presence contract v1
+# UDP presence and NAT-punch contract v1
 
-Tracking: #4
+Tracking: #4, #11
 
-The UDP mediator accepts a single bounded presence envelope from a host or
-client. It associates the authenticated mediation handle with the packet's
-observed public source endpoint and the sender's reported local endpoint. It
-does not carry gameplay packets.
+The UDP mediator accepts the frozen bounded presence envelope below and native
+LiteNetLib NAT-introduction requests. Both forms associate an authenticated
+mediation handle with the packet's observed public source endpoint and the
+sender's reported local endpoint. Neither form carries gameplay packets.
 
 All multi-byte integers use network byte order. UUID bytes use the canonical
 RFC 4122 textual order (the byte pairs from the 32 hexadecimal digits), not the
@@ -49,5 +49,48 @@ Capabilities are short-lived, single-purpose, scoped to one mediation handle,
 and compared without exposing them in logs. A valid-looking packet does not
 prove authorization until the capability is checked. Invalid packets receive
 no UDP response, preventing the mediator from becoming an amplification oracle.
-Replay, expiry, pairing, and rate-limit policy are defined by later mediator
-issues; the v1 envelope deliberately leaves no unbounded or reflected payload.
+For the frozen envelope, `HostPresence` is resolved against either the listing's
+host-presence capability or an attempt's host-role capability. `ClientPresence`
+is resolved only against the attempt's client-role capability. Handles are
+globally distinct in the active store, so this does not permit role confusion.
+
+## Native LiteNetLib request token
+
+A game using LiteNetLib sends `NatPunchModule.SendNatIntroduceRequest` from its
+gameplay `NetManager`. The `additionalInfo` value is produced by
+`NatPunchRequestTokenCodec` and is exactly 192 ASCII characters:
+
+```text
+rv1:<role>:<32 lowercase handle hex>:<43-character capability><dot padding>
+```
+
+`role` is `p` for listing host-presence refresh, `h` for the host side of a join
+attempt, or `c` for its client side. Padding is canonical and leaves the token
+below LiteNetLib's 256-character ceiling. Its fixed size also ensures that the
+two authenticated introduction responses remain within the 2.0 response-byte
+budget. Tokens with a wrong length, role, handle, capability, or padding receive
+no response.
+
+The mediator runs LiteNetLib in bounded manual-poll mode. Its packet layer admits
+only the pinned native `NatIntroduceRequest` frame, consumes every inbound frame
+before LiteNetLib can act on it, and uses `NatPunchModule` only to emit authorized
+introductions. Native and frozen v1 inputs reach the same atomic role/capability
+checks. Only the packet source is
+used as the public endpoint. A claimed private candidate is retained only when
+it is private unicast, matches the observed address family, and both authorized
+peers were observed behind the same public address; otherwise the observed
+public endpoint is substituted. IPv4 punching is required. IPv6 sources must be
+observed global unicast and both roles must use IPv6; IPv6 NAT traversal remains
+best-effort rather than a v1 release requirement.
+
+The second valid contribution atomically consumes the introduction and starts
+the connection-ticket lifetime. `NatIntroduce` is called once with the distinct
+43-character connection ticket. Reordered and exact duplicate requests are
+idempotent. Endpoint substitution, cross-role use, stale host presence, expired
+or cancelled attempts, malformed packets, and gameplay payloads produce no
+introduction and create no mediator queue or endpoint state.
+
+Frozen envelopes may refresh listing presence over IPv6 because that operation
+has no response. IPv6 attempt contributions must use the fixed-size native token;
+the shorter frozen IPv6 envelope cannot fund two IPv6 introduction frames within
+the 2.0 response-byte ceiling and is therefore dropped without response.

src/FinalFactory.Rendezvous.Client/JoinAttempts/RendezvousJoinClient.cs

@@ -0,0 +1,148 @@
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public sealed class RendezvousJoinClient : IRendezvousJoinClient
+{
+    private const string LeaseTokenHeader = "X-Rendezvous-Lease-Token";
+    private const string ClientPunchCapabilityHeader = "X-Rendezvous-Client-Punch-Capability";
+
+    private readonly RendezvousHttpTransport _transport;
+
+    public RendezvousJoinClient(
+        HttpClient httpClient,
+        RendezvousClientOptions? options = null,
+        IRendezvousDelay? delay = null)
+    {
+        _transport = new(httpClient, options, delay);
+    }
+
+    public Task<RendezvousClientResult<CreateJoinAttemptResponse>> CreateAsync(
+        CreateJoinAttemptRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        if (request is null)
+        {
+            throw new ArgumentNullException(nameof(request));
+        }
+        CreateJoinAttemptRequest body = new()
+        {
+            ContractVersion = request.ContractVersion,
+            IdempotencyKey = request.IdempotencyKey,
+            GameId = request.GameId,
+            EnvironmentId = request.EnvironmentId,
+            ListingId = request.ListingId,
+            ProtocolVersion = request.ProtocolVersion,
+        };
+        return _transport.SendSafeAsync<CreateJoinAttemptResponse>(
+            () => RendezvousHttpTransport.JsonRequest(HttpMethod.Post, "v1/join-attempts", body),
+            cancellationToken);
+    }
+
+    public Task<RendezvousClientResult<bool>> CancelAsync(
+        CreateJoinAttemptResponse attempt,
+        CancellationToken cancellationToken = default)
+    {
+        if (attempt is null)
+        {
+            throw new ArgumentNullException(nameof(attempt));
+        }
+        return _transport.SendSafeAsync<bool>(
+            () => HeaderRequest(
+                HttpMethod.Delete,
+                $"v1/join-attempts/{attempt.AttemptId}",
+                ClientPunchCapabilityHeader,
+                RequireHeaderValue(attempt.ClientPunchCapability, nameof(attempt))),
+            cancellationToken);
+    }
+
+    public Task<RendezvousClientResult<BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(
+        PublishedSession session,
+        int pageSize = ContractLimits.BrowserPageMaxItems,
+        string? cursor = null,
+        CancellationToken cancellationToken = default)
+    {
+        if (session is null)
+        {
+            throw new ArgumentNullException(nameof(session));
+        }
+        if (pageSize is < 1 or > ContractLimits.BrowserPageMaxItems)
+        {
+            throw new ArgumentOutOfRangeException(nameof(pageSize));
+        }
+
+        string query = $"v1/sessions/{session.ListingId}/join-attempts"
+            + $"?contractVersion={ContractLimits.ContractVersion}"
+            + $"&pageSize={pageSize}"
+            + (cursor is null ? string.Empty : $"&cursor={Uri.EscapeDataString(cursor)}");
+        return _transport.SendSafeAsync<BrowseHostJoinAttemptsResponse>(
+            () => HeaderRequest(
+                HttpMethod.Get,
+                query,
+                LeaseTokenHeader,
+                RequireHeaderValue(session.LeaseToken, nameof(session))),
+            cancellationToken);
+    }
+
+    public async Task<RendezvousClientResult<IReadOnlyList<HostJoinAttempt>>> BrowseAllForHostAsync(
+        PublishedSession session,
+        int maximumPages = 100,
+        CancellationToken cancellationToken = default)
+    {
+        if (session is null)
+        {
+            throw new ArgumentNullException(nameof(session));
+        }
+        if (maximumPages is < 1 or > 1_000)
+        {
+            throw new ArgumentOutOfRangeException(nameof(maximumPages));
+        }
+
+        List<HostJoinAttempt> attempts = [];
+        string? cursor = null;
+        for (int page = 0; page < maximumPages; page++)
+        {
+            RendezvousClientResult<BrowseHostJoinAttemptsResponse> result =
+                await BrowseForHostAsync(
+                    session,
+                    ContractLimits.BrowserPageMaxItems,
+                    cursor,
+                    cancellationToken).ConfigureAwait(false);
+            if (!result.IsSuccess || result.Value is null)
+            {
+                return RendezvousClientResult.Failure<IReadOnlyList<HostJoinAttempt>>(
+                    result.Error,
+                    result.Message,
+                    result.RetryAfterSeconds);
+            }
+
+            attempts.AddRange(result.Value.Items);
+            cursor = result.Value.NextCursor;
+            if (string.IsNullOrEmpty(cursor))
+            {
+                return RendezvousClientResult.Success<IReadOnlyList<HostJoinAttempt>>(
+                    attempts.AsReadOnly());
+            }
+        }
+
+        return RendezvousClientResult.Failure<IReadOnlyList<HostJoinAttempt>>(
+            RendezvousErrorCode.CapacityExceeded,
+            $"Host invitation polling exceeded the configured {maximumPages}-page limit.");
+    }
+
+    private static HttpRequestMessage HeaderRequest(
+        HttpMethod method,
+        string uri,
+        string header,
+        string value)
+    {
+        HttpRequestMessage request = new(method, uri);
+        request.Headers.TryAddWithoutValidation(header, value);
+        return request;
+    }
+
+    private static string RequireHeaderValue(string value, string parameterName) =>
+        !string.IsNullOrWhiteSpace(value)
+            ? value
+            : throw new ArgumentException("The required capability is missing.", parameterName);
+}

src/FinalFactory.Rendezvous.Client/README.md

@@ -1,6 +1,6 @@
 # FinalFactory.Rendezvous.Client
 
-Godot-independent .NET publisher and session-browser SDK for Rendezvous v1.
+Godot-independent .NET publisher, browser, join, and LiteNetLib traversal SDK for Rendezvous v1.
 The package targets `netstandard2.1` and uses a caller-owned `HttpClient`.
 
 ```csharp
@@ -42,6 +42,86 @@ if (!registered.IsSuccess || registered.Value is null)
 Load `publisherCredential` from the game's deployment secret boundary; never
 embed it in a client build or source control. A successful registration returns a
 `PublishedSession` containing the lease and host-presence capabilities.
+Send a periodic presence request from the host's gameplay `NetManager` using the
+server-controlled refresh interval and the fixed-size native token:
+
+```csharp
+string presenceToken = NatPunchRequestTokenCodec.Encode(
+    NatPunchPeerRole.HostPresence,
+    session.HostPresenceHandle,
+    session.HostPresenceCapability);
+gameplayNetManager.NatPunchModule.SendNatIntroduceRequest(mediator, presenceToken);
+```
+
+For direct connections, let the SDK drive those tokens from the same caller-owned
+LiteNetLib socket that carries gameplay. Ask the routing listener to create the
+bound manager, then configure and start that caller-owned manager yourself. The
+factory does not open a socket, and synchronized events must remain enabled:
+
+```csharp
+RendezvousNetListener networkEvents = new();
+NetManager gameplayNetManager = networkEvents.CreateManager();
+if (!gameplayNetManager.Start(0))
+{
+    throw new InvalidOperationException("The gameplay UDP socket could not start.");
+}
+```
+
+The host polls join invitations asynchronously; that method only queues a
+snapshot and never calls the manager. `Poll()` is the sole SDK path that invokes
+LiteNetLib and dispatches its synchronized callbacks. Call it once per game
+frame on the thread that owns the manager:
+
+```csharp
+RendezvousJoinClient joins = new(http);
+using RendezvousHostCoordinator host = new(
+    gameplayNetManager,
+    networkEvents,
+    mediatorEndPoint,
+    session,
+    joins);
+
+// Run periodically from the game's normal async scheduling path.
+await host.RefreshJoinAttemptsAsync(cancellationToken);
+
+// Godot _Process, Update, or the equivalent main-thread frame callback.
+host.Poll();
+```
+
+Do not also call `gameplayNetManager.PollEvents()` or
+`gameplayNetManager.NatPunchModule.PollEvents()` when a coordinator owns polling.
+The host coordinator refreshes host presence, punches for queued invitations,
+validates the introduction ticket, and accepts the direct request. Subscribe to
+`AttemptCompleted`; a `Connected` result is raised only after LiteNetLib reports
+the accepted peer as connected. Register ordinary gameplay callbacks on
+`networkEvents.GameplayEvents`; the routing listener reserves Rendezvous direct
+requests for ticket validation and forwards every other callback normally.
+
+The joining game first creates the HTTP attempt, then uses its own already-started
+gameplay manager in the same frame loop:
+
+```csharp
+CreateJoinAttemptResponse attempt = (await joins.CreateAsync(
+    createJoinRequest,
+    cancellationToken)).Value
+    ?? throw new InvalidOperationException("Join issuance failed.");
+using RendezvousClientCoordinator client = new(
+    gameplayNetManager,
+    networkEvents,
+    mediatorEndPoint,
+    attempt);
+
+// Godot _Process, Update, or the equivalent main-thread frame callback.
+client.Poll();
+```
+
+NAT introduction changes the client state to `Connecting`; it is not success.
+Only `Connected` supplies `ConnectedPeer`. Call `Cancel()` and then `Poll()` for
+local cancellation, or `CancelAsync(joins, cancellationToken)` to also revoke the
+service attempt. Terminal client paths release all event subscriptions. Disposing
+a coordinator never stops or disposes the caller-owned manager and does not touch
+an in-flight peer; call `Cancel()` followed by `Poll()` first when that peer must
+also be disconnected.
 
 Lease renewal is explicit and caller-controlled:
 

src/FinalFactory.Rendezvous.Client/RendezvousClientAbstractions.cs

@@ -42,6 +42,10 @@ public static class RendezvousClientResult
 
 public sealed class PublishedSession
 {
+    private readonly object _timingGate = new();
+    private DateTimeOffset _expiresAt;
+    private int _leaseRenewAfterSeconds;
+
     internal PublishedSession(RegisterSessionResponse response)
     {
         ListingId = response.ListingId;
@@ -49,8 +53,8 @@ public sealed class PublishedSession
         LeaseToken = response.LeaseToken;
         HostPresenceHandle = response.HostPresenceHandle;
         HostPresenceCapability = response.HostPresenceCapability;
-        ExpiresAt = response.ExpiresAt;
-        LeaseRenewAfterSeconds = response.LeaseRenewAfterSeconds;
+        _expiresAt = response.ExpiresAt;
+        _leaseRenewAfterSeconds = response.LeaseRenewAfterSeconds;
         HostPresenceRefreshAfterSeconds = response.HostPresenceRefreshAfterSeconds;
     }
 
@@ -59,8 +63,41 @@ public sealed class PublishedSession
     public string LeaseToken { get; }
     public MediationHandle HostPresenceHandle { get; }
     public string HostPresenceCapability { get; }
-    public DateTimeOffset ExpiresAt { get; internal set; }
-    public int LeaseRenewAfterSeconds { get; internal set; }
+    public DateTimeOffset ExpiresAt
+    {
+        get
+        {
+            lock (_timingGate)
+            {
+                return _expiresAt;
+            }
+        }
+        internal set
+        {
+            lock (_timingGate)
+            {
+                _expiresAt = value;
+            }
+        }
+    }
+
+    public int LeaseRenewAfterSeconds
+    {
+        get
+        {
+            lock (_timingGate)
+            {
+                return _leaseRenewAfterSeconds;
+            }
+        }
+        internal set
+        {
+            lock (_timingGate)
+            {
+                _leaseRenewAfterSeconds = value;
+            }
+        }
+    }
     public int HostPresenceRefreshAfterSeconds { get; }
 
     public override string ToString() => $"[PublishedSession {ListingId}; credentials redacted]";
@@ -109,6 +146,28 @@ public interface IRendezvousSessionBrowserClient
         CancellationToken cancellationToken = default);
 }
 
+public interface IRendezvousJoinClient
+{
+    Task<RendezvousClientResult<CreateJoinAttemptResponse>> CreateAsync(
+        CreateJoinAttemptRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<RendezvousClientResult<bool>> CancelAsync(
+        CreateJoinAttemptResponse attempt,
+        CancellationToken cancellationToken = default);
+
+    Task<RendezvousClientResult<BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(
+        PublishedSession session,
+        int pageSize = ContractLimits.BrowserPageMaxItems,
+        string? cursor = null,
+        CancellationToken cancellationToken = default);
+
+    Task<RendezvousClientResult<IReadOnlyList<HostJoinAttempt>>> BrowseAllForHostAsync(
+        PublishedSession session,
+        int maximumPages = 100,
+        CancellationToken cancellationToken = default);
+}
+
 public interface IRendezvousDelay
 {
     Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken);

src/FinalFactory.Rendezvous.Client/Traversal/DirectConnectionRequestCodec.cs

@@ -0,0 +1,83 @@
+using System.Text;
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public sealed class DirectConnectionRequest
+{
+    public JoinAttemptId AttemptId { get; set; }
+    public string ConnectionTicket { get; set; } = string.Empty;
+
+    public override string ToString() =>
+        $"[DirectConnectionRequest {AttemptId}; ticket redacted]";
+}
+
+public static class DirectConnectionRequestCodec
+{
+    public const int EncodedLength = 63;
+
+    private const int MagicLength = 4;
+    private const int AttemptIdLength = 16;
+    private const int TicketLength = ContractLimits.DerivedCredentialCharacters;
+    private static readonly byte[] Magic = [(byte)'R', (byte)'V', (byte)'D', (byte)'1'];
+
+    public static bool IsRendezvousRequest(ReadOnlySpan<byte> encoded) =>
+        encoded.Length >= MagicLength && encoded[..MagicLength].SequenceEqual(Magic);
+
+    public static byte[] Encode(JoinAttemptId attemptId, string connectionTicket)
+    {
+        if (attemptId.Value == Guid.Empty
+            || connectionTicket is null
+            || connectionTicket.Length != TicketLength
+            || !ContractValidation.IsConnectionTicketValid(connectionTicket))
+        {
+            throw new ArgumentException("The direct connection request fields are invalid.");
+        }
+
+        byte[] encoded = new byte[EncodedLength];
+        Magic.CopyTo(encoded, 0);
+        if (!attemptId.Value.TryWriteBytes(encoded.AsSpan(MagicLength, AttemptIdLength)))
+        {
+            throw new InvalidOperationException("The join attempt identifier could not be encoded.");
+        }
+
+        Encoding.ASCII.GetBytes(
+            connectionTicket,
+            0,
+            connectionTicket.Length,
+            encoded,
+            MagicLength + AttemptIdLength);
+        return encoded;
+    }
+
+    public static bool TryDecode(
+        ReadOnlySpan<byte> encoded,
+        out DirectConnectionRequest? request)
+    {
+        request = null;
+        if (encoded.Length != EncodedLength
+            || !encoded[..MagicLength].SequenceEqual(Magic))
+        {
+            return false;
+        }
+
+        Guid attemptId = new(encoded.Slice(MagicLength, AttemptIdLength));
+        if (attemptId == Guid.Empty)
+        {
+            return false;
+        }
+
+        string ticket = Encoding.ASCII.GetString(encoded[(MagicLength + AttemptIdLength)..]);
+        if (!ContractValidation.IsConnectionTicketValid(ticket))
+        {
+            return false;
+        }
+
+        request = new DirectConnectionRequest
+        {
+            AttemptId = new JoinAttemptId(attemptId),
+            ConnectionTicket = ticket,
+        };
+        return true;
+    }
+}

src/FinalFactory.Rendezvous.Client/Traversal/RendezvousClientCoordinator.cs

@@ -0,0 +1,290 @@
+using System.Net;
+using FinalFactory.Rendezvous.Contracts;
+using LiteNetLib;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public sealed class RendezvousClientCoordinator : IDisposable
+{
+    private readonly NetManager _manager;
+    private readonly RendezvousNetListener _networkEvents;
+    private readonly EventBasedNatPunchListener _punchEvents;
+    private readonly IPEndPoint _mediator;
+    private readonly CreateJoinAttemptResponse _attempt;
+    private readonly IRendezvousCoordinatorClock _clock;
+    private readonly RendezvousPunchRetrySchedule _retry;
+    private NetPeer? _connectingPeer;
+    private bool _cancelRequested;
+    private int _polling;
+    private bool _subscriptionsReleased;
+    private bool _disposed;
+
+    public RendezvousClientCoordinator(
+        NetManager manager,
+        RendezvousNetListener networkEvents,
+        IPEndPoint mediator,
+        CreateJoinAttemptResponse attempt,
+        RendezvousCoordinatorOptions? options = null)
+        : this(
+            manager,
+            networkEvents,
+            mediator,
+            attempt,
+            options,
+            new SystemRendezvousCoordinatorClock())
+    {
+    }
+
+    internal RendezvousClientCoordinator(
+        NetManager manager,
+        RendezvousNetListener networkEvents,
+        IPEndPoint mediator,
+        CreateJoinAttemptResponse attempt,
+        RendezvousCoordinatorOptions? options,
+        IRendezvousCoordinatorClock clock)
+    {
+        _manager = manager ?? throw new ArgumentNullException(nameof(manager));
+        _networkEvents = networkEvents ?? throw new ArgumentNullException(nameof(networkEvents));
+        _punchEvents = _networkEvents.PunchEvents;
+        _mediator = mediator ?? throw new ArgumentNullException(nameof(mediator));
+        _attempt = attempt ?? throw new ArgumentNullException(nameof(attempt));
+        _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+        RendezvousCoordinatorOptions validated = (options ?? new RendezvousCoordinatorOptions())
+            .CopyAndValidate();
+        _retry = new(validated, _clock);
+
+        RendezvousManagerGuard.Validate(_manager, _networkEvents);
+        if (_mediator.Port is < 1 or > 65_535
+            || _attempt.AttemptId.Value == Guid.Empty
+            || _attempt.MediationHandle.Value == Guid.Empty
+            || !ContractValidation.IsCapabilityValid(_attempt.ClientPunchCapability)
+            || !ContractValidation.IsConnectionTicketValid(_attempt.ConnectionTicketDigest)
+            || _attempt.ExpiresAt <= _clock.UtcNow)
+        {
+            throw new ArgumentException("The client traversal inputs are invalid.");
+        }
+
+        _networkEvents.RendezvousPeerConnected += OnPeerConnected;
+        _networkEvents.RendezvousPeerDisconnected += OnPeerDisconnected;
+        _punchEvents.NatIntroductionSuccess += OnNatIntroductionSuccess;
+    }
+
+    public event EventHandler<RendezvousConnectionCompletedEventArgs>? Completed;
+
+    public RendezvousConnectionState State { get; private set; } = RendezvousConnectionState.Punching;
+    public NetPeer? ConnectedPeer { get; private set; }
+    public bool IsCompleted => IsTerminal(State);
+
+    public void Cancel() => Volatile.Write(ref _cancelRequested, true);
+
+    public async Task<RendezvousClientResult<bool>> CancelAsync(
+        IRendezvousJoinClient joinClient,
+        CancellationToken cancellationToken = default)
+    {
+        if (joinClient is null)
+        {
+            throw new ArgumentNullException(nameof(joinClient));
+        }
+
+        ThrowIfDisposed();
+        Cancel();
+        return await joinClient.CancelAsync(_attempt, cancellationToken).ConfigureAwait(false);
+    }
+
+    public void Poll()
+    {
+        ThrowIfDisposed();
+        if (IsCompleted)
+        {
+            return;
+        }
+
+        if (Interlocked.Exchange(ref _polling, 1) != 0)
+        {
+            throw new InvalidOperationException("The Rendezvous coordinator cannot be polled concurrently or recursively.");
+        }
+
+        try
+        {
+            if (Volatile.Read(ref _cancelRequested))
+            {
+                DisconnectPendingPeer();
+                Complete(RendezvousConnectionState.Cancelled);
+                return;
+            }
+
+            if (!_manager.IsRunning)
+            {
+                Complete(RendezvousConnectionState.ManagerStopped);
+                return;
+            }
+
+            _manager.PollEvents();
+            _manager.NatPunchModule.PollEvents();
+            if (IsCompleted)
+            {
+                return;
+            }
+
+            DateTimeOffset now = _clock.UtcNow;
+            if (Volatile.Read(ref _cancelRequested))
+            {
+                DisconnectPendingPeer();
+                Complete(RendezvousConnectionState.Cancelled);
+            }
+            else if (!_manager.IsRunning)
+            {
+                Complete(RendezvousConnectionState.ManagerStopped);
+            }
+            else if (now >= _attempt.ExpiresAt)
+            {
+                DisconnectPendingPeer();
+                Complete(RendezvousConnectionState.TimedOut);
+            }
+            else if (State == RendezvousConnectionState.Punching && _retry.IsDue(now))
+            {
+                if (_retry.IsExhausted)
+                {
+                    Complete(RendezvousConnectionState.TimedOut);
+                    return;
+                }
+
+                _manager.NatPunchModule.SendNatIntroduceRequest(
+                    _mediator,
+                    NatPunchRequestTokenCodec.Encode(
+                        NatPunchPeerRole.Client,
+                        _attempt.MediationHandle,
+                        _attempt.ClientPunchCapability));
+                _retry.RecordRequest();
+            }
+        }
+        finally
+        {
+            Volatile.Write(ref _polling, 0);
+        }
+    }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        if (!IsCompleted)
+        {
+            Complete(RendezvousConnectionState.Disposed);
+        }
+
+        ReleaseSubscriptions();
+        _disposed = true;
+    }
+
+    public override string ToString() =>
+        $"[RendezvousClientCoordinator {_attempt.AttemptId}; credentials redacted]";
+
+    private void OnNatIntroductionSuccess(
+        IPEndPoint target,
+        NatAddressType addressType,
+        string encodedIntroduction)
+    {
+        _ = addressType;
+        if (State != RendezvousConnectionState.Punching
+            || !NatIntroductionTokenCodec.TryDecode(
+                encodedIntroduction,
+                out NatIntroductionToken? introduction)
+            || introduction is null
+            || introduction.AttemptId != _attempt.AttemptId
+            || !NatIntroductionTokenCodec.MatchesDigest(
+                introduction.ConnectionTicket,
+                _attempt.ConnectionTicketDigest))
+        {
+            return;
+        }
+
+        byte[] connectionData = DirectConnectionRequestCodec.Encode(
+            introduction.AttemptId,
+            introduction.ConnectionTicket);
+        _connectingPeer = _manager.Connect(target, connectionData);
+        if (_connectingPeer is null
+            || _connectingPeer.ConnectionState != ConnectionState.Outgoing)
+        {
+            _connectingPeer = null;
+            Complete(RendezvousConnectionState.Rejected);
+            return;
+        }
+
+        State = RendezvousConnectionState.Connecting;
+    }
+
+    private void OnPeerConnected(NetPeer peer)
+    {
+        if (State != RendezvousConnectionState.Connecting
+            || !ReferenceEquals(peer, _connectingPeer))
+        {
+            return;
+        }
+
+        ConnectedPeer = peer;
+        Complete(RendezvousConnectionState.Connected, peer);
+    }
+
+    private void OnPeerDisconnected(NetPeer peer, DisconnectInfo disconnectInfo)
+    {
+        _ = disconnectInfo;
+        if (State == RendezvousConnectionState.Connecting
+            && ReferenceEquals(peer, _connectingPeer))
+        {
+            Complete(RendezvousConnectionState.Rejected);
+        }
+    }
+
+    private void DisconnectPendingPeer()
+    {
+        if (_connectingPeer is not null && State == RendezvousConnectionState.Connecting)
+        {
+            _connectingPeer.Disconnect();
+        }
+    }
+
+    private void Complete(RendezvousConnectionState terminalState, NetPeer? peer = null)
+    {
+        if (IsCompleted)
+        {
+            return;
+        }
+
+        State = terminalState;
+        ReleaseSubscriptions();
+        Completed?.Invoke(this, new(terminalState, peer));
+    }
+
+    private void ReleaseSubscriptions()
+    {
+        if (_subscriptionsReleased)
+        {
+            return;
+        }
+
+        _networkEvents.RendezvousPeerConnected -= OnPeerConnected;
+        _networkEvents.RendezvousPeerDisconnected -= OnPeerDisconnected;
+        _punchEvents.NatIntroductionSuccess -= OnNatIntroductionSuccess;
+        _subscriptionsReleased = true;
+    }
+
+    private static bool IsTerminal(RendezvousConnectionState state) => state is
+        RendezvousConnectionState.Connected
+        or RendezvousConnectionState.Cancelled
+        or RendezvousConnectionState.TimedOut
+        or RendezvousConnectionState.Rejected
+        or RendezvousConnectionState.ManagerStopped
+        or RendezvousConnectionState.Disposed;
+
+    private void ThrowIfDisposed()
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(nameof(RendezvousClientCoordinator));
+        }
+    }
+}

src/FinalFactory.Rendezvous.Client/Traversal/RendezvousCoordinatorAbstractions.cs

@@ -0,0 +1,124 @@
+using System.Security.Cryptography;
+using LiteNetLib;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public enum RendezvousConnectionState
+{
+    Punching = 1,
+    Connecting = 2,
+    Connected = 3,
+    Cancelled = 4,
+    TimedOut = 5,
+    Rejected = 6,
+    ManagerStopped = 7,
+    Disposed = 8,
+}
+
+public sealed class RendezvousConnectionCompletedEventArgs(
+    RendezvousConnectionState state,
+    NetPeer? peer = null) : EventArgs
+{
+    public RendezvousConnectionState State { get; } = state;
+    public NetPeer? Peer { get; } = peer;
+}
+
+public sealed class RendezvousCoordinatorOptions
+{
+    public int MaximumPunchRequests { get; set; } = 5;
+    public int MaximumAttemptChecksPerPoll { get; set; } = 128;
+    public TimeSpan InitialPunchRetryDelay { get; set; } = TimeSpan.FromMilliseconds(200);
+    public TimeSpan MaximumPunchRetryDelay { get; set; } = TimeSpan.FromSeconds(2);
+    public TimeSpan ConnectionTicketLifetime { get; set; } = TimeSpan.FromSeconds(20);
+    public double JitterRatio { get; set; } = 0.2;
+
+    internal RendezvousCoordinatorOptions CopyAndValidate()
+    {
+        if (MaximumPunchRequests is < 1 or > 20
+            || MaximumAttemptChecksPerPoll is < 1 or > 1_024
+            || InitialPunchRetryDelay < TimeSpan.FromMilliseconds(10)
+            || MaximumPunchRetryDelay < InitialPunchRetryDelay
+            || MaximumPunchRetryDelay > TimeSpan.FromSeconds(10)
+            || ConnectionTicketLifetime <= TimeSpan.Zero
+            || ConnectionTicketLifetime > TimeSpan.FromSeconds(20)
+            || JitterRatio is < 0 or > 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(RendezvousCoordinatorOptions));
+        }
+
+        return new RendezvousCoordinatorOptions
+        {
+            MaximumPunchRequests = MaximumPunchRequests,
+            MaximumAttemptChecksPerPoll = MaximumAttemptChecksPerPoll,
+            InitialPunchRetryDelay = InitialPunchRetryDelay,
+            MaximumPunchRetryDelay = MaximumPunchRetryDelay,
+            ConnectionTicketLifetime = ConnectionTicketLifetime,
+            JitterRatio = JitterRatio,
+        };
+    }
+}
+
+internal interface IRendezvousCoordinatorClock
+{
+    DateTimeOffset UtcNow { get; }
+}
+
+internal sealed class SystemRendezvousCoordinatorClock : IRendezvousCoordinatorClock
+{
+    public DateTimeOffset UtcNow => DateTimeOffset.UtcNow;
+}
+
+internal static class RendezvousManagerGuard
+{
+    internal static void Validate(
+        NetManager manager,
+        RendezvousNetListener networkEvents)
+    {
+        networkEvents.ValidateManager(manager);
+        if (!manager.IsRunning)
+        {
+            throw new InvalidOperationException("The caller-owned LiteNetLib manager must be running.");
+        }
+
+        if (!manager.NatPunchEnabled
+            || manager.UnsyncedEvents
+            || manager.NatPunchModule.UnsyncedEvents)
+        {
+            throw new InvalidOperationException(
+                "The caller-owned manager must enable NAT punching and synchronized event dispatch.");
+        }
+    }
+}
+
+internal sealed class RendezvousPunchRetrySchedule(
+    RendezvousCoordinatorOptions options,
+    IRendezvousCoordinatorClock clock)
+{
+    public int RequestsSent { get; private set; }
+    public DateTimeOffset NextRequestAt { get; private set; } = DateTimeOffset.MinValue;
+
+    public bool IsExhausted => RequestsSent >= options.MaximumPunchRequests;
+
+    public bool IsDue(DateTimeOffset now) => now >= NextRequestAt;
+
+    public void RecordRequest()
+    {
+        int exponent = Math.Min(RequestsSent, 30);
+        RequestsSent++;
+        double milliseconds = Math.Min(
+            options.InitialPunchRetryDelay.TotalMilliseconds * Math.Pow(2, exponent),
+            options.MaximumPunchRetryDelay.TotalMilliseconds);
+        if (options.JitterRatio > 0)
+        {
+            Span<byte> random = stackalloc byte[1];
+            RandomNumberGenerator.Fill(random);
+            double unit = random[0] / 255d;
+            double multiplier = 1 - options.JitterRatio + (2 * options.JitterRatio * unit);
+            milliseconds = Math.Min(
+                milliseconds * multiplier,
+                options.MaximumPunchRetryDelay.TotalMilliseconds);
+        }
+
+        NextRequestAt = clock.UtcNow + TimeSpan.FromMilliseconds(milliseconds);
+    }
+}

src/FinalFactory.Rendezvous.Client/Traversal/RendezvousHostCoordinator.cs

@@ -0,0 +1,547 @@
+using System.Net;
+using FinalFactory.Rendezvous.Contracts;
+using LiteNetLib;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public enum RendezvousHostState
+{
+    Active = 1,
+    ManagerStopped = 2,
+    Disposed = 3,
+}
+
+public sealed class RendezvousHostAttemptCompletedEventArgs(
+    JoinAttemptId attemptId,
+    RendezvousConnectionState state,
+    NetPeer? peer = null) : EventArgs
+{
+    public JoinAttemptId AttemptId { get; } = attemptId;
+    public RendezvousConnectionState State { get; } = state;
+    public NetPeer? Peer { get; } = peer;
+}
+
+public sealed class RendezvousHostCoordinator : IDisposable
+{
+    private readonly NetManager _manager;
+    private readonly RendezvousNetListener _networkEvents;
+    private readonly EventBasedNatPunchListener _punchEvents;
+    private readonly IPEndPoint _mediator;
+    private readonly PublishedSession _session;
+    private readonly IRendezvousJoinClient _joinClient;
+    private readonly RendezvousCoordinatorOptions _options;
+    private readonly IRendezvousCoordinatorClock _clock;
+    private readonly ConnectionTicketValidator _tickets;
+    private readonly Dictionary<JoinAttemptId, PendingHostAttempt> _attempts = [];
+    private readonly Dictionary<NetPeer, JoinAttemptId> _acceptedPeers = [];
+    private readonly Dictionary<JoinAttemptId, DeferredConnectionRequest> _deferredRequests = [];
+    private readonly Dictionary<JoinAttemptId, DateTimeOffset> _terminalAttempts = [];
+    private readonly Queue<JoinAttemptId> _attemptSchedule = [];
+    private readonly List<JoinAttemptId> _cleanupScratch = [];
+    private HostJoinAttempt[]? _latestSnapshot;
+    private DateTimeOffset _nextPresenceAt = DateTimeOffset.MinValue;
+    private DateTimeOffset _nextTerminalCleanupAt = DateTimeOffset.MinValue;
+    private int _refreshing;
+    private int _polling;
+    private bool _subscriptionsReleased;
+    private int _disposed;
+
+    public RendezvousHostCoordinator(
+        NetManager manager,
+        RendezvousNetListener networkEvents,
+        IPEndPoint mediator,
+        PublishedSession session,
+        IRendezvousJoinClient joinClient,
+        RendezvousCoordinatorOptions? options = null)
+        : this(
+            manager,
+            networkEvents,
+            mediator,
+            session,
+            joinClient,
+            options,
+            new SystemRendezvousCoordinatorClock(),
+            null)
+    {
+    }
+
+    internal RendezvousHostCoordinator(
+        NetManager manager,
+        RendezvousNetListener networkEvents,
+        IPEndPoint mediator,
+        PublishedSession session,
+        IRendezvousJoinClient joinClient,
+        RendezvousCoordinatorOptions? options,
+        IRendezvousCoordinatorClock clock,
+        ConnectionTicketValidator? tickets)
+    {
+        _manager = manager ?? throw new ArgumentNullException(nameof(manager));
+        _networkEvents = networkEvents ?? throw new ArgumentNullException(nameof(networkEvents));
+        _punchEvents = _networkEvents.PunchEvents;
+        _mediator = mediator ?? throw new ArgumentNullException(nameof(mediator));
+        _session = session ?? throw new ArgumentNullException(nameof(session));
+        _joinClient = joinClient ?? throw new ArgumentNullException(nameof(joinClient));
+        _options = (options ?? new RendezvousCoordinatorOptions()).CopyAndValidate();
+        _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+        _tickets = tickets ?? new ConnectionTicketValidator();
+
+        RendezvousManagerGuard.Validate(_manager, _networkEvents);
+        ValidateInputs();
+        _networkEvents.RendezvousConnectionRequest += OnConnectionRequest;
+        _networkEvents.RendezvousPeerConnected += OnPeerConnected;
+        _networkEvents.RendezvousPeerDisconnected += OnPeerDisconnected;
+        _punchEvents.NatIntroductionSuccess += OnNatIntroductionSuccess;
+    }
+
+    public event EventHandler<RendezvousHostAttemptCompletedEventArgs>? AttemptCompleted;
+
+    public RendezvousHostState State { get; private set; } = RendezvousHostState.Active;
+    public int PendingAttemptCount => _attempts.Count;
+    internal int DeferredRequestCount => _deferredRequests.Count;
+
+    public async Task<RendezvousClientResult<int>> RefreshJoinAttemptsAsync(
+        CancellationToken cancellationToken = default)
+    {
+        ThrowIfDisposed();
+        if (Interlocked.Exchange(ref _refreshing, 1) != 0)
+        {
+            throw new InvalidOperationException("A host invitation refresh is already running.");
+        }
+
+        try
+        {
+            RendezvousClientResult<IReadOnlyList<HostJoinAttempt>> result =
+                await _joinClient.BrowseAllForHostAsync(
+                    _session,
+                    cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (!result.IsSuccess || result.Value is null)
+            {
+                return RendezvousClientResult.Failure<int>(
+                    result.Error,
+                    result.Message,
+                    result.RetryAfterSeconds);
+            }
+
+            HostJoinAttempt[] snapshot = result.Value.Select(CopyAttempt).ToArray();
+            if (Volatile.Read(ref _disposed) != 0)
+            {
+                throw new ObjectDisposedException(nameof(RendezvousHostCoordinator));
+            }
+
+            Interlocked.Exchange(ref _latestSnapshot, snapshot);
+            if (Volatile.Read(ref _disposed) != 0)
+            {
+                Interlocked.Exchange(ref _latestSnapshot, null);
+                throw new ObjectDisposedException(nameof(RendezvousHostCoordinator));
+            }
+
+            return RendezvousClientResult.Success(snapshot.Length);
+        }
+        finally
+        {
+            Volatile.Write(ref _refreshing, 0);
+        }
+    }
+
+    public void Poll()
+    {
+        ThrowIfDisposed();
+        if (State != RendezvousHostState.Active)
+        {
+            return;
+        }
+
+        if (Interlocked.Exchange(ref _polling, 1) != 0)
+        {
+            throw new InvalidOperationException("The Rendezvous coordinator cannot be polled concurrently or recursively.");
+        }
+
+        try
+        {
+            ApplySnapshots();
+            if (!_manager.IsRunning)
+            {
+                Stop(RendezvousHostState.ManagerStopped, RendezvousConnectionState.ManagerStopped);
+                return;
+            }
+
+            _manager.NatPunchModule.PollEvents();
+            _manager.PollEvents();
+            _manager.NatPunchModule.PollEvents();
+            if (State != RendezvousHostState.Active)
+            {
+                return;
+            }
+
+            DateTimeOffset now = _clock.UtcNow;
+            if (!_manager.IsRunning)
+            {
+                Stop(RendezvousHostState.ManagerStopped, RendezvousConnectionState.ManagerStopped);
+                return;
+            }
+
+            RefreshPresence(now);
+            int checks = Math.Min(
+                _attemptSchedule.Count,
+                _options.MaximumAttemptChecksPerPoll);
+            for (int index = 0; index < checks; index++)
+            {
+                JoinAttemptId attemptId = _attemptSchedule.Dequeue();
+                if (!_attempts.TryGetValue(attemptId, out PendingHostAttempt? attempt))
+                {
+                    continue;
+                }
+
+                if (now >= attempt.Invitation.ExpiresAt)
+                {
+                    CompleteAttempt(attemptId, RendezvousConnectionState.TimedOut);
+                    continue;
+                }
+
+                if (attempt.State == RendezvousConnectionState.Punching
+                    && attempt.Retry.IsDue(now))
+                {
+                    if (attempt.Retry.IsExhausted)
+                    {
+                        CompleteAttempt(attemptId, RendezvousConnectionState.TimedOut);
+                        continue;
+                    }
+
+                    _manager.NatPunchModule.SendNatIntroduceRequest(
+                        _mediator,
+                        NatPunchRequestTokenCodec.Encode(
+                            NatPunchPeerRole.Host,
+                            attempt.Invitation.MediationHandle,
+                            attempt.Invitation.HostPunchCapability));
+                    attempt.Retry.RecordRequest();
+                }
+
+                _attemptSchedule.Enqueue(attemptId);
+            }
+
+            if (now >= _nextTerminalCleanupAt)
+            {
+                _cleanupScratch.Clear();
+                foreach (KeyValuePair<JoinAttemptId, DateTimeOffset> terminal in _terminalAttempts)
+                {
+                    if (terminal.Value <= now)
+                    {
+                        _cleanupScratch.Add(terminal.Key);
+                    }
+                }
+
+                foreach (JoinAttemptId attemptId in _cleanupScratch)
+                {
+                    _terminalAttempts.Remove(attemptId);
+                }
+
+                _nextTerminalCleanupAt = now + TimeSpan.FromSeconds(1);
+            }
+        }
+        finally
+        {
+            Volatile.Write(ref _polling, 0);
+        }
+    }
+
+    public void Dispose()
+    {
+        if (Interlocked.Exchange(ref _disposed, 1) != 0)
+        {
+            return;
+        }
+
+        Stop(RendezvousHostState.Disposed, RendezvousConnectionState.Disposed);
+        Interlocked.Exchange(ref _latestSnapshot, null);
+        _attemptSchedule.Clear();
+        _terminalAttempts.Clear();
+        _cleanupScratch.Clear();
+        _tickets.Dispose();
+    }
+
+    public override string ToString() =>
+        $"[RendezvousHostCoordinator {_session.ListingId}; credentials redacted]";
+
+    private void ApplySnapshots()
+    {
+        HostJoinAttempt[]? latest = Interlocked.Exchange(ref _latestSnapshot, null);
+
+        if (latest is null)
+        {
+            return;
+        }
+
+        DateTimeOffset now = _clock.UtcNow;
+        foreach (HostJoinAttempt invitation in latest)
+        {
+            if (invitation.AttemptId.Value == Guid.Empty
+                || invitation.MediationHandle.Value == Guid.Empty
+                || !ContractValidation.IsCapabilityValid(invitation.HostPunchCapability)
+                || !ContractValidation.IsConnectionTicketValid(
+                    invitation.ConnectionTicketDigest))
+            {
+                continue;
+            }
+
+            if (invitation.IsCancelled)
+            {
+                if (_attempts.ContainsKey(invitation.AttemptId))
+                {
+                    CompleteAttempt(
+                        invitation.AttemptId,
+                        RendezvousConnectionState.Cancelled);
+                }
+
+                _terminalAttempts[invitation.AttemptId] = invitation.ExpiresAt;
+                continue;
+            }
+
+            if (invitation.ExpiresAt <= now
+                || _attempts.ContainsKey(invitation.AttemptId)
+                || _terminalAttempts.ContainsKey(invitation.AttemptId))
+            {
+                continue;
+            }
+
+            _attempts.Add(
+                invitation.AttemptId,
+                new PendingHostAttempt(
+                    CopyAttempt(invitation),
+                    new RendezvousPunchRetrySchedule(_options, _clock)));
+            _attemptSchedule.Enqueue(invitation.AttemptId);
+        }
+    }
+
+    private void RefreshPresence(DateTimeOffset now)
+    {
+        if (now < _nextPresenceAt || now >= _session.ExpiresAt)
+        {
+            return;
+        }
+
+        _manager.NatPunchModule.SendNatIntroduceRequest(
+            _mediator,
+            NatPunchRequestTokenCodec.Encode(
+                NatPunchPeerRole.HostPresence,
+                _session.HostPresenceHandle,
+                _session.HostPresenceCapability));
+        _nextPresenceAt = now + TimeSpan.FromSeconds(_session.HostPresenceRefreshAfterSeconds);
+    }
+
+    private void OnNatIntroductionSuccess(
+        IPEndPoint target,
+        NatAddressType addressType,
+        string encodedIntroduction)
+    {
+        _ = target;
+        _ = addressType;
+        if (!NatIntroductionTokenCodec.TryDecode(
+                encodedIntroduction,
+                out NatIntroductionToken? introduction)
+            || introduction is null
+            || !_attempts.TryGetValue(introduction.AttemptId, out PendingHostAttempt? attempt)
+            || !NatIntroductionTokenCodec.MatchesDigest(
+                introduction.ConnectionTicket,
+                attempt.Invitation.ConnectionTicketDigest)
+            || !_tickets.TryAuthorize(
+                introduction.AttemptId,
+                introduction.ConnectionTicket,
+                Min(
+                    attempt.Invitation.ExpiresAt,
+                    _clock.UtcNow + _options.ConnectionTicketLifetime)))
+        {
+            return;
+        }
+
+        attempt.State = RendezvousConnectionState.Connecting;
+        if (_deferredRequests.Remove(
+                introduction.AttemptId,
+                out DeferredConnectionRequest? deferred))
+        {
+            AcceptAuthorizedRequest(
+                introduction.AttemptId,
+                attempt,
+                deferred.Request,
+                deferred.ConnectionTicket);
+        }
+    }
+
+    private void OnConnectionRequest(ConnectionRequest request)
+    {
+        ReadOnlySpan<byte> data = request.Data.GetRemainingBytesSpan();
+        if (!DirectConnectionRequestCodec.IsRendezvousRequest(data))
+        {
+            return;
+        }
+
+        if (!DirectConnectionRequestCodec.TryDecode(data, out DirectConnectionRequest? connection)
+            || connection is null
+            || !_attempts.TryGetValue(connection.AttemptId, out PendingHostAttempt? attempt)
+            || !NatIntroductionTokenCodec.MatchesDigest(
+                connection.ConnectionTicket,
+                attempt.Invitation.ConnectionTicketDigest))
+        {
+            request.RejectForce([]);
+            return;
+        }
+
+        if (attempt.State == RendezvousConnectionState.Punching)
+        {
+            _deferredRequests[connection.AttemptId] = new(
+                request,
+                connection.ConnectionTicket);
+            return;
+        }
+
+        if (attempt.State != RendezvousConnectionState.Connecting)
+        {
+            request.RejectForce([]);
+            return;
+        }
+
+        AcceptAuthorizedRequest(
+            connection.AttemptId,
+            attempt,
+            request,
+            connection.ConnectionTicket);
+    }
+
+    private void OnPeerConnected(NetPeer peer)
+    {
+        if (_acceptedPeers.TryGetValue(peer, out JoinAttemptId attemptId))
+        {
+            CompleteAttempt(attemptId, RendezvousConnectionState.Connected, peer);
+        }
+    }
+
+    private void OnPeerDisconnected(NetPeer peer, DisconnectInfo disconnectInfo)
+    {
+        _ = disconnectInfo;
+        if (_acceptedPeers.TryGetValue(peer, out JoinAttemptId attemptId))
+        {
+            CompleteAttempt(attemptId, RendezvousConnectionState.Rejected);
+        }
+    }
+
+    private void CompleteAttempt(
+        JoinAttemptId attemptId,
+        RendezvousConnectionState state,
+        NetPeer? peer = null)
+    {
+        if (!_attempts.Remove(attemptId, out PendingHostAttempt? attempt))
+        {
+            return;
+        }
+
+        if (attempt.AcceptedPeer is not null)
+        {
+            _acceptedPeers.Remove(attempt.AcceptedPeer);
+        }
+
+        _deferredRequests.Remove(attemptId);
+        _tickets.Revoke(attemptId);
+        _terminalAttempts[attemptId] = attempt.Invitation.ExpiresAt;
+        AttemptCompleted?.Invoke(this, new(attemptId, state, peer));
+    }
+
+    private void Stop(RendezvousHostState hostState, RendezvousConnectionState attemptState)
+    {
+        if (State != RendezvousHostState.Active)
+        {
+            return;
+        }
+
+        State = hostState;
+        foreach (JoinAttemptId attemptId in _attempts.Keys.ToArray())
+        {
+            CompleteAttempt(attemptId, attemptState);
+        }
+
+        ReleaseSubscriptions();
+    }
+
+    private void ReleaseSubscriptions()
+    {
+        if (_subscriptionsReleased)
+        {
+            return;
+        }
+
+        _networkEvents.RendezvousConnectionRequest -= OnConnectionRequest;
+        _networkEvents.RendezvousPeerConnected -= OnPeerConnected;
+        _networkEvents.RendezvousPeerDisconnected -= OnPeerDisconnected;
+        _punchEvents.NatIntroductionSuccess -= OnNatIntroductionSuccess;
+        _subscriptionsReleased = true;
+    }
+
+    private void ValidateInputs()
+    {
+        if (_mediator.Port is < 1 or > 65_535
+            || _session.HostPresenceHandle.Value == Guid.Empty
+            || !ContractValidation.IsCapabilityValid(_session.HostPresenceCapability)
+            || _session.HostPresenceRefreshAfterSeconds < 1
+            || _session.ExpiresAt <= _clock.UtcNow)
+        {
+            throw new ArgumentException("The host traversal inputs are invalid.");
+        }
+    }
+
+    private static HostJoinAttempt CopyAttempt(HostJoinAttempt attempt) => new()
+    {
+        AttemptId = attempt.AttemptId,
+        MediationHandle = attempt.MediationHandle,
+        HostPunchCapability = attempt.HostPunchCapability,
+        ConnectionTicketDigest = attempt.ConnectionTicketDigest,
+        IsCancelled = attempt.IsCancelled,
+        ExpiresAt = attempt.ExpiresAt,
+    };
+
+    private static DateTimeOffset Min(DateTimeOffset left, DateTimeOffset right) =>
+        left <= right ? left : right;
+
+    private void AcceptAuthorizedRequest(
+        JoinAttemptId attemptId,
+        PendingHostAttempt attempt,
+        ConnectionRequest request,
+        string connectionTicket)
+    {
+        ConnectionTicketConsumptionResult consumption = _tickets.Consume(
+            attemptId,
+            connectionTicket);
+        if (consumption != ConnectionTicketConsumptionResult.Accepted)
+        {
+            request.RejectForce([]);
+            return;
+        }
+
+        NetPeer peer = request.Accept();
+        attempt.AcceptedPeer = peer;
+        _acceptedPeers[peer] = attemptId;
+    }
+
+    private void ThrowIfDisposed()
+    {
+        if (Volatile.Read(ref _disposed) != 0)
+        {
+            throw new ObjectDisposedException(nameof(RendezvousHostCoordinator));
+        }
+    }
+
+    private sealed class PendingHostAttempt(
+        HostJoinAttempt invitation,
+        RendezvousPunchRetrySchedule retry)
+    {
+        internal HostJoinAttempt Invitation { get; } = invitation;
+        internal RendezvousPunchRetrySchedule Retry { get; } = retry;
+        internal RendezvousConnectionState State { get; set; } = RendezvousConnectionState.Punching;
+        internal NetPeer? AcceptedPeer { get; set; }
+    }
+
+    private sealed class DeferredConnectionRequest(
+        ConnectionRequest request,
+        string connectionTicket)
+    {
+        internal ConnectionRequest Request { get; } = request;
+        internal string ConnectionTicket { get; } = connectionTicket;
+    }
+}

src/FinalFactory.Rendezvous.Client/Traversal/RendezvousNetListener.cs

@@ -0,0 +1,110 @@
+using System.Net;
+using System.Net.Sockets;
+using LiteNetLib;
+using LiteNetLib.Utils;
+
+namespace FinalFactory.Rendezvous.Client;
+
+public sealed class RendezvousNetListener : INetEventListener
+{
+    private NetManager? _manager;
+
+    public EventBasedNetListener GameplayEvents { get; } = new();
+    public EventBasedNatPunchListener PunchEvents { get; } = new();
+
+    public NetManager CreateManager()
+    {
+        if (_manager is not null)
+        {
+            throw new InvalidOperationException(
+                "This Rendezvous listener is already bound to a LiteNetLib manager.");
+        }
+
+        NetManager manager = new(this) { NatPunchEnabled = true };
+        manager.NatPunchModule.Init(PunchEvents);
+        _manager = manager;
+        return manager;
+    }
+
+    internal event Action<NetPeer>? RendezvousPeerConnected;
+    internal event Action<NetPeer, DisconnectInfo>? RendezvousPeerDisconnected;
+    internal event Action<ConnectionRequest>? RendezvousConnectionRequest;
+
+    internal void ValidateManager(NetManager manager)
+    {
+        if (!ReferenceEquals(_manager, manager))
+        {
+            throw new InvalidOperationException(
+                "The LiteNetLib manager must be created by this Rendezvous listener.");
+        }
+    }
+
+    public void OnPeerConnected(NetPeer peer)
+    {
+        RendezvousPeerConnected?.Invoke(peer);
+        ((INetEventListener)GameplayEvents).OnPeerConnected(peer);
+    }
+
+    public void OnPeerDisconnected(NetPeer peer, DisconnectInfo disconnectInfo)
+    {
+        RendezvousPeerDisconnected?.Invoke(peer, disconnectInfo);
+        ((INetEventListener)GameplayEvents).OnPeerDisconnected(peer, disconnectInfo);
+    }
+
+    public void OnNetworkError(IPEndPoint endPoint, SocketError socketError) =>
+        ((INetEventListener)GameplayEvents).OnNetworkError(endPoint, socketError);
+
+    public void OnNetworkReceive(
+        NetPeer peer,
+        NetPacketReader reader,
+        byte channelNumber,
+        DeliveryMethod deliveryMethod) =>
+        ((INetEventListener)GameplayEvents).OnNetworkReceive(
+            peer,
+            reader,
+            channelNumber,
+            deliveryMethod);
+
+    public void OnNetworkReceiveUnconnected(
+        IPEndPoint remoteEndPoint,
+        NetPacketReader reader,
+        UnconnectedMessageType messageType) =>
+        ((INetEventListener)GameplayEvents).OnNetworkReceiveUnconnected(
+            remoteEndPoint,
+            reader,
+            messageType);
+
+    public void OnNetworkLatencyUpdate(NetPeer peer, int latency) =>
+        ((INetEventListener)GameplayEvents).OnNetworkLatencyUpdate(peer, latency);
+
+    public void OnConnectionRequest(ConnectionRequest request)
+    {
+        int position = request.Data.Position;
+        bool isRendezvous = DirectConnectionRequestCodec.IsRendezvousRequest(
+            request.Data.GetRemainingBytesSpan());
+        request.Data.SetPosition(position);
+        if (!isRendezvous)
+        {
+            ((INetEventListener)GameplayEvents).OnConnectionRequest(request);
+            return;
+        }
+
+        Action<ConnectionRequest>? handler = RendezvousConnectionRequest;
+        if (handler is null)
+        {
+            request.RejectForce([]);
+            return;
+        }
+
+        handler(request);
+    }
+
+    public void OnMessageDelivered(NetPeer peer, object userData) =>
+        ((INetEventListener)GameplayEvents).OnMessageDelivered(peer, userData);
+
+    public void OnNtpResponse(NtpPacket packet) =>
+        ((INetEventListener)GameplayEvents).OnNtpResponse(packet);
+
+    public void OnPeerAddressChanged(NetPeer peer, IPEndPoint previousAddress) =>
+        ((INetEventListener)GameplayEvents).OnPeerAddressChanged(peer, previousAddress);
+}

src/FinalFactory.Rendezvous.Contracts/ContractLimits.cs

@@ -23,6 +23,8 @@ public static class ContractLimits
     public const int OpaqueHttpCredentialMaxCharacters = 1_024;
     public const int UdpCapabilityMaxCharacters = 192;
     public const int ConnectionTicketMaxCharacters = 192;
+    public const int DerivedCredentialCharacters = 43;
+    public const int NatPunchRequestTokenCharacters = 192;
     public const int LiteNetLibNatTokenMaxCharacters = 256;
     public const int SessionCapacityMaxPlayers = 10_000;
 }

src/FinalFactory.Rendezvous.Contracts/Http/JoinContracts.cs

@@ -37,6 +37,9 @@ public sealed class CreateJoinAttemptResponse
     [JsonRequired]
     public string ClientPunchCapability { get; set; } = string.Empty;
 
+    [JsonRequired]
+    public string ConnectionTicketDigest { get; set; } = string.Empty;
+
     [JsonRequired]
     public DateTimeOffset ExpiresAt { get; set; }
     public NetworkEndpoint? DedicatedFallback { get; set; }
@@ -53,6 +56,12 @@ public sealed class HostJoinAttempt
     [JsonRequired]
     public string HostPunchCapability { get; set; } = string.Empty;
 
+    [JsonRequired]
+    public string ConnectionTicketDigest { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public bool IsCancelled { get; set; }
+
     [JsonRequired]
     public DateTimeOffset ExpiresAt { get; set; }
 }

src/FinalFactory.Rendezvous.Contracts/Udp/NatIntroductionTokenCodec.cs

@@ -0,0 +1,149 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace FinalFactory.Rendezvous.Contracts;
+
+public sealed class NatIntroductionToken
+{
+    public JoinAttemptId AttemptId { get; set; }
+    public string ConnectionTicket { get; set; } = string.Empty;
+
+    public override string ToString() =>
+        $"[NatIntroductionToken {AttemptId}; ticket redacted]";
+}
+
+public static class NatIntroductionTokenCodec
+{
+    public const int EncodedLength = ContractLimits.DerivedCredentialCharacters;
+
+    private const int DecodedLength = 32;
+    private const int AttemptIdLength = 16;
+    private const int AuthenticatorLength = DecodedLength - AttemptIdLength;
+
+    public static string Encode(JoinAttemptId attemptId, string derivedAuthenticator)
+    {
+        if (attemptId.Value == Guid.Empty
+            || !ContractValidation.IsConnectionTicketValid(derivedAuthenticator)
+            || !TryDecodeBase64Url(derivedAuthenticator, out byte[]? authenticator)
+            || authenticator.Length != DecodedLength)
+        {
+            throw new ArgumentException("The NAT introduction token fields are invalid.");
+        }
+
+        byte[] payload = new byte[DecodedLength];
+        try
+        {
+            if (!attemptId.Value.TryWriteBytes(payload.AsSpan(0, AttemptIdLength)))
+            {
+                throw new InvalidOperationException("The join attempt identifier could not be encoded.");
+            }
+
+            authenticator.AsSpan(0, AuthenticatorLength).CopyTo(payload.AsSpan(AttemptIdLength));
+            return EncodeBase64Url(payload);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(authenticator);
+            CryptographicOperations.ZeroMemory(payload);
+        }
+    }
+
+    public static bool TryDecode(string? encoded, out NatIntroductionToken? token)
+    {
+        token = null;
+        if (!ContractValidation.IsConnectionTicketValid(encoded)
+            || !TryDecodeBase64Url(encoded!, out byte[]? payload)
+            || payload.Length != DecodedLength)
+        {
+            return false;
+        }
+
+        try
+        {
+            Guid attemptId = new(payload.AsSpan(0, AttemptIdLength));
+            if (attemptId == Guid.Empty)
+            {
+                return false;
+            }
+
+            token = new NatIntroductionToken
+            {
+                AttemptId = new JoinAttemptId(attemptId),
+                ConnectionTicket = encoded!,
+            };
+            return true;
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(payload);
+        }
+    }
+
+    public static string ComputeDigest(string connectionTicket)
+    {
+        if (!ContractValidation.IsConnectionTicketValid(connectionTicket))
+        {
+            throw new ArgumentException("The connection ticket is invalid.", nameof(connectionTicket));
+        }
+
+        byte[] encoded = Encoding.ASCII.GetBytes(connectionTicket);
+        byte[] digest;
+        using (SHA256 sha256 = SHA256.Create())
+        {
+            digest = sha256.ComputeHash(encoded);
+        }
+        CryptographicOperations.ZeroMemory(encoded);
+        try
+        {
+            return EncodeBase64Url(digest);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(digest);
+        }
+    }
+
+    public static bool MatchesDigest(string? connectionTicket, string? expectedDigest)
+    {
+        if (!ContractValidation.IsConnectionTicketValid(connectionTicket)
+            || !ContractValidation.IsConnectionTicketValid(expectedDigest))
+        {
+            return false;
+        }
+
+        byte[] actual = Encoding.ASCII.GetBytes(ComputeDigest(connectionTicket!));
+        byte[] expected = Encoding.ASCII.GetBytes(expectedDigest!);
+        try
+        {
+            return CryptographicOperations.FixedTimeEquals(actual, expected);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(actual);
+            CryptographicOperations.ZeroMemory(expected);
+        }
+    }
+
+    private static bool TryDecodeBase64Url(string? encoded, out byte[] bytes)
+    {
+        bytes = [];
+        if (encoded is null || encoded.Length != EncodedLength)
+        {
+            return false;
+        }
+
+        try
+        {
+            bytes = Convert.FromBase64String(
+                encoded.Replace('-', '+').Replace('_', '/') + "=");
+            return true;
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+    }
+
+    private static string EncodeBase64Url(byte[] value) =>
+        Convert.ToBase64String(value).TrimEnd('=').Replace('+', '-').Replace('/', '_');
+}

src/FinalFactory.Rendezvous.Contracts/Udp/NatPunchRequestTokenCodec.cs

@@ -0,0 +1,131 @@
+namespace FinalFactory.Rendezvous.Contracts;
+
+public enum NatPunchPeerRole
+{
+    HostPresence = 1,
+    Host = 2,
+    Client = 3,
+}
+
+public sealed class NatPunchRequestToken
+{
+    public NatPunchPeerRole Role { get; set; }
+    public MediationHandle MediationHandle { get; set; }
+    public string Capability { get; set; } = string.Empty;
+
+    public override string ToString() => "[NatPunchRequestToken: capability redacted]";
+}
+
+public static class NatPunchRequestTokenCodec
+{
+    public const int EncodedLength = ContractLimits.NatPunchRequestTokenCharacters;
+
+    private const string VersionPrefix = "rv1:";
+    private const int HandleLength = 32;
+    private const int CapabilityLength = ContractLimits.DerivedCredentialCharacters;
+    private const char Separator = ':';
+    private const char Padding = '.';
+
+    public static string Encode(
+        NatPunchPeerRole role,
+        MediationHandle mediationHandle,
+        string capability)
+    {
+        if (!TryGetRoleCode(role, out char roleCode)
+            || mediationHandle.Value == Guid.Empty
+            || capability is null
+            || capability.Length != CapabilityLength
+            || !ContractValidation.IsCapabilityValid(capability))
+        {
+            throw new ArgumentException("The NAT punch request token fields are invalid.");
+        }
+
+        string payload = string.Concat(
+            VersionPrefix,
+            roleCode,
+            Separator,
+            mediationHandle.Value.ToString("N"),
+            Separator,
+            capability);
+        return payload.PadRight(EncodedLength, Padding);
+    }
+
+    public static bool TryDecode(string? encoded, out NatPunchRequestToken? token)
+    {
+        token = null;
+        if (encoded is null
+            || encoded.Length != EncodedLength
+            || !encoded.StartsWith(VersionPrefix, StringComparison.Ordinal)
+            || !TryParseRole(encoded[VersionPrefix.Length], out NatPunchPeerRole role))
+        {
+            return false;
+        }
+
+        int roleSeparator = VersionPrefix.Length + 1;
+        int handleOffset = roleSeparator + 1;
+        int capabilitySeparator = handleOffset + HandleLength;
+        int capabilityOffset = capabilitySeparator + 1;
+        int paddingOffset = capabilityOffset + CapabilityLength;
+        string handleText = encoded.Substring(handleOffset, HandleLength);
+        if (encoded[roleSeparator] != Separator
+            || encoded[capabilitySeparator] != Separator
+            || !Guid.TryParseExact(handleText, "N", out Guid handle)
+            || handle == Guid.Empty
+            || !string.Equals(handleText, handle.ToString("N"), StringComparison.Ordinal)
+            || !ContainsOnlyPadding(encoded, paddingOffset))
+        {
+            return false;
+        }
+
+        string capability = encoded.Substring(capabilityOffset, CapabilityLength);
+        if (!ContractValidation.IsCapabilityValid(capability))
+        {
+            return false;
+        }
+
+        token = new NatPunchRequestToken
+        {
+            Role = role,
+            MediationHandle = new MediationHandle(handle),
+            Capability = capability,
+        };
+        return true;
+    }
+
+    private static bool TryGetRoleCode(NatPunchPeerRole role, out char code)
+    {
+        code = role switch
+        {
+            NatPunchPeerRole.HostPresence => 'p',
+            NatPunchPeerRole.Host => 'h',
+            NatPunchPeerRole.Client => 'c',
+            _ => default,
+        };
+        return code != default;
+    }
+
+    private static bool TryParseRole(char code, out NatPunchPeerRole role)
+    {
+        role = code switch
+        {
+            'p' => NatPunchPeerRole.HostPresence,
+            'h' => NatPunchPeerRole.Host,
+            'c' => NatPunchPeerRole.Client,
+            _ => default,
+        };
+        return role != default;
+    }
+
+    private static bool ContainsOnlyPadding(string value, int offset)
+    {
+        for (int index = offset; index < value.Length; index++)
+        {
+            if (value[index] != Padding)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}

src/FinalFactory.Rendezvous.Server/JoinAttempts/JoinAttemptService.cs

@@ -66,7 +66,15 @@ internal sealed class JoinAttemptService(
         string derivationSalt = capabilities.CreateDerivationSalt();
         string hostCapability = Derive("join-host-punch", clientSubject, request, requestFingerprint, derivationSalt);
         string clientCapability = Derive("join-client-punch", clientSubject, request, requestFingerprint, derivationSalt);
-        string connectionTicket = Derive("connection-ticket", clientSubject, request, requestFingerprint, derivationSalt);
+        JoinAttemptId attemptId = new(capabilities.DeriveGuid(
+            "join-attempt-id",
+            clientSubject,
+            request.IdempotencyKey,
+            requestFingerprint,
+            derivationSalt));
+        string connectionTicket = NatIntroductionTokenCodec.Encode(
+            attemptId,
+            Derive("connection-ticket", clientSubject, request, requestFingerprint, derivationSalt));
         if (!CredentialLengthsAreValid(hostCapability, clientCapability, connectionTicket)
             || !capabilities.TryFingerprint(hostCapability, out SecretFingerprint hostFingerprint)
             || !capabilities.TryFingerprint(clientCapability, out SecretFingerprint clientFingerprint)
@@ -75,12 +83,6 @@ internal sealed class JoinAttemptService(
             throw new InvalidOperationException("Derived join credentials violated their contract invariants.");
         }
 
-        JoinAttemptId attemptId = new(capabilities.DeriveGuid(
-            "join-attempt-id",
-            clientSubject,
-            request.IdempotencyKey,
-            requestFingerprint,
-            derivationSalt));
         MediationHandle mediationHandle = new(capabilities.DeriveGuid(
             "join-mediation-handle",
             clientSubject,
@@ -126,6 +128,8 @@ internal sealed class JoinAttemptService(
             AttemptId = persisted.AttemptId,
             MediationHandle = persisted.MediationHandle,
             ClientPunchCapability = clientCapability,
+            ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+                CreateConnectionTicket(persisted)),
             ExpiresAt = persisted.ExpiresAt,
         });
     }
@@ -203,7 +207,7 @@ internal sealed class JoinAttemptService(
         StoredJoinAttempt attempt)
     {
         ArgumentNullException.ThrowIfNull(attempt);
-        if (!attempt.IntroductionConsumed)
+        if (!attempt.IntroductionConsumed || attempt.IsCancelled)
         {
             return new(RendezvousErrorCode.Conflict);
         }
@@ -213,12 +217,7 @@ internal sealed class JoinAttemptService(
             return new(RendezvousErrorCode.Expired);
         }
 
-        string ticket = Derive(
-            "connection-ticket",
-            attempt.ClientSubject,
-            attempt.IdempotencyKey,
-            attempt.RequestFingerprint,
-            attempt.CapabilityDerivationSalt);
+        string ticket = CreateConnectionTicket(attempt);
         if (!ContractValidation.IsConnectionTicketValid(ticket)
             || !capabilities.TryFingerprint(ticket, out SecretFingerprint fingerprint)
             || fingerprint != attempt.ConnectionTicketFingerprint)
@@ -249,10 +248,23 @@ internal sealed class JoinAttemptService(
             AttemptId = attempt.AttemptId,
             MediationHandle = attempt.MediationHandle,
             HostPunchCapability = capability,
+            ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+                CreateConnectionTicket(attempt)),
+            IsCancelled = attempt.IsCancelled,
             ExpiresAt = attempt.ExpiresAt,
         };
     }
 
+    private string CreateConnectionTicket(StoredJoinAttempt attempt) =>
+        NatIntroductionTokenCodec.Encode(
+            attempt.AttemptId,
+            Derive(
+                "connection-ticket",
+                attempt.ClientSubject,
+                attempt.IdempotencyKey,
+                attempt.RequestFingerprint,
+                attempt.CapabilityDerivationSalt));
+
     private static RendezvousErrorCode ValidateCreate(CreateJoinAttemptRequest request)
     {
         RendezvousErrorCode version = ContractValidation.ValidateContractVersion(request.ContractVersion);
@@ -316,6 +328,9 @@ internal sealed class JoinAttemptService(
         ContractValidation.IsCapabilityValid(hostCapability)
         && ContractValidation.IsCapabilityValid(clientCapability)
         && ContractValidation.IsConnectionTicketValid(ticket)
+        && hostCapability.Length == ContractLimits.DerivedCredentialCharacters
+        && clientCapability.Length == ContractLimits.DerivedCredentialCharacters
+        && ticket.Length == ContractLimits.DerivedCredentialCharacters
         && hostCapability.Length <= ContractLimits.LiteNetLibNatTokenMaxCharacters
         && clientCapability.Length <= ContractLimits.LiteNetLibNatTokenMaxCharacters;
 

src/FinalFactory.Rendezvous.Server/Program.cs

@@ -133,12 +133,19 @@ builder.Services
     .BindConfiguration(UdpMediatorOptions.SectionName)
     .ValidateDataAnnotations()
     .Validate(
-        options => IPAddress.TryParse(options.ListenAddress, out _),
-        $"{UdpMediatorOptions.SectionName}:ListenAddress must be an IP address.")
+        options => IPAddress.TryParse(options.ListenAddress, out IPAddress? address)
+                   && address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork,
+        $"{UdpMediatorOptions.SectionName}:ListenAddress must be an IPv4 address.")
+    .Validate(
+        options => string.IsNullOrWhiteSpace(options.Ipv6ListenAddress)
+                   || (IPAddress.TryParse(options.Ipv6ListenAddress, out IPAddress? address)
+                       && address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6),
+        $"{UdpMediatorOptions.SectionName}:Ipv6ListenAddress must be an IPv6 address when configured.")
     .ValidateOnStart();
 builder.Services.AddSingleton<UdpMediatorService>();
 if (!isOpenApiGeneration)
 {
+    builder.Services.AddSingleton<NatMediationProcessor>();
     builder.Services.AddHostedService(static services =>
         services.GetRequiredService<UdpMediatorService>());
 }

src/FinalFactory.Rendezvous.Server/State/EphemeralStateContracts.cs

@@ -286,6 +286,7 @@ internal sealed record StoredJoinAttempt
     public AttemptEndpointBinding? ClientEndpoint { get; init; }
     public required bool IntroductionConsumed { get; init; }
     public required bool ConnectionTicketConsumed { get; init; }
+    public required bool IsCancelled { get; init; }
 
     public override string ToString() => $"[StoredJoinAttempt {AttemptId}; credentials redacted]";
 }

src/FinalFactory.Rendezvous.Server/State/InMemoryEphemeralRendezvousStore.cs

@@ -4,6 +4,7 @@ namespace FinalFactory.Rendezvous.Server.State;
 
 internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousStore
 {
+    private static readonly TimeSpan UdpMaintenanceInterval = TimeSpan.FromSeconds(1);
     private readonly object _gate = new();
     private readonly EphemeralStoreOptions _options;
     private readonly IMonotonicClock _monotonicClock;
@@ -19,6 +20,8 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
     private readonly Dictionary<string, TimeSpan> _replay = new(StringComparer.Ordinal);
     private readonly Dictionary<string, TimeSpan> _revocations = new(StringComparer.Ordinal);
     private TimeSpan? _drainDeadline;
+    private TimeSpan _nextUdpMaintenance;
+    private long _maintenanceSweepCount;
     private bool _available = true;
 
     public InMemoryEphemeralRendezvousStore(
@@ -38,6 +41,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
     }
 
     public Guid InstanceId { get; }
+    internal long MaintenanceSweepCount => Interlocked.Read(ref _maintenanceSweepCount);
 
     public bool IsAvailable
     {
@@ -270,6 +274,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
 
         if (!_presenceHandles.TryGetValue(command.Handle, out SessionListingId listingId)
             || !_listings.TryGetValue(listingId, out ListingEntry? entry)
+            || entry.LeaseDeadline <= now
             || entry.Definition.HostPresenceFingerprint != command.CapabilityFingerprint)
         {
             return new(StoreResultCode.NotFound);
@@ -285,7 +290,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
             command.LocalEndpoint,
             now + _options.PresenceLifetime);
         return new(StoreResultCode.Success, Snapshot(entry));
-    }, cancellationToken);
+    }, cancellationToken, eagerCleanup: false);
 
     public StoreResult<IReadOnlyList<StoredListing>> BrowseVisibleListings(
         VisibleListingQuery query,
@@ -415,7 +420,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
 
         IReadOnlyList<StoredJoinAttempt> attempts = _attempts.Values
             .Where(entry => entry.Command.ListingId == query.ListingId
-                && !entry.IntroductionConsumed
+                && (!entry.IntroductionConsumed || entry.IsCancelled)
                 && (!query.AfterAttemptId.HasValue
                     || entry.Command.AttemptId.Value.CompareTo(query.AfterAttemptId.Value.Value) > 0))
             .OrderBy(static entry => entry.Command.AttemptId.Value)
@@ -446,13 +451,18 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
             return new(StoreResultCode.NotFound);
         }
 
-        RemoveAttempt(command.AttemptId);
+        if (attempt.IsCancelled)
+        {
+            return new(StoreResultCode.Success, true, true);
+        }
+
+        attempt.IsCancelled = true;
         return new(StoreResultCode.Success, true);
     }, cancellationToken);
 
     public StoreResult<StoredJoinAttempt> BindAttemptEndpoint(
         BindAttemptEndpointCommand command,
-        CancellationToken cancellationToken = default) => Atomic<StoredJoinAttempt>(_ =>
+        CancellationToken cancellationToken = default) => Atomic<StoredJoinAttempt>(now =>
     {
         ArgumentNullException.ThrowIfNull(command);
         if (command.Handle.Value == Guid.Empty
@@ -469,7 +479,14 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         }
 
         if (!_attemptHandles.TryGetValue(command.Handle, out JoinAttemptId attemptId)
-            || !_attempts.TryGetValue(attemptId, out AttemptEntry? attempt))
+            || !_attempts.TryGetValue(attemptId, out AttemptEntry? attempt)
+            || attempt.Deadline <= now
+            || attempt.IsCancelled)
+        {
+            return new(StoreResultCode.NotFound);
+        }
+
+        if (!HasFreshHostPresence(attempt, now))
         {
             return new(StoreResultCode.NotFound);
         }
@@ -503,7 +520,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         }
 
         return new(StoreResultCode.Success, Snapshot(attempt));
-    }, cancellationToken);
+    }, cancellationToken, eagerCleanup: false);
 
     public StoreResult<IntroductionEndpoints> ConsumeIntroduction(
         MediationHandle handle,
@@ -515,7 +532,14 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         }
 
         if (!_attemptHandles.TryGetValue(handle, out JoinAttemptId attemptId)
-            || !_attempts.TryGetValue(attemptId, out AttemptEntry? attempt))
+            || !_attempts.TryGetValue(attemptId, out AttemptEntry? attempt)
+            || attempt.Deadline <= now
+            || attempt.IsCancelled)
+        {
+            return new(StoreResultCode.NotFound);
+        }
+
+        if (!HasFreshHostPresence(attempt, now))
         {
             return new(StoreResultCode.NotFound);
         }
@@ -540,7 +564,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
             Snapshot(attempt),
             attempt.HostEndpoint,
             attempt.ClientEndpoint));
-    }, cancellationToken);
+    }, cancellationToken, eagerCleanup: false);
 
     public StoreResult<bool> ConsumeConnectionTicket(
         ConsumeConnectionTicketCommand command,
@@ -568,6 +592,11 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
             return new(StoreResultCode.Conflict);
         }
 
+        if (attempt.IsCancelled)
+        {
+            return new(StoreResultCode.Conflict);
+        }
+
         if (!attempt.TicketDeadline.HasValue || attempt.TicketDeadline.Value <= now)
         {
             return new(StoreResultCode.Expired);
@@ -687,18 +716,38 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         }
     }
 
-    private StoreResult<T> Atomic<T>(Func<TimeSpan, StoreResult<T>> operation, CancellationToken cancellationToken)
+    private StoreResult<T> Atomic<T>(
+        Func<TimeSpan, StoreResult<T>> operation,
+        CancellationToken cancellationToken,
+        bool eagerCleanup = true)
     {
         cancellationToken.ThrowIfCancellationRequested();
         lock (_gate)
         {
             cancellationToken.ThrowIfCancellationRequested();
             TimeSpan now = _monotonicClock.Elapsed;
-            Cleanup(now);
+            // Authenticated UDP duplicates need O(1) store work. Their operations
+            // check exact resource deadlines and amortize physical expiry removal.
+            bool drainExpired = _drainDeadline is TimeSpan drainDeadline
+                && now >= drainDeadline;
+            if (drainExpired || eagerCleanup || now >= _nextUdpMaintenance)
+            {
+                Cleanup(now);
+                _nextUdpMaintenance = now + UdpMaintenanceInterval;
+            }
+
             return operation(now);
         }
     }
 
+    private bool HasFreshHostPresence(AttemptEntry attempt, TimeSpan now) =>
+        _listings.TryGetValue(attempt.Command.ListingId, out ListingEntry? listing)
+        && listing.LeaseDeadline > now
+        && _presence.TryGetValue(
+            listing.Definition.HostPresenceHandle,
+            out PresenceEntry? presence)
+        && presence.Deadline > now;
+
     private StoreResult<T>? CheckNewWorkAdmission<T>(string subject)
     {
         if (!_available)
@@ -718,6 +767,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
 
     private void Cleanup(TimeSpan now)
     {
+        _maintenanceSweepCount++;
         if (_drainDeadline is TimeSpan drainDeadline && now >= drainDeadline)
         {
             ClearActiveState();
@@ -831,6 +881,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         ClientEndpoint = entry.ClientEndpoint,
         IntroductionConsumed = entry.IntroductionConsumed,
         ConnectionTicketConsumed = entry.ConnectionTicketConsumed,
+        IsCancelled = entry.IsCancelled,
     };
 
     private static void RemoveExpired(Dictionary<string, TimeSpan> entries, TimeSpan now)
@@ -977,6 +1028,7 @@ internal sealed class InMemoryEphemeralRendezvousStore : IEphemeralRendezvousSto
         public AttemptEndpointBinding? ClientEndpoint { get; set; }
         public bool IntroductionConsumed { get; set; }
         public bool ConnectionTicketConsumed { get; set; }
+        public bool IsCancelled { get; set; }
     }
 
     private sealed record IdempotencyEntry(

src/FinalFactory.Rendezvous.Server/Transport/LiteNetNatRequestCodec.cs

@@ -0,0 +1,73 @@
+using System.Buffers.Binary;
+using System.Net;
+using System.Text;
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Server.Transport;
+
+internal static class LiteNetNatRequestCodec
+{
+    private const byte NatMessageProperty = 17;
+    private const int TypeIdentifierLength = 8;
+    private const int TokenLengthPrefix = NatPunchRequestTokenCodec.EncodedLength + 1;
+    // LiteNetLib 2.1.4's private NatIntroduceRequest type ID. The native socket
+    // integration test deliberately fails if a package upgrade changes this wire value.
+    private static ReadOnlySpan<byte> RequestTypeIdentifier =>
+        [0x88, 0xbe, 0x10, 0x26, 0xbf, 0xb1, 0x66, 0x9c];
+
+    public static bool TryDecode(
+        ReadOnlySpan<byte> datagram,
+        out IPEndPoint? claimedLocalEndpoint,
+        out string? token)
+    {
+        claimedLocalEndpoint = null;
+        token = null;
+        if (datagram.Length < 1 + TypeIdentifierLength + 1 + 4 + 2 + 2
+            + NatPunchRequestTokenCodec.EncodedLength
+            || datagram[0] != NatMessageProperty
+            || !datagram.Slice(1, TypeIdentifierLength).SequenceEqual(RequestTypeIdentifier))
+        {
+            return false;
+        }
+
+        int offset = 1 + TypeIdentifierLength;
+        int addressLength = datagram[offset++] switch
+        {
+            0 => 4,
+            1 => 16,
+            _ => 0,
+        };
+        int expectedLength = offset + addressLength + 2 + 2
+            + NatPunchRequestTokenCodec.EncodedLength;
+        if (addressLength == 0 || datagram.Length != expectedLength)
+        {
+            return false;
+        }
+
+        IPAddress localAddress = new(datagram.Slice(offset, addressLength));
+        offset += addressLength;
+        int localPort = BinaryPrimitives.ReadUInt16LittleEndian(datagram.Slice(offset, 2));
+        offset += 2;
+        int encodedTokenLength = BinaryPrimitives.ReadUInt16LittleEndian(datagram.Slice(offset, 2));
+        offset += 2;
+        if (localPort == 0 || encodedTokenLength != TokenLengthPrefix)
+        {
+            return false;
+        }
+
+        ReadOnlySpan<byte> tokenBytes = datagram.Slice(
+            offset,
+            NatPunchRequestTokenCodec.EncodedLength);
+        for (int index = 0; index < tokenBytes.Length; index++)
+        {
+            if (tokenBytes[index] > 0x7f)
+            {
+                return false;
+            }
+        }
+
+        claimedLocalEndpoint = new(localAddress, localPort);
+        token = Encoding.ASCII.GetString(tokenBytes);
+        return true;
+    }
+}

src/FinalFactory.Rendezvous.Server/Transport/NatMediationProcessor.cs

@@ -0,0 +1,328 @@
+using System.Net;
+using System.Net.Sockets;
+using FinalFactory.Rendezvous.Contracts;
+using FinalFactory.Rendezvous.Server.JoinAttempts;
+using FinalFactory.Rendezvous.Server.Sessions;
+using FinalFactory.Rendezvous.Server.State;
+
+namespace FinalFactory.Rendezvous.Server.Transport;
+
+internal interface INatIntroductionSink
+{
+    void Introduce(NatIntroductionPlan plan);
+}
+
+internal sealed record NatIntroductionPlan(
+    IPEndPoint HostLocal,
+    IPEndPoint HostPublic,
+    IPEndPoint ClientLocal,
+    IPEndPoint ClientPublic,
+    string IntroductionToken)
+{
+    public override string ToString() => "[NatIntroductionPlan: endpoints and ticket redacted]";
+}
+
+internal enum NatMediationResult
+{
+    Dropped = 0,
+    HostPresenceAccepted = 1,
+    HostPresenceRejected = 2,
+    WaitingForPeer = 3,
+    Introduced = 4,
+    Duplicate = 5,
+    Rejected = 6,
+}
+
+internal sealed class NatMediationProcessor(
+    IEphemeralRendezvousStore store,
+    ISessionCapabilityService capabilities,
+    JoinAttemptService joinAttempts)
+{
+    public NatMediationResult ProcessDatagram(
+        ReadOnlySpan<byte> encoded,
+        IPEndPoint observedPublicEndpoint,
+        INatIntroductionSink introductionSink,
+        CancellationToken cancellationToken = default)
+    {
+        if (!RendezvousUdpCodec.TryDecode(encoded, out PresenceDatagram? datagram, out _)
+            || datagram is null
+            || datagram.Capability.Length != ContractLimits.DerivedCredentialCharacters
+            || !IPAddress.TryParse(datagram.LocalAddress, out IPAddress? localAddress))
+        {
+            return NatMediationResult.Dropped;
+        }
+
+        IPEndPoint claimedLocalEndpoint = new(localAddress, datagram.LocalPort);
+        NatPunchPeerRole role = datagram.MessageType == UdpPresenceMessageType.ClientPresence
+            ? NatPunchPeerRole.Client
+            : NatPunchPeerRole.HostPresence;
+        bool observedIpv6 = observedPublicEndpoint.AddressFamily == AddressFamily.InterNetworkV6
+            && !observedPublicEndpoint.Address.IsIPv4MappedToIPv6;
+        if (role == NatPunchPeerRole.Client && observedIpv6)
+        {
+            return NatMediationResult.Dropped;
+        }
+
+        NatMediationResult result = ProcessRequest(
+            claimedLocalEndpoint,
+            observedPublicEndpoint,
+            NatPunchRequestTokenCodec.Encode(role, datagram.MediationHandle, datagram.Capability),
+            introductionSink,
+            cancellationToken);
+        if (role != NatPunchPeerRole.HostPresence
+            || result != NatMediationResult.HostPresenceRejected
+            || observedIpv6)
+        {
+            return result;
+        }
+
+        return ProcessRequest(
+            claimedLocalEndpoint,
+            observedPublicEndpoint,
+            NatPunchRequestTokenCodec.Encode(
+                NatPunchPeerRole.Host,
+                datagram.MediationHandle,
+                datagram.Capability),
+            introductionSink,
+            cancellationToken);
+    }
+
+    public NatMediationResult ProcessRequest(
+        IPEndPoint claimedLocalEndpoint,
+        IPEndPoint observedPublicEndpoint,
+        string token,
+        INatIntroductionSink introductionSink,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(claimedLocalEndpoint);
+        ArgumentNullException.ThrowIfNull(observedPublicEndpoint);
+        ArgumentNullException.ThrowIfNull(introductionSink);
+
+        if (!NatPunchRequestTokenCodec.TryDecode(token, out NatPunchRequestToken? request)
+            || request is null
+            || !TryCreateObservedEndpoint(observedPublicEndpoint, out ObservedEndpoint publicEndpoint)
+            || !capabilities.TryFingerprint(request.Capability, out SecretFingerprint fingerprint))
+        {
+            return NatMediationResult.Dropped;
+        }
+
+        ObservedEndpoint? localEndpoint = TryCreatePrivateCandidate(
+            claimedLocalEndpoint,
+            publicEndpoint.AddressFamily,
+            out ObservedEndpoint candidate)
+            ? candidate
+            : null;
+
+        if (request.Role == NatPunchPeerRole.HostPresence)
+        {
+            StoreResult<StoredListing> presence = store.BindHostPresence(new(
+                request.MediationHandle,
+                fingerprint,
+                publicEndpoint,
+                localEndpoint), cancellationToken);
+            return presence.Succeeded
+                ? NatMediationResult.HostPresenceAccepted
+                : NatMediationResult.HostPresenceRejected;
+        }
+
+        AttemptPeerRole role = request.Role switch
+        {
+            NatPunchPeerRole.Host => AttemptPeerRole.Host,
+            NatPunchPeerRole.Client => AttemptPeerRole.Client,
+            _ => default,
+        };
+        if (role == default)
+        {
+            return NatMediationResult.Dropped;
+        }
+
+        StoreResult<StoredJoinAttempt> bound = store.BindAttemptEndpoint(new(
+            request.MediationHandle,
+            role,
+            fingerprint,
+            publicEndpoint,
+            localEndpoint), cancellationToken);
+        if (!bound.Succeeded || bound.Value is null)
+        {
+            return bound.Code == StoreResultCode.ReplayRejected
+                ? NatMediationResult.Rejected
+                : NatMediationResult.Dropped;
+        }
+
+        StoredJoinAttempt attempt = bound.Value;
+        if (attempt.IntroductionConsumed)
+        {
+            return NatMediationResult.Duplicate;
+        }
+
+        if (attempt.HostEndpoint is null || attempt.ClientEndpoint is null)
+        {
+            return NatMediationResult.WaitingForPeer;
+        }
+
+        if (attempt.HostEndpoint.PublicEndpoint.AddressFamily
+            != attempt.ClientEndpoint.PublicEndpoint.AddressFamily)
+        {
+            return NatMediationResult.Rejected;
+        }
+
+        StoreResult<IntroductionEndpoints> consumed = store.ConsumeIntroduction(
+            request.MediationHandle,
+            cancellationToken);
+        if (!consumed.Succeeded || consumed.Value is null)
+        {
+            return consumed.Code == StoreResultCode.ReplayRejected
+                ? NatMediationResult.Duplicate
+                : NatMediationResult.Rejected;
+        }
+
+        JoinAttemptServiceResult<ConnectionTicketGrant> ticket = joinAttempts.IssueConnectionTicket(
+            consumed.Value.Attempt);
+        if (!ticket.Succeeded || ticket.Value is null)
+        {
+            return NatMediationResult.Rejected;
+        }
+
+        try
+        {
+            introductionSink.Introduce(CreatePlan(consumed.Value, ticket.Value));
+            return NatMediationResult.Introduced;
+        }
+        catch (Exception exception) when (exception is SocketException
+                                          or InvalidOperationException
+                                          or ArgumentException)
+        {
+            return NatMediationResult.Rejected;
+        }
+    }
+
+    private static NatIntroductionPlan CreatePlan(
+        IntroductionEndpoints endpoints,
+        ConnectionTicketGrant ticket)
+    {
+        IPEndPoint hostPublic = ToIpEndpoint(endpoints.Host.PublicEndpoint);
+        IPEndPoint clientPublic = ToIpEndpoint(endpoints.Client.PublicEndpoint);
+        bool sameNat = hostPublic.Address.Equals(clientPublic.Address);
+        IPEndPoint hostLocal = sameNat && endpoints.Host.LocalEndpoint is { } hostCandidate
+            ? ToIpEndpoint(hostCandidate)
+            : hostPublic;
+        IPEndPoint clientLocal = sameNat && endpoints.Client.LocalEndpoint is { } clientCandidate
+            ? ToIpEndpoint(clientCandidate)
+            : clientPublic;
+        return new(
+            hostLocal,
+            hostPublic,
+            clientLocal,
+            clientPublic,
+            ticket.Ticket);
+    }
+
+    private static bool TryCreateObservedEndpoint(
+        IPEndPoint source,
+        out ObservedEndpoint endpoint)
+    {
+        endpoint = default;
+        if (source.Port is < 1 or > 65_535)
+        {
+            return false;
+        }
+
+        IPAddress address = source.Address.IsIPv4MappedToIPv6
+            ? source.Address.MapToIPv4()
+            : source.Address;
+        if (address.Equals(IPAddress.Any)
+            || address.Equals(IPAddress.IPv6Any)
+            || address.IsIPv6Multicast
+            || IsIpv4MulticastOrBroadcast(address)
+            || (address.AddressFamily == AddressFamily.InterNetworkV6
+                && !IsGlobalIpv6(address)))
+        {
+            return false;
+        }
+
+        AddressFamilyKind family = address.AddressFamily switch
+        {
+            AddressFamily.InterNetwork => AddressFamilyKind.Ipv4,
+            AddressFamily.InterNetworkV6 => AddressFamilyKind.Ipv6,
+            _ => default,
+        };
+        if (family == default)
+        {
+            return false;
+        }
+
+        endpoint = new(family, address.ToString(), source.Port);
+        return true;
+    }
+
+    private static bool TryCreatePrivateCandidate(
+        IPEndPoint source,
+        AddressFamilyKind publicFamily,
+        out ObservedEndpoint endpoint)
+    {
+        endpoint = default;
+        if (source.Port is < 1 or > 65_535)
+        {
+            return false;
+        }
+
+        IPAddress address = source.Address.IsIPv4MappedToIPv6
+            ? source.Address.MapToIPv4()
+            : source.Address;
+        AddressFamilyKind family = address.AddressFamily switch
+        {
+            AddressFamily.InterNetwork => AddressFamilyKind.Ipv4,
+            AddressFamily.InterNetworkV6 => AddressFamilyKind.Ipv6,
+            _ => default,
+        };
+        if (family != publicFamily || !IsPrivateUnicast(address))
+        {
+            return false;
+        }
+
+        endpoint = new(family, address.ToString(), source.Port);
+        return true;
+    }
+
+    private static bool IsPrivateUnicast(IPAddress address)
+    {
+        byte[] bytes = address.GetAddressBytes();
+        return address.AddressFamily switch
+        {
+            AddressFamily.InterNetwork => bytes[0] == 10
+                || (bytes[0] == 172 && bytes[1] is >= 16 and <= 31)
+                || (bytes[0] == 192 && bytes[1] == 168),
+            AddressFamily.InterNetworkV6 => (bytes[0] & 0xfe) == 0xfc,
+            _ => false,
+        };
+    }
+
+    private static bool IsGlobalIpv6(IPAddress address) =>
+        !address.Equals(IPAddress.IPv6Loopback)
+        && !address.Equals(IPAddress.IPv6Any)
+        && !address.IsIPv6LinkLocal
+        && !address.IsIPv6Multicast
+        && !address.IsIPv6SiteLocal
+        && !IsPrivateUnicast(address)
+        && !IsDocumentationIpv6(address);
+
+    private static bool IsIpv4MulticastOrBroadcast(IPAddress address)
+    {
+        if (address.AddressFamily != AddressFamily.InterNetwork)
+        {
+            return false;
+        }
+
+        byte[] bytes = address.GetAddressBytes();
+        return bytes[0] >= 224 || bytes.All(static value => value == byte.MaxValue);
+    }
+
+    private static bool IsDocumentationIpv6(IPAddress address)
+    {
+        byte[] bytes = address.GetAddressBytes();
+        return bytes[0] == 0x20 && bytes[1] == 0x01 && bytes[2] == 0x0d && bytes[3] == 0xb8;
+    }
+
+    private static IPEndPoint ToIpEndpoint(ObservedEndpoint endpoint) =>
+        new(IPAddress.Parse(endpoint.Address), endpoint.Port);
+}

src/FinalFactory.Rendezvous.Server/Transport/UdpMediatorOptions.cs

@@ -18,9 +18,17 @@ public sealed class UdpMediatorOptions
     [Required]
     public string ListenAddress { get; set; } = "0.0.0.0";
 
+    public string? Ipv6ListenAddress { get; set; }
+
     /// <summary>
     /// Gets or sets the UDP port. Zero requests an ephemeral port for tests.
     /// </summary>
     [Range(0, 65_535)]
     public int Port { get; set; } = 9050;
+
+    [Range(1, 4_096)]
+    public int MaxDatagramsPerPoll { get; set; } = 256;
+
+    [Range(1, 100)]
+    public int PollIntervalMilliseconds { get; set; } = 2;
 }

src/FinalFactory.Rendezvous.Server/Transport/UdpMediatorService.cs

@@ -1,161 +1,136 @@
+using System.Diagnostics;
 using System.Net;
 using System.Net.Sockets;
 using FinalFactory.Rendezvous.Contracts;
-using FinalFactory.Rendezvous.Server.Sessions;
-using FinalFactory.Rendezvous.Server.State;
+using LiteNetLib;
+using LiteNetLib.Layers;
 using Microsoft.Extensions.Options;
 
 namespace FinalFactory.Rendezvous.Server.Transport;
 
-/// <summary>
-/// Owns the cancellable UDP socket used by the future NAT mediator.
-/// </summary>
 internal sealed partial class UdpMediatorService : BackgroundService
 {
     private readonly ILogger<UdpMediatorService> _logger;
     private readonly UdpMediatorOptions _options;
-    private readonly IEphemeralRendezvousStore _store;
-    private readonly ISessionCapabilityService _capabilities;
-    private UdpClient? _udpClient;
+    private readonly NatMediationProcessor _processor;
+    private LiteNetManager? _manager;
+    private LiteNetIntroductionSink? _introductionSink;
 
-    /// <summary>
-    /// Initializes a new UDP mediator service.
-    /// </summary>
     public UdpMediatorService(
         IOptions<UdpMediatorOptions> options,
         ILogger<UdpMediatorService> logger,
-        IEphemeralRendezvousStore store,
-        ISessionCapabilityService capabilities)
+        NatMediationProcessor processor)
     {
         _options = options.Value;
         _logger = logger;
-        _store = store;
-        _capabilities = capabilities;
+        _processor = processor;
     }
 
-    /// <summary>
-    /// Gets the bound endpoint after startup completes.
-    /// </summary>
     public IPEndPoint? LocalEndpoint { get; private set; }
+    public IPEndPoint? LocalIpv6Endpoint { get; private set; }
 
-    /// <inheritdoc />
     public override Task StartAsync(CancellationToken cancellationToken)
     {
         cancellationToken.ThrowIfCancellationRequested();
-
-        if (_udpClient is not null)
+        if (_manager is not null)
         {
             throw new InvalidOperationException("The UDP mediator is already running.");
         }
 
         IPAddress listenAddress = IPAddress.Parse(_options.ListenAddress);
-        UdpClient udpClient = new(new IPEndPoint(listenAddress, _options.Port));
-        _udpClient = udpClient;
-        IPEndPoint localEndpoint =
-            (IPEndPoint?)udpClient.Client.LocalEndPoint
-            ?? throw new InvalidOperationException("The UDP socket did not expose its bound endpoint.");
-        LocalEndpoint = localEndpoint;
+        if (listenAddress.AddressFamily != AddressFamily.InterNetwork)
+        {
+            throw new InvalidOperationException("The required UDP listen address must be IPv4.");
+        }
 
-        LogMediatorListening(_logger, localEndpoint.Address, localEndpoint.Port);
+        IPAddress? ipv6ListenAddress = string.IsNullOrWhiteSpace(_options.Ipv6ListenAddress)
+            ? null
+            : IPAddress.Parse(_options.Ipv6ListenAddress);
+        if (ipv6ListenAddress is not null
+            && ipv6ListenAddress.AddressFamily != AddressFamily.InterNetworkV6)
+        {
+            throw new InvalidOperationException("The optional UDP IPv6 listen address must be IPv6.");
+        }
 
+        EventBasedLiteNetListener listener = new();
+        RendezvousPacketLayer packetLayer = new(_processor);
+        LiteNetManager manager = new(listener, packetLayer)
+        {
+            NatPunchEnabled = true,
+            IPv6Enabled = ipv6ListenAddress is not null,
+            UnsyncedEvents = true,
+            MaxPacketPerManualReceive = _options.MaxDatagramsPerPoll,
+        };
+        manager.NatPunchModule.UnsyncedEvents = true;
+        _introductionSink = new(manager.NatPunchModule);
+        packetLayer.Attach(_introductionSink);
+
+        if (!manager.StartInManualMode(
+                listenAddress,
+                ipv6ListenAddress ?? IPAddress.IPv6Any,
+                _options.Port))
+        {
+            _introductionSink = null;
+            manager.Stop();
+            throw new InvalidOperationException("The UDP mediator could not bind its LiteNetLib socket.");
+        }
+
+        _manager = manager;
+        LocalEndpoint = new(listenAddress, manager.LocalPort);
+        LocalIpv6Endpoint = ipv6ListenAddress is null
+            ? null
+            : new(ipv6ListenAddress, manager.LocalPort);
+        LogMediatorListening(_logger, listenAddress, manager.LocalPort);
         return base.StartAsync(cancellationToken);
     }
 
-    /// <inheritdoc />
     public override async Task StopAsync(CancellationToken cancellationToken)
     {
         await base.StopAsync(cancellationToken).ConfigureAwait(false);
-        _udpClient?.Dispose();
-        _udpClient = null;
-        LocalEndpoint = null;
+        StopManager();
         LogMediatorStopped(_logger);
     }
 
-    /// <inheritdoc />
     public override void Dispose()
     {
-        _udpClient?.Dispose();
-        _udpClient = null;
-        LocalEndpoint = null;
+        StopManager();
         base.Dispose();
     }
 
-    /// <inheritdoc />
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
-        UdpClient udpClient = _udpClient
+        LiteNetManager manager = _manager
             ?? throw new InvalidOperationException("The UDP mediator socket was not initialized.");
-
+        long previous = Stopwatch.GetTimestamp();
         try
         {
             while (!stoppingToken.IsCancellationRequested)
             {
-                UdpReceiveResult received = await udpClient
-                    .ReceiveAsync(stoppingToken)
-                    .ConfigureAwait(false);
-                ProcessDatagram(received.Buffer, received.RemoteEndPoint, stoppingToken);
-                // Bootstrap deliberately emits no UDP response. Protocol handling lands in #11.
+                manager.PollEvents();
+                manager.NatPunchModule.PollEvents();
+                long current = Stopwatch.GetTimestamp();
+                manager.ManualUpdate((float)Stopwatch.GetElapsedTime(previous, current).TotalMilliseconds);
+                previous = current;
+                await Task.Delay(_options.PollIntervalMilliseconds, stoppingToken).ConfigureAwait(false);
             }
         }
         catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
         {
-            // Expected during normal shutdown.
-        }
-        catch (ObjectDisposedException) when (stoppingToken.IsCancellationRequested)
-        {
-            // Disposing the socket is the fallback that releases a blocked receive.
         }
         finally
         {
             LocalEndpoint = null;
+            LocalIpv6Endpoint = null;
         }
     }
 
-    internal UdpPresenceProcessingResult ProcessDatagram(
-        ReadOnlySpan<byte> encoded,
-        IPEndPoint observedSource,
-        CancellationToken cancellationToken = default)
+    private void StopManager()
     {
-        ArgumentNullException.ThrowIfNull(observedSource);
-        if (!RendezvousUdpCodec.TryDecode(encoded, out PresenceDatagram? datagram, out _)
-            || datagram is null
-            || !_capabilities.TryFingerprint(datagram.Capability, out SecretFingerprint fingerprint))
-        {
-            return UdpPresenceProcessingResult.Dropped;
-        }
-
-        if (datagram.MessageType != UdpPresenceMessageType.HostPresence)
-        {
-            return UdpPresenceProcessingResult.ClientPresenceDeferred;
-        }
-
-        AddressFamilyKind publicFamily = observedSource.AddressFamily switch
-        {
-            AddressFamily.InterNetwork => AddressFamilyKind.Ipv4,
-            AddressFamily.InterNetworkV6 => AddressFamilyKind.Ipv6,
-            _ => 0,
-        };
-        if (publicFamily == 0)
-        {
-            return UdpPresenceProcessingResult.Dropped;
-        }
-
-        ObservedEndpoint publicEndpoint = new(
-            publicFamily,
-            observedSource.Address.ToString(),
-            observedSource.Port);
-        ObservedEndpoint localEndpoint = new(
-            datagram.AddressFamily,
-            datagram.LocalAddress,
-            datagram.LocalPort);
-        StoreResult<StoredListing> bound = _store.BindHostPresence(new(
-            datagram.MediationHandle,
-            fingerprint,
-            publicEndpoint,
-            localEndpoint), cancellationToken);
-        return bound.Succeeded
-            ? UdpPresenceProcessingResult.HostPresenceAccepted
-            : UdpPresenceProcessingResult.HostPresenceRejected;
+        LiteNetManager? manager = Interlocked.Exchange(ref _manager, null);
+        _introductionSink = null;
+        LocalEndpoint = null;
+        LocalIpv6Endpoint = null;
+        manager?.Stop();
     }
 
     [LoggerMessage(
@@ -172,12 +147,62 @@ internal sealed partial class UdpMediatorService : BackgroundService
         Level = LogLevel.Information,
         Message = "UDP mediator stopped")]
     private static partial void LogMediatorStopped(ILogger logger);
-}
 
-internal enum UdpPresenceProcessingResult
-{
-    Dropped = 0,
-    HostPresenceAccepted = 1,
-    HostPresenceRejected = 2,
-    ClientPresenceDeferred = 3,
+    private sealed class LiteNetIntroductionSink(NatPunchModule module) : INatIntroductionSink
+    {
+        public void Introduce(NatIntroductionPlan plan) => module.NatIntroduce(
+            plan.HostLocal,
+            plan.HostPublic,
+            plan.ClientLocal,
+            plan.ClientPublic,
+            plan.IntroductionToken);
+    }
+
+    private sealed class RendezvousPacketLayer(NatMediationProcessor processor) : PacketLayerBase(0)
+    {
+        private INatIntroductionSink? _sink;
+
+        public void Attach(INatIntroductionSink sink) => _sink = sink;
+
+        public override void ProcessInboundPacket(
+            ref IPEndPoint endPoint,
+            ref byte[] data,
+            ref int length)
+        {
+            bool isFrozenEnvelope = length >= 2
+                && data[0] == RendezvousUdpCodec.MagicFirst
+                && data[1] == RendezvousUdpCodec.MagicSecond;
+            INatIntroductionSink? sink = _sink;
+            if (isFrozenEnvelope)
+            {
+                if (sink is not null)
+                {
+                    _ = processor.ProcessDatagram(data.AsSpan(0, length), endPoint, sink);
+                }
+            }
+            else if (sink is not null
+                     && LiteNetNatRequestCodec.TryDecode(
+                         data.AsSpan(0, length),
+                         out IPEndPoint? claimedLocalEndpoint,
+                         out string? token)
+                     && claimedLocalEndpoint is not null
+                     && token is not null)
+            {
+                _ = processor.ProcessRequest(claimedLocalEndpoint, endPoint, token, sink);
+            }
+
+            // Every inbound packet is consumed here. NatPunchModule is used only for outbound introductions.
+            Drop(ref length);
+        }
+
+        public override void ProcessOutBoundPacket(
+            ref IPEndPoint endPoint,
+            ref byte[] data,
+            ref int offset,
+            ref int length)
+        {
+        }
+
+        private static void Drop(ref int length) => length = 0;
+    }
 }

src/FinalFactory.Rendezvous.Server/appsettings.json

@@ -2,7 +2,9 @@
   "Rendezvous": {
     "Udp": {
       "ListenAddress": "0.0.0.0",
-      "Port": 9050
+      "Port": 9050,
+      "MaxDatagramsPerPoll": 256,
+      "PollIntervalMilliseconds": 2
     }
   },
   "Logging": {

tests/FinalFactory.Rendezvous.Tests/Client/RendezvousCoordinatorBehaviorTests.cs

@@ -0,0 +1,616 @@
+using System.Net;
+using FinalFactory.Rendezvous.Client;
+using FinalFactory.Rendezvous.Contracts;
+using LiteNetLib;
+
+namespace FinalFactory.Rendezvous.Tests.Client;
+
+public sealed class RendezvousCoordinatorBehaviorTests
+{
+    [Fact]
+    public void NatIntroductionAloneDoesNotCompleteTheClientAttempt()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness harness = new(clock);
+        int completions = 0;
+        harness.Coordinator.Completed += (_, _) => completions++;
+
+        ((INatPunchListener)harness.PunchEvents).OnNatIntroductionSuccess(
+            new IPEndPoint(IPAddress.Loopback, 65_000),
+            NatAddressType.External,
+            harness.IntroductionToken);
+
+        Assert.Equal(RendezvousConnectionState.Connecting, harness.Coordinator.State);
+        Assert.False(harness.Coordinator.IsCompleted);
+        Assert.Equal(0, completions);
+    }
+
+    [Fact]
+    public void ClientRejectsASyntacticallyValidIntroductionWithTheWrongTicket()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness harness = new(clock);
+        string forged = NatIntroductionTokenCodec.Encode(
+            harness.AttemptId,
+            Credential('F'));
+
+        ((INatPunchListener)harness.PunchEvents).OnNatIntroductionSuccess(
+            new IPEndPoint(IPAddress.Loopback, 65_000),
+            NatAddressType.External,
+            forged);
+
+        Assert.Equal(RendezvousConnectionState.Punching, harness.Coordinator.State);
+        Assert.False(harness.Coordinator.IsCompleted);
+    }
+
+    [Fact]
+    public void CancellationCompletesExactlyOnceAndLateCallbacksCannotReopenTheAttempt()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness harness = new(clock);
+        List<RendezvousConnectionState> completions = [];
+        harness.Coordinator.Completed += (_, completion) => completions.Add(completion.State);
+
+        harness.Coordinator.Cancel();
+        harness.Coordinator.Poll();
+        ((INatPunchListener)harness.PunchEvents).OnNatIntroductionSuccess(
+            new IPEndPoint(IPAddress.Loopback, 65_000),
+            NatAddressType.External,
+            harness.IntroductionToken);
+        harness.Coordinator.Poll();
+
+        Assert.Equal(RendezvousConnectionState.Cancelled, harness.Coordinator.State);
+        Assert.Equal([RendezvousConnectionState.Cancelled], completions);
+    }
+
+    [Fact]
+    public void ExhaustedPunchBudgetTimesOutExactlyOnceUnderAFakeClock()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness harness = new(clock, new RendezvousCoordinatorOptions
+        {
+            MaximumPunchRequests = 1,
+            InitialPunchRetryDelay = TimeSpan.FromMilliseconds(10),
+            MaximumPunchRetryDelay = TimeSpan.FromMilliseconds(10),
+            JitterRatio = 0,
+        });
+        int completions = 0;
+        harness.Coordinator.Completed += (_, _) => completions++;
+
+        harness.Coordinator.Poll();
+        clock.Advance(TimeSpan.FromMilliseconds(10));
+        harness.Coordinator.Poll();
+        clock.Advance(TimeSpan.FromMinutes(1));
+        harness.Coordinator.Poll();
+
+        Assert.Equal(RendezvousConnectionState.TimedOut, harness.Coordinator.State);
+        Assert.Equal(1, completions);
+    }
+
+    [Fact]
+    public void ManagerShutdownAndDisposalEachReleaseTheirTerminalPathOnce()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness stopped = new(clock);
+        int stoppedCompletions = 0;
+        stopped.Coordinator.Completed += (_, _) => stoppedCompletions++;
+        stopped.Manager.Stop();
+
+        stopped.Coordinator.Poll();
+        stopped.Coordinator.Poll();
+
+        Assert.Equal(RendezvousConnectionState.ManagerStopped, stopped.Coordinator.State);
+        Assert.Equal(1, stoppedCompletions);
+
+        using ClientHarness disposed = new(clock);
+        int disposedCompletions = 0;
+        disposed.Coordinator.Completed += (_, _) => disposedCompletions++;
+        disposed.Coordinator.Dispose();
+        disposed.Coordinator.Dispose();
+        ((INatPunchListener)disposed.PunchEvents).OnNatIntroductionSuccess(
+            new IPEndPoint(IPAddress.Loopback, 65_000),
+            NatAddressType.External,
+            disposed.IntroductionToken);
+
+        Assert.Equal(RendezvousConnectionState.Disposed, disposed.Coordinator.State);
+        Assert.Equal(1, disposedCompletions);
+        Assert.Throws<ObjectDisposedException>(() => disposed.Coordinator.Poll());
+    }
+
+    [Fact]
+    public async Task DirectConnectionRejectionProducesOneTerminalTransition()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        using ClientHarness client = new(clock);
+        EventBasedNetListener rejectingEvents = new();
+        rejectingEvents.ConnectionRequestEvent += request => request.Reject();
+        NetManager rejectingHost = new(rejectingEvents);
+        try
+        {
+            Assert.True(rejectingHost.Start(0));
+            int completions = 0;
+            client.Coordinator.Completed += (_, _) => completions++;
+            ((INatPunchListener)client.PunchEvents).OnNatIntroductionSuccess(
+                new IPEndPoint(IPAddress.Loopback, rejectingHost.LocalPort),
+                NatAddressType.External,
+                client.IntroductionToken);
+
+            DateTime deadline = DateTime.UtcNow.AddSeconds(2);
+            while (!client.Coordinator.IsCompleted && DateTime.UtcNow < deadline)
+            {
+                rejectingHost.PollEvents();
+                client.Coordinator.Poll();
+                await Task.Delay(2);
+            }
+
+            Assert.Equal(RendezvousConnectionState.Rejected, client.Coordinator.State);
+            Assert.Equal(1, completions);
+            client.Coordinator.Poll();
+            Assert.Equal(1, completions);
+        }
+        finally
+        {
+            rejectingHost.Stop();
+        }
+    }
+
+    [Fact]
+    public void UnsynchronizedLiteNetCallbacksAreRejectedAtConstruction()
+    {
+        RendezvousNetListener networkEvents = new();
+        NetManager manager = networkEvents.CreateManager();
+        manager.UnsyncedEvents = true;
+        try
+        {
+            Assert.True(manager.Start(0));
+            Assert.Throws<InvalidOperationException>(() => new RendezvousClientCoordinator(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 9_050),
+                CreateAttempt(new DateTimeOffset(2030, 1, 1, 0, 0, 30, TimeSpan.Zero))));
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public void CoordinatorRejectsAManagerCreatedByAnotherRoutingListener()
+    {
+        RendezvousNetListener managerEvents = new();
+        NetManager manager = managerEvents.CreateManager();
+        RendezvousNetListener mismatchedEvents = new();
+        try
+        {
+            Assert.True(manager.Start(0));
+
+            Assert.Throws<InvalidOperationException>(() => new RendezvousClientCoordinator(
+                manager,
+                mismatchedEvents,
+                new IPEndPoint(IPAddress.Loopback, 9_050),
+                CreateAttempt(new DateTimeOffset(2030, 1, 1, 0, 0, 30, TimeSpan.Zero))));
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public async Task PublishedSessionTimingRemainsValidDuringConcurrentRenewalReads()
+    {
+        DateTimeOffset firstExpiry = new(2030, 1, 1, 0, 1, 0, TimeSpan.Zero);
+        DateTimeOffset secondExpiry = new(2030, 1, 1, 0, 2, 0, TimeSpan.Zero);
+        PublishedSession session = CreateSession(firstExpiry);
+
+        Task writer = Task.Run(() =>
+        {
+            for (int index = 0; index < 10_000; index++)
+            {
+                session.ExpiresAt = index % 2 == 0 ? firstExpiry : secondExpiry;
+                session.LeaseRenewAfterSeconds = index % 2 == 0 ? 10 : 20;
+            }
+        });
+        Task reader = Task.Run(() =>
+        {
+            for (int index = 0; index < 10_000; index++)
+            {
+                DateTimeOffset expiry = session.ExpiresAt;
+                int renewAfter = session.LeaseRenewAfterSeconds;
+                Assert.True(expiry == firstExpiry || expiry == secondExpiry);
+                Assert.True(renewAfter is 10 or 20 or 30);
+            }
+        });
+
+        await Task.WhenAll(writer, reader);
+    }
+
+    [Fact]
+    public async Task HostDoesNotMistakeAnIntroducedAttemptForCancellationWhenItLeavesPolling()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        RendezvousNetListener networkEvents = new();
+        EventBasedNatPunchListener punchEvents = networkEvents.PunchEvents;
+        NetManager manager = networkEvents.CreateManager();
+        JoinAttemptId attemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000111"));
+        HostJoinAttempt invitation = new()
+        {
+            AttemptId = attemptId,
+            MediationHandle = new(Guid.Parse("00000000-0000-0000-0000-000000000112")),
+            HostPunchCapability = Credential('H'),
+            ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+                NatIntroductionTokenCodec.Encode(attemptId, Credential('T'))),
+            ExpiresAt = clock.UtcNow + TimeSpan.FromSeconds(30),
+        };
+        MutableJoinClient joins = new([invitation]);
+        using ConnectionTicketValidator tickets = new(16, clock);
+        try
+        {
+            Assert.True(manager.Start(0));
+            using RendezvousHostCoordinator host = new(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_002),
+                CreateSession(clock.UtcNow + TimeSpan.FromMinutes(1)),
+                joins,
+                new RendezvousCoordinatorOptions { JitterRatio = 0 },
+                clock,
+                tickets);
+            int completions = 0;
+            host.AttemptCompleted += (_, _) => completions++;
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+            Assert.Equal(1, host.PendingAttemptCount);
+
+            ((INatPunchListener)punchEvents).OnNatIntroductionSuccess(
+                new IPEndPoint(IPAddress.Loopback, 65_003),
+                NatAddressType.External,
+                NatIntroductionTokenCodec.Encode(attemptId, Credential('T')));
+            joins.Attempts = [];
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+
+            Assert.Equal(1, host.PendingAttemptCount);
+            Assert.Equal(0, completions);
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public async Task HostCancellationSnapshotRevokesAnAuthorizedTicketAndCompletesOnce()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        RendezvousNetListener networkEvents = new();
+        EventBasedNatPunchListener punchEvents = networkEvents.PunchEvents;
+        NetManager manager = networkEvents.CreateManager();
+        JoinAttemptId attemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000131"));
+        string ticket = NatIntroductionTokenCodec.Encode(attemptId, Credential('T'));
+        HostJoinAttempt invitation = CreateHostAttempt(
+            attemptId,
+            new(Guid.Parse("00000000-0000-0000-0000-000000000132")),
+            ticket,
+            clock.UtcNow + TimeSpan.FromSeconds(30));
+        MutableJoinClient joins = new([invitation]);
+        using ConnectionTicketValidator tickets = new(16, clock);
+        try
+        {
+            Assert.True(manager.Start(0));
+            using RendezvousHostCoordinator host = new(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_002),
+                CreateSession(clock.UtcNow + TimeSpan.FromMinutes(1)),
+                joins,
+                new RendezvousCoordinatorOptions { JitterRatio = 0 },
+                clock,
+                tickets);
+            List<RendezvousConnectionState> completions = [];
+            host.AttemptCompleted += (_, completion) => completions.Add(completion.State);
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+            ((INatPunchListener)punchEvents).OnNatIntroductionSuccess(
+                new IPEndPoint(IPAddress.Loopback, 65_003),
+                NatAddressType.External,
+                ticket);
+
+            invitation.IsCancelled = true;
+            joins.Attempts = [invitation];
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+            host.Poll();
+
+            Assert.Equal(0, host.PendingAttemptCount);
+            Assert.Equal([RendezvousConnectionState.Cancelled], completions);
+            Assert.Equal(
+                ConnectionTicketConsumptionResult.Revoked,
+                tickets.Consume(attemptId, ticket));
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public async Task HostAppliesOnlyTheLatestUnpolledSnapshot()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        RendezvousNetListener networkEvents = new();
+        NetManager manager = networkEvents.CreateManager();
+        JoinAttemptId attemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000141"));
+        HostJoinAttempt invitation = CreateHostAttempt(
+            attemptId,
+            new(Guid.Parse("00000000-0000-0000-0000-000000000142")),
+            NatIntroductionTokenCodec.Encode(attemptId, Credential('T')),
+            clock.UtcNow + TimeSpan.FromSeconds(30));
+        MutableJoinClient joins = new([invitation]);
+        try
+        {
+            Assert.True(manager.Start(0));
+            using RendezvousHostCoordinator host = new(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_002),
+                CreateSession(clock.UtcNow + TimeSpan.FromMinutes(1)),
+                joins,
+                new RendezvousCoordinatorOptions { JitterRatio = 0 },
+                clock,
+                null);
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            joins.Attempts = [];
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+
+            host.Poll();
+
+            Assert.Equal(0, host.PendingAttemptCount);
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public async Task DisposingHostDuringRefreshDropsTheLateSnapshot()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        RendezvousNetListener networkEvents = new();
+        NetManager manager = networkEvents.CreateManager();
+        BlockingJoinClient joins = new();
+        try
+        {
+            Assert.True(manager.Start(0));
+            RendezvousHostCoordinator host = new(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_002),
+                CreateSession(clock.UtcNow + TimeSpan.FromMinutes(1)),
+                joins,
+                new RendezvousCoordinatorOptions { JitterRatio = 0 },
+                clock,
+                null);
+            Task<RendezvousClientResult<int>> refresh = host.RefreshJoinAttemptsAsync();
+            await joins.WaitUntilCalled;
+
+            host.Dispose();
+            joins.Complete([]);
+
+            await Assert.ThrowsAsync<ObjectDisposedException>(async () => await refresh);
+            Assert.Throws<ObjectDisposedException>(() => host.Poll());
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    [Fact]
+    public async Task HostBoundsAttemptExpiryChecksPerPoll()
+    {
+        ManualCoordinatorClock clock = new(new(2030, 1, 1, 0, 0, 0, TimeSpan.Zero));
+        RendezvousNetListener networkEvents = new();
+        NetManager manager = networkEvents.CreateManager();
+        JoinAttemptId firstId = new(Guid.Parse("00000000-0000-0000-0000-000000000151"));
+        JoinAttemptId secondId = new(Guid.Parse("00000000-0000-0000-0000-000000000152"));
+        DateTimeOffset expiresAt = clock.UtcNow + TimeSpan.FromSeconds(1);
+        MutableJoinClient joins = new([
+            CreateHostAttempt(
+                firstId,
+                new(Guid.Parse("00000000-0000-0000-0000-000000000153")),
+                NatIntroductionTokenCodec.Encode(firstId, Credential('T')),
+                expiresAt),
+            CreateHostAttempt(
+                secondId,
+                new(Guid.Parse("00000000-0000-0000-0000-000000000154")),
+                NatIntroductionTokenCodec.Encode(secondId, Credential('U')),
+                expiresAt),
+        ]);
+        try
+        {
+            Assert.True(manager.Start(0));
+            using RendezvousHostCoordinator host = new(
+                manager,
+                networkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_002),
+                CreateSession(clock.UtcNow + TimeSpan.FromMinutes(1)),
+                joins,
+                new RendezvousCoordinatorOptions
+                {
+                    MaximumAttemptChecksPerPoll = 1,
+                    JitterRatio = 0,
+                },
+                clock,
+                null);
+            List<RendezvousConnectionState> completions = [];
+            host.AttemptCompleted += (_, completion) => completions.Add(completion.State);
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+            clock.Advance(TimeSpan.FromSeconds(2));
+
+            host.Poll();
+
+            Assert.Equal(1, host.PendingAttemptCount);
+            Assert.Equal([RendezvousConnectionState.TimedOut], completions);
+            host.Poll();
+            Assert.Equal(0, host.PendingAttemptCount);
+            Assert.Equal(
+                [RendezvousConnectionState.TimedOut, RendezvousConnectionState.TimedOut],
+                completions);
+        }
+        finally
+        {
+            manager.Stop();
+        }
+    }
+
+    private static CreateJoinAttemptResponse CreateAttempt(DateTimeOffset expiresAt) => new()
+    {
+        AttemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000101")),
+        MediationHandle = new(Guid.Parse("00000000-0000-0000-0000-000000000102")),
+        ClientPunchCapability = Credential('C'),
+        ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+            NatIntroductionTokenCodec.Encode(
+                new JoinAttemptId(Guid.Parse("00000000-0000-0000-0000-000000000101")),
+                Credential('T'))),
+        ExpiresAt = expiresAt,
+    };
+
+    private static PublishedSession CreateSession(DateTimeOffset expiresAt) => new(new RegisterSessionResponse
+    {
+        ListingId = new(Guid.Parse("00000000-0000-0000-0000-000000000121")),
+        LeaseId = new(Guid.Parse("00000000-0000-0000-0000-000000000122")),
+        LeaseToken = "lease-token",
+        HostPresenceHandle = new(Guid.Parse("00000000-0000-0000-0000-000000000123")),
+        HostPresenceCapability = Credential('P'),
+        ExpiresAt = expiresAt,
+        LeaseRenewAfterSeconds = 30,
+        HostPresenceRefreshAfterSeconds = 10,
+    });
+
+    private static HostJoinAttempt CreateHostAttempt(
+        JoinAttemptId attemptId,
+        MediationHandle mediationHandle,
+        string connectionTicket,
+        DateTimeOffset expiresAt) => new()
+        {
+            AttemptId = attemptId,
+            MediationHandle = mediationHandle,
+            HostPunchCapability = Credential('H'),
+            ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(connectionTicket),
+            ExpiresAt = expiresAt,
+        };
+
+    private static string Credential(char value) => new(value, ContractLimits.DerivedCredentialCharacters);
+
+    private sealed class ClientHarness : IDisposable
+    {
+        internal ClientHarness(
+            ManualCoordinatorClock clock,
+            RendezvousCoordinatorOptions? options = null)
+        {
+            NetworkEvents = new();
+            PunchEvents = NetworkEvents.PunchEvents;
+            Manager = NetworkEvents.CreateManager();
+            Assert.True(Manager.Start(0));
+            CreateJoinAttemptResponse attempt = CreateAttempt(clock.UtcNow + TimeSpan.FromSeconds(30));
+            AttemptId = attempt.AttemptId;
+            IntroductionToken = NatIntroductionTokenCodec.Encode(
+                attempt.AttemptId,
+                Credential('T'));
+            Coordinator = new(
+                Manager,
+                NetworkEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_001),
+                attempt,
+                options,
+                clock);
+        }
+
+        internal RendezvousNetListener NetworkEvents { get; }
+        internal EventBasedNatPunchListener PunchEvents { get; }
+        internal NetManager Manager { get; }
+        internal RendezvousClientCoordinator Coordinator { get; }
+        internal JoinAttemptId AttemptId { get; }
+        internal string IntroductionToken { get; }
+
+        public void Dispose()
+        {
+            Coordinator.Dispose();
+            Manager.Stop();
+        }
+    }
+
+    private sealed class MutableJoinClient(IReadOnlyList<HostJoinAttempt> attempts) : IRendezvousJoinClient
+    {
+        internal IReadOnlyList<HostJoinAttempt> Attempts { get; set; } = attempts;
+
+        public Task<RendezvousClientResult<CreateJoinAttemptResponse>> CreateAsync(
+            CreateJoinAttemptRequest request,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<bool>> CancelAsync(
+            CreateJoinAttemptResponse attempt,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(
+            PublishedSession session,
+            int pageSize = ContractLimits.BrowserPageMaxItems,
+            string? cursor = null,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<IReadOnlyList<HostJoinAttempt>>> BrowseAllForHostAsync(
+            PublishedSession session,
+            int maximumPages = 100,
+            CancellationToken cancellationToken = default) => Task.FromResult(
+                RendezvousClientResult.Success(Attempts));
+    }
+
+    private sealed class BlockingJoinClient : IRendezvousJoinClient
+    {
+        private readonly TaskCompletionSource<bool> _called = new(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly TaskCompletionSource<IReadOnlyList<HostJoinAttempt>> _result = new(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+
+        internal Task WaitUntilCalled => _called.Task;
+
+        internal void Complete(IReadOnlyList<HostJoinAttempt> attempts) =>
+            _result.SetResult(attempts);
+
+        public Task<RendezvousClientResult<CreateJoinAttemptResponse>> CreateAsync(
+            CreateJoinAttemptRequest request,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<bool>> CancelAsync(
+            CreateJoinAttemptResponse attempt,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(
+            PublishedSession session,
+            int pageSize = ContractLimits.BrowserPageMaxItems,
+            string? cursor = null,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public async Task<RendezvousClientResult<IReadOnlyList<HostJoinAttempt>>> BrowseAllForHostAsync(
+            PublishedSession session,
+            int maximumPages = 100,
+            CancellationToken cancellationToken = default)
+        {
+            _called.SetResult(true);
+            return RendezvousClientResult.Success(await _result.Task.WaitAsync(cancellationToken));
+        }
+    }
+
+    private sealed class ManualCoordinatorClock(DateTimeOffset now) :
+        IRendezvousCoordinatorClock,
+        IConnectionTicketClock
+    {
+        public DateTimeOffset UtcNow { get; private set; } = now;
+
+        internal void Advance(TimeSpan amount) => UtcNow += amount;
+    }
+}

tests/FinalFactory.Rendezvous.Tests/Client/RendezvousCoordinatorIntegrationTests.cs

@@ -0,0 +1,272 @@
+using System.Net;
+using FinalFactory.Rendezvous.Client;
+using FinalFactory.Rendezvous.Contracts;
+using FinalFactory.Rendezvous.Server.JoinAttempts;
+using FinalFactory.Rendezvous.Server.State;
+using FinalFactory.Rendezvous.Server.Transport;
+using FinalFactory.Rendezvous.Tests.JoinAttempts;
+using LiteNetLib;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+
+namespace FinalFactory.Rendezvous.Tests.Client;
+
+public sealed class RendezvousCoordinatorIntegrationTests
+{
+    [Fact]
+    public async Task CallerOwnedManagersCompleteAuthenticatedDirectConnectionAndRejectTicketReplay()
+    {
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(8));
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId, "sdk-direct-connect");
+        HostJoinAttempt hostAttempt = fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items.Single(item => item.AttemptId == created.AttemptId);
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService mediatorService = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                PollIntervalMilliseconds = 1,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+        await mediatorService.StartAsync(timeout.Token);
+
+        RendezvousNetListener hostEvents = new();
+        RendezvousNetListener clientEvents = new();
+        bool gameplayConnectionRequestHandled = false;
+        hostEvents.GameplayEvents.ConnectionRequestEvent += _ =>
+            gameplayConnectionRequestHandled = true;
+        EventBasedNatPunchListener hostPunch = hostEvents.PunchEvents;
+        EventBasedNatPunchListener clientPunch = clientEvents.PunchEvents;
+        NetManager hostManager = hostEvents.CreateManager();
+        NetManager clientManager = clientEvents.CreateManager();
+        string? introductionToken = null;
+        string? hostIntroductionToken = null;
+        clientPunch.NatIntroductionSuccess += (_, _, token) => introductionToken = token;
+        hostPunch.NatIntroductionSuccess += (_, _, token) => hostIntroductionToken = token;
+
+        try
+        {
+            Assert.True(hostManager.Start(0));
+            Assert.True(clientManager.Start(0));
+            IPEndPoint mediator = Assert.IsType<IPEndPoint>(mediatorService.LocalEndpoint);
+            FakeJoinClient joinClient = new([hostAttempt]);
+            FixedCoordinatorClock clock = new(fixture.Sessions.Clock.UtcNow);
+            using ConnectionTicketValidator tickets = new(1_024, clock);
+            using RendezvousHostCoordinator host = new(
+                hostManager,
+                hostEvents,
+                mediator,
+                new PublishedSession(registration),
+                joinClient,
+                FastOptions(),
+                clock,
+                tickets);
+            using RendezvousClientCoordinator client = new(
+                clientManager,
+                clientEvents,
+                mediator,
+                created,
+                FastOptions(),
+                clock);
+            List<RendezvousHostAttemptCompletedEventArgs> hostCompletions = [];
+            List<RendezvousConnectionCompletedEventArgs> clientCompletions = [];
+            host.AttemptCompleted += (_, completion) => hostCompletions.Add(completion);
+            client.Completed += (_, completion) => clientCompletions.Add(completion);
+            Assert.True((await host.RefreshJoinAttemptsAsync(timeout.Token)).IsSuccess);
+
+            while ((!client.IsCompleted || hostCompletions.Count == 0)
+                   && !timeout.IsCancellationRequested)
+            {
+                host.Poll();
+                client.Poll();
+                await Task.Delay(2);
+            }
+
+            Assert.True(
+                client.State == RendezvousConnectionState.Connected,
+                $"Client ended in {client.State}; host pending={host.PendingAttemptCount}; "
+                + $"host completions={hostCompletions.Count}; introduction={introductionToken is not null}; "
+                + $"host introduction={hostIntroductionToken is not null}; "
+                + $"client digest={NatIntroductionTokenCodec.MatchesDigest(introductionToken, created.ConnectionTicketDigest)}; "
+                + $"host digest={NatIntroductionTokenCodec.MatchesDigest(hostIntroductionToken, hostAttempt.ConnectionTicketDigest)}.");
+            Assert.NotNull(client.ConnectedPeer);
+            Assert.Equal(
+                RendezvousConnectionState.Connected,
+                Assert.Single(clientCompletions).State);
+            RendezvousHostAttemptCompletedEventArgs hostCompletion = Assert.Single(hostCompletions);
+            Assert.Equal(created.AttemptId, hostCompletion.AttemptId);
+            Assert.Equal(RendezvousConnectionState.Connected, hostCompletion.State);
+            Assert.NotNull(hostCompletion.Peer);
+            Assert.False(gameplayConnectionRequestHandled);
+            Assert.True(NatIntroductionTokenCodec.TryDecode(
+                introductionToken,
+                out NatIntroductionToken? introduction));
+            Assert.NotNull(introduction);
+
+            EventBasedNetListener replayEvents = new();
+            bool replayConnected = false;
+            replayEvents.PeerConnectedEvent += _ => replayConnected = true;
+            NetManager replayManager = new(replayEvents);
+            try
+            {
+                Assert.True(replayManager.Start(0));
+                replayManager.Connect(
+                    new IPEndPoint(IPAddress.Loopback, hostManager.LocalPort),
+                    DirectConnectionRequestCodec.Encode(
+                        created.AttemptId,
+                        introduction.ConnectionTicket));
+                DateTime replayDeadline = DateTime.UtcNow.AddSeconds(1);
+                while (DateTime.UtcNow < replayDeadline && !replayConnected)
+                {
+                    host.Poll();
+                    replayManager.PollEvents();
+                    await Task.Delay(2, timeout.Token);
+                }
+
+                Assert.False(replayConnected);
+                Assert.False(gameplayConnectionRequestHandled);
+                Assert.Single(hostCompletions);
+            }
+            finally
+            {
+                replayManager.Stop();
+            }
+        }
+        finally
+        {
+            hostManager.Stop();
+            clientManager.Stop();
+            await mediatorService.StopAsync(CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public async Task HostDefersADirectRequestUntilTheMatchingNatIntroductionArrives()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId, "direct-before-nat");
+        HostJoinAttempt hostAttempt = fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items.Single(item => item.AttemptId == created.AttemptId);
+        IntroductionEndpoints introduction = fixture.Introduce(registration, created);
+        ConnectionTicketGrant grant = Assert.IsType<ConnectionTicketGrant>(
+            fixture.Service.IssueConnectionTicket(introduction.Attempt).Value);
+        RendezvousNetListener hostEvents = new();
+        EventBasedNatPunchListener hostPunch = hostEvents.PunchEvents;
+        EventBasedNetListener clientEvents = new();
+        bool clientConnected = false;
+        clientEvents.PeerConnectedEvent += _ => clientConnected = true;
+        NetManager hostManager = hostEvents.CreateManager();
+        NetManager clientManager = new(clientEvents);
+        try
+        {
+            Assert.True(hostManager.Start(0));
+            Assert.True(clientManager.Start(0));
+            FixedCoordinatorClock clock = new(fixture.Sessions.Clock.UtcNow);
+            FakeJoinClient joins = new([hostAttempt]);
+            using ConnectionTicketValidator tickets = new(16, clock);
+            using RendezvousHostCoordinator host = new(
+                hostManager,
+                hostEvents,
+                new IPEndPoint(IPAddress.Loopback, 65_000),
+                new PublishedSession(registration),
+                joins,
+                FastOptions(),
+                clock,
+                tickets);
+            List<RendezvousHostAttemptCompletedEventArgs> completions = [];
+            host.AttemptCompleted += (_, completion) => completions.Add(completion);
+            Assert.True((await host.RefreshJoinAttemptsAsync()).IsSuccess);
+            host.Poll();
+            bool observedDeferredRequest = false;
+            hostEvents.RendezvousConnectionRequest += _ =>
+            {
+                observedDeferredRequest = host.DeferredRequestCount == 1;
+                ((INatPunchListener)hostPunch).OnNatIntroductionSuccess(
+                    new IPEndPoint(IPAddress.Loopback, clientManager.LocalPort),
+                    NatAddressType.External,
+                    grant.Ticket);
+            };
+
+            clientManager.Connect(
+                new IPEndPoint(IPAddress.Loopback, hostManager.LocalPort),
+                DirectConnectionRequestCodec.Encode(created.AttemptId, grant.Ticket));
+            DateTime connectedDeadline = DateTime.UtcNow.AddSeconds(1);
+            while ((!clientConnected || completions.Count == 0)
+                   && DateTime.UtcNow < connectedDeadline)
+            {
+                host.Poll();
+                clientManager.PollEvents();
+                await Task.Delay(2);
+            }
+
+            Assert.True(
+                clientConnected,
+                $"Deferred observed={observedDeferredRequest}; deferred={host.DeferredRequestCount}; "
+                + $"pending={host.PendingAttemptCount}; completions={completions.Count}.");
+            Assert.True(observedDeferredRequest);
+            Assert.Equal(0, host.DeferredRequestCount);
+            Assert.Equal(
+                RendezvousConnectionState.Connected,
+                Assert.Single(completions).State);
+        }
+        finally
+        {
+            hostManager.Stop();
+            clientManager.Stop();
+        }
+    }
+
+    private static RendezvousCoordinatorOptions FastOptions() => new()
+    {
+        MaximumPunchRequests = 20,
+        InitialPunchRetryDelay = TimeSpan.FromMilliseconds(10),
+        MaximumPunchRetryDelay = TimeSpan.FromMilliseconds(100),
+        JitterRatio = 0,
+    };
+
+    private sealed class FakeJoinClient(IReadOnlyList<HostJoinAttempt> attempts) : IRendezvousJoinClient
+    {
+        public Task<RendezvousClientResult<CreateJoinAttemptResponse>> CreateAsync(
+            CreateJoinAttemptRequest request,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<bool>> CancelAsync(
+            CreateJoinAttemptResponse attempt,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(
+            PublishedSession session,
+            int pageSize = ContractLimits.BrowserPageMaxItems,
+            string? cursor = null,
+            CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<RendezvousClientResult<IReadOnlyList<HostJoinAttempt>>> BrowseAllForHostAsync(
+            PublishedSession session,
+            int maximumPages = 100,
+            CancellationToken cancellationToken = default) => Task.FromResult(
+                RendezvousClientResult.Success(attempts));
+    }
+
+    private sealed class FixedCoordinatorClock(DateTimeOffset now) :
+        IRendezvousCoordinatorClock,
+        IConnectionTicketClock
+    {
+        public DateTimeOffset UtcNow { get; } = now;
+    }
+}

tests/FinalFactory.Rendezvous.Tests/Client/RendezvousJoinClientTests.cs

@@ -0,0 +1,154 @@
+using System.Net;
+using System.Text.Json;
+using FinalFactory.Rendezvous.Client;
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Tests.Client;
+
+public sealed class RendezvousJoinClientTests
+{
+    [Fact]
+    public async Task JoinIssuanceRetriesTheSameIdempotentPayloadAndCancellationUsesCapability()
+    {
+        CreateJoinAttemptResponse created = CreateAttempt();
+        RecordingHandler handler = new(
+            new HttpResponseMessage(HttpStatusCode.ServiceUnavailable),
+            JsonResponse(HttpStatusCode.Created, created),
+            new HttpResponseMessage(HttpStatusCode.NoContent));
+        using HttpClient http = new(handler) { BaseAddress = new("http://rendezvous.test/") };
+        RendezvousJoinClient client = new(
+            http,
+            new RendezvousClientOptions { JitterRatio = 0 },
+            new ImmediateDelay());
+        CreateJoinAttemptRequest request = new()
+        {
+            IdempotencyKey = "stable-join-key",
+            GameId = new("space-game"),
+            EnvironmentId = new("production"),
+            ListingId = new(Guid.Parse("00000000-0000-0000-0000-000000000201")),
+            ProtocolVersion = 7,
+        };
+
+        RendezvousClientResult<CreateJoinAttemptResponse> result = await client.CreateAsync(request);
+        RendezvousClientResult<bool> cancelled = await client.CancelAsync(created);
+
+        Assert.True(result.IsSuccess, result.Message);
+        Assert.True(cancelled.IsSuccess, cancelled.Message);
+        Assert.Equal(handler.Requests[0].Body, handler.Requests[1].Body);
+        Assert.Contains("stable-join-key", handler.Requests[0].Body, StringComparison.Ordinal);
+        RecordedRequest cancellation = handler.Requests[2];
+        Assert.Equal(HttpMethod.Delete, cancellation.Method);
+        Assert.Equal(
+            created.ClientPunchCapability,
+            cancellation.Headers["X-Rendezvous-Client-Punch-Capability"]);
+    }
+
+    [Fact]
+    public async Task HostInvitationPollingFollowsCursorsWithTheLeaseToken()
+    {
+        HostJoinAttempt first = CreateHostAttempt("00000000-0000-0000-0000-000000000211");
+        HostJoinAttempt second = CreateHostAttempt("00000000-0000-0000-0000-000000000212");
+        RecordingHandler handler = new(
+            JsonResponse(HttpStatusCode.OK, new BrowseHostJoinAttemptsResponse
+            {
+                Items = [first],
+                NextCursor = "next page+cursor",
+            }),
+            JsonResponse(HttpStatusCode.OK, new BrowseHostJoinAttemptsResponse
+            {
+                Items = [second],
+            }));
+        using HttpClient http = new(handler) { BaseAddress = new("http://rendezvous.test/") };
+        RendezvousJoinClient client = new(http);
+        PublishedSession session = new(new RegisterSessionResponse
+        {
+            ListingId = new(Guid.Parse("00000000-0000-0000-0000-000000000220")),
+            LeaseId = new(Guid.Parse("00000000-0000-0000-0000-000000000221")),
+            LeaseToken = "lease-secret",
+            HostPresenceHandle = new(Guid.Parse("00000000-0000-0000-0000-000000000222")),
+            HostPresenceCapability = Credential('P'),
+            ExpiresAt = new DateTimeOffset(2030, 1, 1, 0, 0, 0, TimeSpan.Zero),
+            LeaseRenewAfterSeconds = 15,
+            HostPresenceRefreshAfterSeconds = 10,
+        });
+
+        RendezvousClientResult<IReadOnlyList<HostJoinAttempt>> result =
+            await client.BrowseAllForHostAsync(session);
+
+        Assert.True(result.IsSuccess, result.Message);
+        Assert.Equal([first.AttemptId, second.AttemptId], result.Value!.Select(item => item.AttemptId));
+        Assert.Equal(2, handler.Requests.Count);
+        Assert.All(handler.Requests, request =>
+            Assert.Equal("lease-secret", request.Headers["X-Rendezvous-Lease-Token"]));
+        Assert.Contains("cursor=next%20page%2Bcursor", handler.Requests[1].Uri.Query, StringComparison.Ordinal);
+    }
+
+    private static CreateJoinAttemptResponse CreateAttempt() => new()
+    {
+        AttemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000202")),
+        MediationHandle = new(Guid.Parse("00000000-0000-0000-0000-000000000203")),
+        ClientPunchCapability = Credential('C'),
+        ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+            NatIntroductionTokenCodec.Encode(
+                new JoinAttemptId(Guid.Parse("00000000-0000-0000-0000-000000000202")),
+                Credential('T'))),
+        ExpiresAt = new DateTimeOffset(2030, 1, 1, 0, 0, 30, TimeSpan.Zero),
+    };
+
+    private static HostJoinAttempt CreateHostAttempt(string id) => new()
+    {
+        AttemptId = new(Guid.Parse(id)),
+        MediationHandle = new(Guid.NewGuid()),
+        HostPunchCapability = Credential('H'),
+        ConnectionTicketDigest = NatIntroductionTokenCodec.ComputeDigest(
+            NatIntroductionTokenCodec.Encode(new JoinAttemptId(Guid.Parse(id)), Credential('T'))),
+        ExpiresAt = new DateTimeOffset(2030, 1, 1, 0, 0, 30, TimeSpan.Zero),
+    };
+
+    private static string Credential(char value) => new(value, ContractLimits.DerivedCredentialCharacters);
+
+    private static HttpResponseMessage JsonResponse<T>(HttpStatusCode status, T value) => new(status)
+    {
+        Content = new ByteArrayContent(JsonSerializer.SerializeToUtf8Bytes(value, ContractJson.Options)),
+    };
+
+    private sealed class RecordingHandler(params HttpResponseMessage[] responses) : HttpMessageHandler
+    {
+        private readonly Queue<HttpResponseMessage> _responses = new(responses);
+
+        internal List<RecordedRequest> Requests { get; } = [];
+
+        protected override async Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            Dictionary<string, string> headers = request.Headers.ToDictionary(
+                static item => item.Key,
+                static item => string.Join(",", item.Value),
+                StringComparer.OrdinalIgnoreCase);
+            Requests.Add(new(
+                request.Method,
+                request.RequestUri!,
+                headers,
+                request.Content is null
+                    ? string.Empty
+                    : await request.Content.ReadAsStringAsync(cancellationToken)));
+            return _responses.Dequeue();
+        }
+    }
+
+    private sealed record RecordedRequest(
+        HttpMethod Method,
+        Uri Uri,
+        IReadOnlyDictionary<string, string> Headers,
+        string Body);
+
+    private sealed class ImmediateDelay : IRendezvousDelay
+    {
+        public Task DelayAsync(TimeSpan delay, CancellationToken cancellationToken)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            return Task.CompletedTask;
+        }
+    }
+}

tests/FinalFactory.Rendezvous.Tests/Contracts/NatPunchRequestTokenCodecTests.cs

@@ -0,0 +1,61 @@
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Tests.Contracts;
+
+public sealed class NatPunchRequestTokenCodecTests
+{
+    [Theory]
+    [InlineData(NatPunchPeerRole.HostPresence)]
+    [InlineData(NatPunchPeerRole.Host)]
+    [InlineData(NatPunchPeerRole.Client)]
+    public void FixedSizeTokensRoundTripBelowLiteNetLibLimit(NatPunchPeerRole role)
+    {
+        MediationHandle handle = new(Guid.NewGuid());
+        const string capability = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+        string encoded = NatPunchRequestTokenCodec.Encode(role, handle, capability);
+
+        Assert.Equal(NatPunchRequestTokenCodec.EncodedLength, encoded.Length);
+        Assert.True(encoded.Length <= ContractLimits.LiteNetLibNatTokenMaxCharacters);
+        Assert.True(NatPunchRequestTokenCodec.TryDecode(encoded, out NatPunchRequestToken? decoded));
+        Assert.NotNull(decoded);
+        Assert.Equal(role, decoded.Role);
+        Assert.Equal(handle, decoded.MediationHandle);
+        Assert.Equal(capability, decoded.Capability);
+        Assert.DoesNotContain(capability, decoded.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void MalformedAndNonCanonicalTokensAreRejected()
+    {
+        string valid = NatPunchRequestTokenCodec.Encode(
+            NatPunchPeerRole.Client,
+            new MediationHandle(Guid.Parse("00112233-4455-6677-8899-aabbccddeeff")),
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+        string uppercaseHandle = valid[..6]
+            + valid.Substring(6, 32).ToUpperInvariant()
+            + valid[38..];
+
+        Assert.False(NatPunchRequestTokenCodec.TryDecode(null, out _));
+        Assert.False(NatPunchRequestTokenCodec.TryDecode(valid[..^1], out _));
+        Assert.False(NatPunchRequestTokenCodec.TryDecode("x" + valid[1..], out _));
+        Assert.False(NatPunchRequestTokenCodec.TryDecode(valid[..^1] + "x", out _));
+        Assert.False(NatPunchRequestTokenCodec.TryDecode(uppercaseHandle, out _));
+        Assert.Throws<ArgumentException>(() => NatPunchRequestTokenCodec.Encode(
+            (NatPunchPeerRole)99,
+            new MediationHandle(Guid.NewGuid()),
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));
+    }
+
+    [Fact]
+    public void FixedWireLengthHasADedicatedLiteNetSafeContractLimit()
+    {
+        Assert.Equal(192, ContractLimits.NatPunchRequestTokenCharacters);
+        Assert.Equal(
+            ContractLimits.NatPunchRequestTokenCharacters,
+            NatPunchRequestTokenCodec.EncodedLength);
+        Assert.True(
+            ContractLimits.NatPunchRequestTokenCharacters
+            <= ContractLimits.LiteNetLibNatTokenMaxCharacters);
+    }
+}

tests/FinalFactory.Rendezvous.Tests/Contracts/TraversalTokenCodecTests.cs

@@ -0,0 +1,59 @@
+using FinalFactory.Rendezvous.Client;
+using FinalFactory.Rendezvous.Contracts;
+
+namespace FinalFactory.Rendezvous.Tests.Contracts;
+
+public sealed class TraversalTokenCodecTests
+{
+    [Fact]
+    public void IntroductionTokenBindsAttemptAndRedactsTheFixedTicket()
+    {
+        JoinAttemptId attemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000301"));
+        string authenticator = Credential('T');
+
+        string encoded = NatIntroductionTokenCodec.Encode(attemptId, authenticator);
+
+        Assert.Equal(NatIntroductionTokenCodec.EncodedLength, encoded.Length);
+        Assert.True(encoded.Length <= ContractLimits.LiteNetLibNatTokenMaxCharacters);
+        Assert.True(NatIntroductionTokenCodec.TryDecode(encoded, out NatIntroductionToken? decoded));
+        Assert.NotNull(decoded);
+        Assert.Equal(attemptId, decoded.AttemptId);
+        Assert.Equal(encoded, decoded.ConnectionTicket);
+        Assert.DoesNotContain(encoded, decoded.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void IntroductionTokenRejectsNonCanonicalOrAlteredFields()
+    {
+        string valid = NatIntroductionTokenCodec.Encode(
+            new JoinAttemptId(Guid.Parse("abcdef00-0000-0000-0000-000000000302")),
+            Credential('T'));
+
+        Assert.False(NatIntroductionTokenCodec.TryDecode(null, out _));
+        Assert.False(NatIntroductionTokenCodec.TryDecode(valid[..^1], out _));
+        Assert.False(NatIntroductionTokenCodec.TryDecode(valid[..^1] + "!", out _));
+        Assert.False(NatIntroductionTokenCodec.TryDecode(new string('A', 43), out _));
+    }
+
+    [Fact]
+    public void DirectConnectionRequestRoundTripsFixedBoundedPayloadAndRedactsTicket()
+    {
+        JoinAttemptId attemptId = new(Guid.Parse("00000000-0000-0000-0000-000000000303"));
+        string ticket = Credential('D');
+
+        byte[] encoded = DirectConnectionRequestCodec.Encode(attemptId, ticket);
+
+        Assert.Equal(DirectConnectionRequestCodec.EncodedLength, encoded.Length);
+        Assert.True(DirectConnectionRequestCodec.TryDecode(encoded, out DirectConnectionRequest? decoded));
+        Assert.NotNull(decoded);
+        Assert.Equal(attemptId, decoded.AttemptId);
+        Assert.Equal(ticket, decoded.ConnectionTicket);
+        Assert.DoesNotContain(ticket, decoded.ToString(), StringComparison.Ordinal);
+
+        encoded[0] ^= 0xff;
+        Assert.False(DirectConnectionRequestCodec.TryDecode(encoded, out _));
+        Assert.False(DirectConnectionRequestCodec.TryDecode(encoded.AsSpan(1), out _));
+    }
+
+    private static string Credential(char value) => new(value, ContractLimits.DerivedCredentialCharacters);
+}

tests/FinalFactory.Rendezvous.Tests/JoinAttempts/JoinAttemptHttpEndpointTests.cs

@@ -91,14 +91,16 @@ public sealed class JoinAttemptHttpEndpointTests
         using HttpResponseMessage cancelled = await host.HttpClient.SendAsync(cancelRequest);
         Assert.Equal(HttpStatusCode.NoContent, cancelled.StatusCode);
 
-        using HttpRequestMessage emptyPollRequest = new(
+        using HttpRequestMessage cancelledPollRequest = new(
             HttpMethod.Get,
             $"v1/sessions/{session.ListingId}/join-attempts?contractVersion=1&pageSize=10");
-        emptyPollRequest.Headers.Add("X-Rendezvous-Lease-Token", session.LeaseToken);
-        using HttpResponseMessage emptyPollResponse = await host.HttpClient.SendAsync(emptyPollRequest);
-        BrowseHostJoinAttemptsResponse empty = Assert.IsType<BrowseHostJoinAttemptsResponse>(
-            await emptyPollResponse.Content.ReadFromJsonAsync<BrowseHostJoinAttemptsResponse>(ContractJson.Options));
-        Assert.Empty(empty.Items);
+        cancelledPollRequest.Headers.Add("X-Rendezvous-Lease-Token", session.LeaseToken);
+        using HttpResponseMessage cancelledPollResponse = await host.HttpClient.SendAsync(cancelledPollRequest);
+        BrowseHostJoinAttemptsResponse cancelledPoll = Assert.IsType<BrowseHostJoinAttemptsResponse>(
+            await cancelledPollResponse.Content.ReadFromJsonAsync<BrowseHostJoinAttemptsResponse>(ContractJson.Options));
+        HostJoinAttempt cancelledAttempt = Assert.Single(cancelledPoll.Items);
+        Assert.Equal(created.AttemptId, cancelledAttempt.AttemptId);
+        Assert.True(cancelledAttempt.IsCancelled);
     }
 
     private static T AssertSuccess<T>(RendezvousClientResult<T> result)

tests/FinalFactory.Rendezvous.Tests/JoinAttempts/JoinAttemptServiceTests.cs

@@ -152,12 +152,47 @@ public sealed class JoinAttemptServiceTests
         Assert.True(fixture.Service.Cancel(
             created.AttemptId,
             created.ClientPunchCapability).Succeeded);
-        Assert.Empty(fixture.Service.BrowseForHost(
+        Assert.True(fixture.Service.Cancel(
+            created.AttemptId,
+            created.ClientPunchCapability).Succeeded);
+        HostJoinAttempt cancelled = Assert.Single(fixture.Service.BrowseForHost(
             registration.ListingId,
             ContractLimits.ContractVersion,
             registration.LeaseToken,
             10,
             null).Value!.Items);
+        Assert.Equal(created.AttemptId, cancelled.AttemptId);
+        Assert.True(cancelled.IsCancelled);
+    }
+
+    [Fact]
+    public void CancellationAfterIntroductionRevokesTicketIssuanceAndConsumption()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId);
+        IntroductionEndpoints introduction = fixture.Introduce(registration, created);
+        JoinAttemptServiceResult<ConnectionTicketGrant> issued =
+            fixture.Service.IssueConnectionTicket(introduction.Attempt);
+        Assert.True(issued.Succeeded);
+        Assert.True(fixture.Sessions.Capabilities.TryFingerprint(
+            issued.Value!.Ticket,
+            out SecretFingerprint ticketFingerprint));
+
+        Assert.True(fixture.Service.Cancel(
+            created.AttemptId,
+            created.ClientPunchCapability).Succeeded);
+
+        StoredJoinAttempt cancelled = fixture.GetAttempt(registration, created.AttemptId);
+        Assert.True(cancelled.IsCancelled);
+        Assert.Equal(
+            RendezvousErrorCode.Conflict,
+            fixture.Service.IssueConnectionTicket(cancelled).Error);
+        Assert.Equal(
+            StoreResultCode.Conflict,
+            fixture.Sessions.Store.ConsumeConnectionTicket(new(
+                created.AttemptId,
+                ticketFingerprint)).Code);
     }
 
     [Fact]

tests/FinalFactory.Rendezvous.Tests/Server/NatMediationProcessorTests.cs

@@ -0,0 +1,416 @@
+using System.Collections.Concurrent;
+using System.Net;
+using FinalFactory.Rendezvous.Contracts;
+using FinalFactory.Rendezvous.Server.JoinAttempts;
+using FinalFactory.Rendezvous.Server.State;
+using FinalFactory.Rendezvous.Server.Transport;
+using FinalFactory.Rendezvous.Tests.JoinAttempts;
+
+namespace FinalFactory.Rendezvous.Tests.Server;
+
+public sealed class NatMediationProcessorTests
+{
+    [Fact]
+    public void AuthenticatedHostPresenceUsesTheObservedGameplaySocket()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost(bindPresence: false);
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+        string token = NatPunchRequestTokenCodec.Encode(
+            NatPunchPeerRole.HostPresence,
+            registration.HostPresenceHandle,
+            registration.HostPresenceCapability);
+
+        Assert.Equal(
+            NatMediationResult.HostPresenceAccepted,
+            processor.ProcessRequest(
+                Endpoint("192.168.1.50", 40_000),
+                Endpoint("203.0.113.77", 51_234),
+                token,
+                sink));
+        Assert.Equal(registration.ListingId, Assert.Single(fixture.Sessions.Browse()).Definition.ListingId);
+        Assert.Empty(sink.Plans);
+    }
+
+    [Fact]
+    public void MatchedPeersReceiveOneIntroductionAndSameNatPrivateCandidates()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "same-nat");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        Assert.Equal(
+            NatMediationResult.WaitingForPeer,
+            Process(processor, sink, attempt, NatPunchPeerRole.Host,
+                Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000)));
+        Assert.Equal(
+            NatMediationResult.Introduced,
+            Process(processor, sink, attempt, NatPunchPeerRole.Client,
+                Endpoint("192.168.1.11", 42_000), Endpoint("203.0.113.20", 52_000)));
+
+        NatIntroductionPlan plan = Assert.Single(sink.Plans);
+        Assert.Equal(Endpoint("192.168.1.10", 41_000), plan.HostLocal);
+        Assert.Equal(Endpoint("192.168.1.11", 42_000), plan.ClientLocal);
+        Assert.Equal(Endpoint("203.0.113.20", 51_000), plan.HostPublic);
+        Assert.Equal(Endpoint("203.0.113.20", 52_000), plan.ClientPublic);
+        Assert.True(NatIntroductionTokenCodec.TryDecode(
+            plan.IntroductionToken,
+            out NatIntroductionToken? introduction));
+        Assert.NotNull(introduction);
+        Assert.Equal(attempt.AttemptId, introduction.AttemptId);
+        Assert.Equal(43, introduction.ConnectionTicket.Length);
+        Assert.DoesNotContain(introduction.ConnectionTicket, plan.ToString(), StringComparison.Ordinal);
+
+        Assert.True(fixture.Sessions.Capabilities.TryFingerprint(
+            introduction.ConnectionTicket,
+            out SecretFingerprint ticketFingerprint));
+        Assert.True(fixture.Sessions.Store.ConsumeConnectionTicket(new(
+            attempt.AttemptId,
+            ticketFingerprint)).Succeeded);
+
+        Assert.Equal(
+            NatMediationResult.Duplicate,
+            Process(processor, sink, attempt, NatPunchPeerRole.Client,
+                Endpoint("192.168.1.11", 42_000), Endpoint("203.0.113.20", 52_000)));
+        Assert.Single(sink.Plans);
+    }
+
+    [Fact]
+    public void DifferentNatsAndInvalidLocalClaimsExposeOnlyObservedPublicEndpoints()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "different-nats");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        _ = Process(processor, sink, attempt, NatPunchPeerRole.Client,
+            Endpoint("8.8.8.8", 42_000), Endpoint("198.51.100.40", 52_000));
+        Assert.Equal(
+            NatMediationResult.Introduced,
+            Process(processor, sink, attempt, NatPunchPeerRole.Host,
+                Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000)));
+
+        NatIntroductionPlan plan = Assert.Single(sink.Plans);
+        Assert.Equal(plan.HostPublic, plan.HostLocal);
+        Assert.Equal(plan.ClientPublic, plan.ClientLocal);
+        Assert.NotEqual(IPAddress.Parse("8.8.8.8"), plan.ClientLocal.Address);
+    }
+
+    [Fact]
+    public void RoleAndEndpointSubstitutionAreRejectedWithoutChangingTheFirstBinding()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "substitution");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        string crossRole = NatPunchRequestTokenCodec.Encode(
+            NatPunchPeerRole.Host,
+            attempt.Handle,
+            attempt.ClientCapability);
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            processor.ProcessRequest(
+                Endpoint("192.168.1.10", 41_000),
+                Endpoint("203.0.113.20", 51_000),
+                crossRole,
+                sink));
+
+        Assert.Equal(
+            NatMediationResult.WaitingForPeer,
+            Process(processor, sink, attempt, NatPunchPeerRole.Host,
+                Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000)));
+        Assert.Equal(
+            NatMediationResult.Rejected,
+            Process(processor, sink, attempt, NatPunchPeerRole.Host,
+                Endpoint("192.168.1.99", 41_999), Endpoint("203.0.113.99", 51_999)));
+        Assert.Equal(
+            NatMediationResult.Introduced,
+            Process(processor, sink, attempt, NatPunchPeerRole.Client,
+                Endpoint("192.168.2.10", 42_000), Endpoint("198.51.100.40", 52_000)));
+
+        Assert.Equal(Endpoint("203.0.113.20", 51_000), Assert.Single(sink.Plans).HostPublic);
+    }
+
+    [Fact]
+    public void ConcurrentAttemptsForOneSessionNeverCrossWire()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials first = CreateAttempt(fixture, registration, "parallel-1");
+        AttemptCredentials second = CreateAttempt(fixture, registration, "parallel-2");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        _ = Process(processor, sink, first, NatPunchPeerRole.Host,
+            Endpoint("10.0.0.10", 41_001), Endpoint("203.0.113.10", 51_001));
+        _ = Process(processor, sink, second, NatPunchPeerRole.Host,
+            Endpoint("10.0.0.20", 41_002), Endpoint("203.0.113.20", 51_002));
+        _ = Process(processor, sink, second, NatPunchPeerRole.Client,
+            Endpoint("10.0.0.21", 42_002), Endpoint("198.51.100.20", 52_002));
+        _ = Process(processor, sink, first, NatPunchPeerRole.Client,
+            Endpoint("10.0.0.11", 42_001), Endpoint("198.51.100.10", 52_001));
+
+        Assert.Equal(2, sink.Plans.Count);
+        Assert.Contains(sink.Plans, plan =>
+            plan.HostPublic.Equals(Endpoint("203.0.113.10", 51_001))
+            && plan.ClientPublic.Equals(Endpoint("198.51.100.10", 52_001)));
+        Assert.Contains(sink.Plans, plan =>
+            plan.HostPublic.Equals(Endpoint("203.0.113.20", 51_002))
+            && plan.ClientPublic.Equals(Endpoint("198.51.100.20", 52_002)));
+    }
+
+    [Fact]
+    public async Task ConcurrentDuplicateCompletionEmitsExactlyOneIntroduction()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "completion-race");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        ConcurrentIntroductionSink sink = new();
+        _ = Process(processor, sink, attempt, NatPunchPeerRole.Host,
+            Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000));
+        using Barrier barrier = new(2);
+
+        Task<NatMediationResult>[] completions = Enumerable.Range(0, 2)
+            .Select(_ => Task.Run(() =>
+            {
+                barrier.SignalAndWait();
+                return Process(processor, sink, attempt, NatPunchPeerRole.Client,
+                    Endpoint("192.168.1.11", 42_000), Endpoint("198.51.100.40", 52_000));
+            }))
+            .ToArray();
+        NatMediationResult[] results = await Task.WhenAll(completions);
+
+        Assert.Single(results, result => result == NatMediationResult.Introduced);
+        Assert.Single(sink.Plans);
+    }
+
+    [Fact]
+    public async Task CancellationAfterIntroductionCreatesAHostRevocationTombstone()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "cancel-race");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        using BlockingIntroductionSink sink = new();
+        _ = Process(processor, sink, attempt, NatPunchPeerRole.Host,
+            Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000));
+        Task<NatMediationResult> completion = Task.Run(() => Process(
+            processor,
+            sink,
+            attempt,
+            NatPunchPeerRole.Client,
+            Endpoint("192.168.1.11", 42_000),
+            Endpoint("198.51.100.40", 52_000)));
+        Assert.True(sink.WaitUntilEntered(TimeSpan.FromSeconds(2)));
+
+        JoinAttemptServiceResult<bool> cancelled = fixture.Service.Cancel(
+            attempt.AttemptId,
+            attempt.ClientCapability);
+
+        Assert.True(cancelled.Succeeded);
+        sink.Release();
+        Assert.Equal(NatMediationResult.Introduced, await completion);
+        HostJoinAttempt cancelledAttempt = Assert.Single(fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items);
+        Assert.True(cancelledAttempt.IsCancelled);
+    }
+
+    [Fact]
+    public void DuplicateFloodAmortizesGlobalExpiryMaintenance()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials attempt = CreateAttempt(fixture, registration, "maintenance-budget");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+        long before = fixture.Sessions.Store.MaintenanceSweepCount;
+
+        for (int index = 0; index < 256; index++)
+        {
+            Assert.Equal(
+                NatMediationResult.WaitingForPeer,
+                Process(processor, sink, attempt, NatPunchPeerRole.Host,
+                    Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000)));
+        }
+
+        Assert.InRange(fixture.Sessions.Store.MaintenanceSweepCount - before, 0, 1);
+        Assert.Empty(sink.Plans);
+    }
+
+    [Fact]
+    public void MissingStaleCancelledAndMalformedRequestsNeverIntroduce()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials stale = CreateAttempt(fixture, registration, "stale");
+        AttemptCredentials cancelled = CreateAttempt(fixture, registration, "cancelled");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        Assert.Equal(
+            NatMediationResult.WaitingForPeer,
+            Process(processor, sink, stale, NatPunchPeerRole.Client,
+                Endpoint("192.168.1.11", 42_000), Endpoint("198.51.100.40", 52_000)));
+        Assert.True(fixture.Service.Cancel(cancelled.AttemptId, cancelled.ClientCapability).Succeeded);
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            Process(processor, sink, cancelled, NatPunchPeerRole.Client,
+                Endpoint("192.168.1.12", 42_001), Endpoint("198.51.100.41", 52_001)));
+
+        fixture.Sessions.Clock.Advance(TimeSpan.FromSeconds(21));
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            Process(processor, sink, stale, NatPunchPeerRole.Host,
+                Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000)));
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            processor.ProcessRequest(
+                Endpoint("192.168.1.10", 41_000),
+                Endpoint("203.0.113.20", 51_000),
+                "malformed",
+                sink));
+        Assert.Empty(sink.Plans);
+    }
+
+    [Fact]
+    public void AddressFamiliesMustMatchAndOnlyGlobalIpv6SourcesAreAccepted()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        AttemptCredentials mismatch = CreateAttempt(fixture, registration, "family-mismatch");
+        AttemptCredentials ipv6 = CreateAttempt(fixture, registration, "ipv6");
+        NatMediationProcessor processor = CreateProcessor(fixture);
+        CaptureIntroductionSink sink = new();
+
+        byte[] shortFrozenIpv6 = RendezvousUdpCodec.Encode(new PresenceDatagram
+        {
+            MessageType = UdpPresenceMessageType.ClientPresence,
+            MediationHandle = ipv6.Handle,
+            AddressFamily = AddressFamilyKind.Ipv6,
+            LocalAddress = "fd00::11",
+            LocalPort = 42_000,
+            Capability = ipv6.ClientCapability,
+        });
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            processor.ProcessDatagram(
+                shortFrozenIpv6,
+                Endpoint("2606:4700:4700::1001", 52_000),
+                sink));
+
+        _ = Process(processor, sink, mismatch, NatPunchPeerRole.Host,
+            Endpoint("192.168.1.10", 41_000), Endpoint("203.0.113.20", 51_000));
+        Assert.Equal(
+            NatMediationResult.Rejected,
+            Process(processor, sink, mismatch, NatPunchPeerRole.Client,
+                Endpoint("fd00::11", 42_000), Endpoint("2606:4700:4700::1111", 52_000)));
+
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            Process(processor, sink, ipv6, NatPunchPeerRole.Host,
+                Endpoint("fd00::10", 41_000), Endpoint("2001:db8::10", 51_000)));
+        _ = Process(processor, sink, ipv6, NatPunchPeerRole.Host,
+            Endpoint("fd00::10", 41_000), Endpoint("2606:4700:4700::1000", 51_000));
+        Assert.Equal(
+            NatMediationResult.Introduced,
+            Process(processor, sink, ipv6, NatPunchPeerRole.Client,
+                Endpoint("fd00::11", 42_000), Endpoint("2606:4700:4700::1001", 52_000)));
+        Assert.Single(sink.Plans);
+    }
+
+    private static NatMediationProcessor CreateProcessor(JoinAttemptFixture fixture) => new(
+        fixture.Sessions.Store,
+        fixture.Sessions.Capabilities,
+        fixture.Service);
+
+    private static AttemptCredentials CreateAttempt(
+        JoinAttemptFixture fixture,
+        RegisterSessionResponse registration,
+        string idempotencyKey)
+    {
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId, idempotencyKey);
+        HostJoinAttempt host = fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items.Single(item => item.AttemptId == created.AttemptId);
+        return new(
+            created.AttemptId,
+            created.MediationHandle,
+            host.HostPunchCapability,
+            created.ClientPunchCapability);
+    }
+
+    private static NatMediationResult Process(
+        NatMediationProcessor processor,
+        INatIntroductionSink sink,
+        AttemptCredentials attempt,
+        NatPunchPeerRole role,
+        IPEndPoint local,
+        IPEndPoint observed) => processor.ProcessRequest(
+            local,
+            observed,
+            NatPunchRequestTokenCodec.Encode(
+                role,
+                attempt.Handle,
+                role == NatPunchPeerRole.Client
+                    ? attempt.ClientCapability
+                    : attempt.HostCapability),
+            sink);
+
+    private static IPEndPoint Endpoint(string address, int port) =>
+        new(IPAddress.Parse(address), port);
+
+    private sealed record AttemptCredentials(
+        JoinAttemptId AttemptId,
+        MediationHandle Handle,
+        string HostCapability,
+        string ClientCapability);
+
+    private sealed class CaptureIntroductionSink : INatIntroductionSink
+    {
+        public List<NatIntroductionPlan> Plans { get; } = [];
+
+        public void Introduce(NatIntroductionPlan plan) => Plans.Add(plan);
+    }
+
+    private sealed class ConcurrentIntroductionSink : INatIntroductionSink
+    {
+        public ConcurrentBag<NatIntroductionPlan> Plans { get; } = [];
+
+        public void Introduce(NatIntroductionPlan plan) => Plans.Add(plan);
+    }
+
+    private sealed class BlockingIntroductionSink : INatIntroductionSink, IDisposable
+    {
+        private readonly ManualResetEventSlim _entered = new();
+        private readonly ManualResetEventSlim _release = new();
+
+        public void Introduce(NatIntroductionPlan plan)
+        {
+            _entered.Set();
+            _release.Wait(TimeSpan.FromSeconds(2));
+        }
+
+        public bool WaitUntilEntered(TimeSpan timeout) => _entered.Wait(timeout);
+        public void Release() => _release.Set();
+
+        public void Dispose()
+        {
+            _entered.Dispose();
+            _release.Dispose();
+        }
+    }
+}

tests/FinalFactory.Rendezvous.Tests/Server/UdpMediatorServiceTests.cs

@@ -1,10 +1,9 @@
 using System.Net;
+using System.Net.Sockets;
 using FinalFactory.Rendezvous.Contracts;
-using FinalFactory.Rendezvous.Server.Sessions;
-using FinalFactory.Rendezvous.Server.State;
 using FinalFactory.Rendezvous.Server.Transport;
-using FinalFactory.Rendezvous.Tests.Sessions;
-using FinalFactory.Rendezvous.Tests.State;
+using FinalFactory.Rendezvous.Tests.JoinAttempts;
+using LiteNetLib;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
 
@@ -13,55 +12,24 @@ namespace FinalFactory.Rendezvous.Tests.Server;
 public sealed class UdpMediatorServiceTests
 {
     [Fact]
-    public void AuthenticatedHostDatagramGatesVisibilityUsingObservedGameplaySocket()
-    {
-        using SessionLeaseFixture fixture = new();
-        RegisterSessionResponse registration = fixture.Register();
-        using UdpMediatorService service = new(
-            Options.Create(new UdpMediatorOptions { ListenAddress = "127.0.0.1", Port = 0 }),
-            NullLogger<UdpMediatorService>.Instance,
-            fixture.Store,
-            fixture.Capabilities);
-        PresenceDatagram presence = new()
-        {
-            MessageType = UdpPresenceMessageType.HostPresence,
-            MediationHandle = registration.HostPresenceHandle,
-            AddressFamily = AddressFamilyKind.Ipv4,
-            LocalAddress = "192.168.1.50",
-            LocalPort = 40_000,
-            Capability = registration.HostPresenceCapability,
-        };
-        IPEndPoint observedGameplaySocket = new(IPAddress.Parse("203.0.113.77"), 51_234);
-        presence.Capability = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        Assert.Equal(
-            UdpPresenceProcessingResult.HostPresenceRejected,
-            service.ProcessDatagram(RendezvousUdpCodec.Encode(presence), observedGameplaySocket));
-        Assert.Empty(fixture.Browse());
-
-        presence.Capability = registration.HostPresenceCapability;
-        Assert.Equal(
-            UdpPresenceProcessingResult.HostPresenceAccepted,
-            service.ProcessDatagram(RendezvousUdpCodec.Encode(presence), observedGameplaySocket));
-        Assert.Equal(registration.ListingId, Assert.Single(fixture.Browse()).Definition.ListingId);
-    }
-
-    [Fact]
-    public async Task ServiceBindsAnEphemeralUdpPortAndStopsCleanly()
+    public async Task ServiceBindsAnEphemeralLiteNetLibPortAndStopsCleanly()
     {
         using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
-        UdpMediatorOptions options = new()
-        {
-            ListenAddress = IPAddress.Loopback.ToString(),
-            Port = 0,
-        };
-        ManualRendezvousClock clock = new();
-        InMemoryEphemeralRendezvousStore store = new(new EphemeralStoreOptions(), clock, clock);
-        using EphemeralCapabilityIssuer capabilities = new();
+        using JoinAttemptFixture fixture = new();
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
         using UdpMediatorService service = new(
-            Options.Create(options),
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                MaxDatagramsPerPoll = 8,
+                PollIntervalMilliseconds = 1,
+            }),
             NullLogger<UdpMediatorService>.Instance,
-            store,
-            capabilities);
+            processor);
 
         await service.StartAsync(timeout.Token);
 
@@ -69,9 +37,307 @@ public sealed class UdpMediatorServiceTests
         Assert.NotNull(boundEndpoint);
         Assert.Equal(IPAddress.Loopback, boundEndpoint.Address);
         Assert.InRange(boundEndpoint.Port, 1, 65_535);
+        Assert.Null(service.LocalIpv6Endpoint);
 
         await service.StopAsync(timeout.Token);
 
         Assert.Null(service.LocalEndpoint);
     }
+
+    [Fact]
+    public async Task OptionalIpv6BindingNeverWidensTheRequiredIpv4Binding()
+    {
+        if (!Socket.OSSupportsIPv6)
+        {
+            return;
+        }
+
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+        using JoinAttemptFixture fixture = new();
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService service = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Ipv6ListenAddress = IPAddress.IPv6Loopback.ToString(),
+                Port = 0,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+
+        await service.StartAsync(timeout.Token);
+
+        Assert.Equal(IPAddress.Loopback, service.LocalEndpoint!.Address);
+        Assert.Equal(IPAddress.IPv6Loopback, service.LocalIpv6Endpoint!.Address);
+        Assert.Equal(service.LocalEndpoint.Port, service.LocalIpv6Endpoint.Port);
+        IPAddress? otherIpv4 = Dns.GetHostAddresses(Dns.GetHostName())
+            .FirstOrDefault(address =>
+                address.AddressFamily == AddressFamily.InterNetwork
+                && !IPAddress.IsLoopback(address));
+        if (otherIpv4 is not null)
+        {
+            using UdpClient scopeProbe = new(new IPEndPoint(otherIpv4, service.LocalEndpoint.Port));
+            Assert.Equal(otherIpv4, ((IPEndPoint)scopeProbe.Client.LocalEndPoint!).Address);
+        }
+
+        await service.StopAsync(timeout.Token);
+    }
+
+    [Fact]
+    public async Task NativeLiteNetLibRequestsIntroduceTheAuthorizedPair()
+    {
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId, "native-litenet");
+        HostJoinAttempt hostAttempt = fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items.Single(item => item.AttemptId == created.AttemptId);
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService service = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                MaxDatagramsPerPoll = 8,
+                PollIntervalMilliseconds = 1,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+        await service.StartAsync(timeout.Token);
+
+        EventBasedNetListener hostListener = new();
+        EventBasedNetListener clientListener = new();
+        NetManager host = new(hostListener) { NatPunchEnabled = true };
+        NetManager client = new(clientListener) { NatPunchEnabled = true };
+        EventBasedNatPunchListener hostPunch = new();
+        EventBasedNatPunchListener clientPunch = new();
+        List<string> hostTickets = [];
+        List<string> clientTickets = [];
+        hostPunch.NatIntroductionSuccess += (_, _, ticket) => hostTickets.Add(ticket);
+        clientPunch.NatIntroductionSuccess += (_, _, ticket) => clientTickets.Add(ticket);
+        host.NatPunchModule.Init(hostPunch);
+        client.NatPunchModule.Init(clientPunch);
+
+        try
+        {
+            Assert.True(host.Start(0));
+            Assert.True(client.Start(0));
+            IPEndPoint mediator = Assert.IsType<IPEndPoint>(service.LocalEndpoint);
+            host.NatPunchModule.SendNatIntroduceRequest(
+                mediator,
+                NatPunchRequestTokenCodec.Encode(
+                    NatPunchPeerRole.Host,
+                    created.MediationHandle,
+                    hostAttempt.HostPunchCapability));
+            client.NatPunchModule.SendNatIntroduceRequest(
+                mediator,
+                NatPunchRequestTokenCodec.Encode(
+                    NatPunchPeerRole.Client,
+                    created.MediationHandle,
+                    created.ClientPunchCapability));
+
+            while ((hostTickets.Count == 0 || clientTickets.Count == 0)
+                   && !timeout.IsCancellationRequested)
+            {
+                host.PollEvents();
+                host.NatPunchModule.PollEvents();
+                client.PollEvents();
+                client.NatPunchModule.PollEvents();
+                await Task.Delay(5, timeout.Token);
+            }
+
+            string hostTicket = Assert.Single(hostTickets.Distinct(StringComparer.Ordinal));
+            string clientTicket = Assert.Single(clientTickets.Distinct(StringComparer.Ordinal));
+            Assert.Equal(hostTicket, clientTicket);
+            Assert.True(NatIntroductionTokenCodec.TryDecode(
+                hostTicket,
+                out NatIntroductionToken? introduction));
+            Assert.NotNull(introduction);
+            Assert.Equal(created.AttemptId, introduction.AttemptId);
+            Assert.Equal(43, introduction.ConnectionTicket.Length);
+        }
+        finally
+        {
+            host.Stop();
+            client.Stop();
+            await service.StopAsync(CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public async Task FrozenV1EnvelopeIsConsumedOnTheLiteNetSocketWithinAmplificationBudget()
+    {
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost();
+        CreateJoinAttemptResponse created = fixture.Create(registration.ListingId, "v1-envelope");
+        HostJoinAttempt hostAttempt = fixture.Service.BrowseForHost(
+            registration.ListingId,
+            ContractLimits.ContractVersion,
+            registration.LeaseToken,
+            ContractLimits.BrowserPageMaxItems,
+            null).Value!.Items.Single(item => item.AttemptId == created.AttemptId);
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService service = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                MaxDatagramsPerPoll = 8,
+                PollIntervalMilliseconds = 1,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+        await service.StartAsync(timeout.Token);
+        using UdpClient host = new(new IPEndPoint(IPAddress.Loopback, 0));
+        using UdpClient client = new(new IPEndPoint(IPAddress.Loopback, 0));
+        IPEndPoint mediator = Assert.IsType<IPEndPoint>(service.LocalEndpoint);
+        byte[] hostDatagram = RendezvousUdpCodec.Encode(new PresenceDatagram
+        {
+            MessageType = UdpPresenceMessageType.HostPresence,
+            MediationHandle = created.MediationHandle,
+            AddressFamily = AddressFamilyKind.Ipv4,
+            LocalAddress = "192.168.1.10",
+            LocalPort = 41_000,
+            Capability = hostAttempt.HostPunchCapability,
+        });
+        byte[] clientDatagram = RendezvousUdpCodec.Encode(new PresenceDatagram
+        {
+            MessageType = UdpPresenceMessageType.ClientPresence,
+            MediationHandle = created.MediationHandle,
+            AddressFamily = AddressFamilyKind.Ipv4,
+            LocalAddress = "192.168.1.11",
+            LocalPort = 42_000,
+            Capability = created.ClientPunchCapability,
+        });
+
+        try
+        {
+            await host.SendAsync(hostDatagram, mediator, timeout.Token);
+            await client.SendAsync(clientDatagram, mediator, timeout.Token);
+            UdpReceiveResult hostIntroduction = await host.ReceiveAsync(timeout.Token);
+            UdpReceiveResult clientIntroduction = await client.ReceiveAsync(timeout.Token);
+
+            Assert.True(
+                hostIntroduction.Buffer.Length + clientIntroduction.Buffer.Length
+                <= clientDatagram.Length * 2,
+                $"The completing authenticated contribution exceeded the 2.0 response-byte budget: "
+                + $"responses={hostIntroduction.Buffer.Length + clientIntroduction.Buffer.Length}, "
+                + $"request={clientDatagram.Length}.");
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public async Task OversizedMalformedAndGameplayDatagramsReceiveNoResponse()
+    {
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+        using JoinAttemptFixture fixture = new();
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService service = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                MaxDatagramsPerPoll = 8,
+                PollIntervalMilliseconds = 1,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+        await service.StartAsync(timeout.Token);
+        using UdpClient sender = new(new IPEndPoint(IPAddress.Loopback, 0));
+        IPEndPoint mediator = Assert.IsType<IPEndPoint>(service.LocalEndpoint);
+        byte[] oversized = new byte[ContractLimits.UdpDatagramMaxBytes + 1];
+        oversized[0] = RendezvousUdpCodec.MagicFirst;
+        oversized[1] = RendezvousUdpCodec.MagicSecond;
+        byte[] gameplayPayload = [0x01, 0x02, 0x03, 0x04];
+        byte[] malformedNative = [17, 0];
+
+        try
+        {
+            await sender.SendAsync(oversized, mediator, timeout.Token);
+            await sender.SendAsync(gameplayPayload, mediator, timeout.Token);
+            await sender.SendAsync(malformedNative, mediator, timeout.Token);
+            using CancellationTokenSource noResponse = new(TimeSpan.FromMilliseconds(150));
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+                await sender.ReceiveAsync(noResponse.Token));
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+    }
+
+    [Fact]
+    public async Task ForgedNativeIntroductionResponseCannotReflectToPayloadEndpoint()
+    {
+        using CancellationTokenSource timeout = new(TimeSpan.FromSeconds(5));
+        using JoinAttemptFixture fixture = new();
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service);
+        using UdpMediatorService service = new(
+            Options.Create(new UdpMediatorOptions
+            {
+                ListenAddress = IPAddress.Loopback.ToString(),
+                Port = 0,
+                MaxDatagramsPerPoll = 8,
+                PollIntervalMilliseconds = 1,
+            }),
+            NullLogger<UdpMediatorService>.Instance,
+            processor);
+        await service.StartAsync(timeout.Token);
+        using UdpClient reflectedTarget = new(new IPEndPoint(IPAddress.Loopback, 0));
+        using UdpClient responseCapture = new(new IPEndPoint(IPAddress.Loopback, 0));
+        using UdpClient attacker = new(new IPEndPoint(IPAddress.Loopback, 0));
+        LiteNetManager generator = new(new EventBasedLiteNetListener()) { NatPunchEnabled = true };
+
+        try
+        {
+            Assert.True(generator.Start(0));
+            IPEndPoint target = (IPEndPoint)reflectedTarget.Client.LocalEndPoint!;
+            IPEndPoint capture = (IPEndPoint)responseCapture.Client.LocalEndPoint!;
+            generator.NatPunchModule.NatIntroduce(
+                target,
+                new IPEndPoint(IPAddress.Loopback, 9),
+                capture,
+                capture,
+                "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+            byte[] forgedResponse = (await responseCapture.ReceiveAsync(timeout.Token)).Buffer;
+
+            await attacker.SendAsync(
+                forgedResponse,
+                Assert.IsType<IPEndPoint>(service.LocalEndpoint),
+                timeout.Token);
+
+            using CancellationTokenSource noReflection = new(TimeSpan.FromMilliseconds(150));
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(async () =>
+                await reflectedTarget.ReceiveAsync(noReflection.Token));
+        }
+        finally
+        {
+            generator.Stop();
+            await service.StopAsync(CancellationToken.None);
+        }
+    }
 }

tests/FinalFactory.Rendezvous.Tests/TestData/Contracts/v1/client-public-api.txt

@@ -12,8 +12,23 @@ TYPE FinalFactory.Rendezvous.Client.ConnectionTicketValidator
   METHOD System.Boolean Revoke(FinalFactory.Rendezvous.Contracts.JoinAttemptId attemptId)
   METHOD System.String ToString()
   METHOD System.Boolean TryAuthorize(FinalFactory.Rendezvous.Contracts.JoinAttemptId attemptId, System.String connectionTicket, System.DateTimeOffset expiresAt)
+TYPE FinalFactory.Rendezvous.Client.DirectConnectionRequest
+  CTOR ()
+  PROP FinalFactory.Rendezvous.Contracts.JoinAttemptId AttemptId {get;set;}
+  PROP System.String ConnectionTicket {get;set;}
+  METHOD System.String ToString()
+TYPE FinalFactory.Rendezvous.Client.DirectConnectionRequestCodec
+  FIELD System.Int32 EncodedLength=63
+  METHOD System.Byte[] Encode(FinalFactory.Rendezvous.Contracts.JoinAttemptId attemptId, System.String connectionTicket)
+  METHOD System.Boolean IsRendezvousRequest(System.ReadOnlySpan<System.Byte> encoded)
+  METHOD System.Boolean TryDecode(System.ReadOnlySpan<System.Byte> encoded, FinalFactory.Rendezvous.Client.DirectConnectionRequest& request)
 TYPE FinalFactory.Rendezvous.Client.IRendezvousDelay
   METHOD System.Threading.Tasks.Task DelayAsync(System.TimeSpan delay, System.Threading.CancellationToken cancellationToken)
+TYPE FinalFactory.Rendezvous.Client.IRendezvousJoinClient
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Collections.Generic.IReadOnlyList<FinalFactory.Rendezvous.Contracts.HostJoinAttempt>>> BrowseAllForHostAsync(FinalFactory.Rendezvous.Client.PublishedSession session, System.Int32 maximumPages, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<FinalFactory.Rendezvous.Contracts.BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(FinalFactory.Rendezvous.Client.PublishedSession session, System.Int32 pageSize, System.String cursor, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Boolean>> CancelAsync(FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse attempt, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse>> CreateAsync(FinalFactory.Rendezvous.Contracts.CreateJoinAttemptRequest request, System.Threading.CancellationToken cancellationToken)
 TYPE FinalFactory.Rendezvous.Client.IRendezvousPublisherClient
   METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Boolean>> DeregisterAsync(FinalFactory.Rendezvous.Client.PublishedSession session, System.String publisherCredential, System.Threading.CancellationToken cancellationToken)
   METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<FinalFactory.Rendezvous.Client.PublishedSession>> RegisterAsync(FinalFactory.Rendezvous.Contracts.RegisterSessionRequest request, System.String publisherCredential, System.Threading.CancellationToken cancellationToken)
@@ -41,6 +56,17 @@ TYPE FinalFactory.Rendezvous.Client.PublishedSession
   PROP System.String LeaseToken {get;}
   PROP FinalFactory.Rendezvous.Contracts.SessionListingId ListingId {get;}
   METHOD System.String ToString()
+TYPE FinalFactory.Rendezvous.Client.RendezvousClientCoordinator
+  CTOR (LiteNetLib.NetManager manager, FinalFactory.Rendezvous.Client.RendezvousNetListener networkEvents, System.Net.IPEndPoint mediator, FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse attempt, FinalFactory.Rendezvous.Client.RendezvousCoordinatorOptions options)
+  PROP LiteNetLib.NetPeer ConnectedPeer {get;}
+  PROP System.Boolean IsCompleted {get;}
+  PROP FinalFactory.Rendezvous.Client.RendezvousConnectionState State {get;}
+  EVENT System.EventHandler<FinalFactory.Rendezvous.Client.RendezvousConnectionCompletedEventArgs> Completed
+  METHOD System.Void Cancel()
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Boolean>> CancelAsync(FinalFactory.Rendezvous.Client.IRendezvousJoinClient joinClient, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Void Dispose()
+  METHOD System.Void Poll()
+  METHOD System.String ToString()
 TYPE FinalFactory.Rendezvous.Client.RendezvousClientOptions
   CTOR ()
   PROP System.TimeSpan InitialRetryDelay {get;set;}
@@ -56,6 +82,66 @@ TYPE FinalFactory.Rendezvous.Client.RendezvousClientResult<T>
   PROP System.String Message {get;}
   PROP System.Nullable<System.Int32> RetryAfterSeconds {get;}
   PROP T Value {get;}
+TYPE FinalFactory.Rendezvous.Client.RendezvousConnectionCompletedEventArgs
+  CTOR (FinalFactory.Rendezvous.Client.RendezvousConnectionState state, LiteNetLib.NetPeer peer)
+  PROP LiteNetLib.NetPeer Peer {get;}
+  PROP FinalFactory.Rendezvous.Client.RendezvousConnectionState State {get;}
+TYPE FinalFactory.Rendezvous.Client.RendezvousConnectionState
+  ENUM Punching=1
+  ENUM Connecting=2
+  ENUM Connected=3
+  ENUM Cancelled=4
+  ENUM TimedOut=5
+  ENUM Rejected=6
+  ENUM ManagerStopped=7
+  ENUM Disposed=8
+TYPE FinalFactory.Rendezvous.Client.RendezvousCoordinatorOptions
+  CTOR ()
+  PROP System.TimeSpan ConnectionTicketLifetime {get;set;}
+  PROP System.TimeSpan InitialPunchRetryDelay {get;set;}
+  PROP System.Double JitterRatio {get;set;}
+  PROP System.Int32 MaximumAttemptChecksPerPoll {get;set;}
+  PROP System.Int32 MaximumPunchRequests {get;set;}
+  PROP System.TimeSpan MaximumPunchRetryDelay {get;set;}
+TYPE FinalFactory.Rendezvous.Client.RendezvousHostAttemptCompletedEventArgs
+  CTOR (FinalFactory.Rendezvous.Contracts.JoinAttemptId attemptId, FinalFactory.Rendezvous.Client.RendezvousConnectionState state, LiteNetLib.NetPeer peer)
+  PROP FinalFactory.Rendezvous.Contracts.JoinAttemptId AttemptId {get;}
+  PROP LiteNetLib.NetPeer Peer {get;}
+  PROP FinalFactory.Rendezvous.Client.RendezvousConnectionState State {get;}
+TYPE FinalFactory.Rendezvous.Client.RendezvousHostCoordinator
+  CTOR (LiteNetLib.NetManager manager, FinalFactory.Rendezvous.Client.RendezvousNetListener networkEvents, System.Net.IPEndPoint mediator, FinalFactory.Rendezvous.Client.PublishedSession session, FinalFactory.Rendezvous.Client.IRendezvousJoinClient joinClient, FinalFactory.Rendezvous.Client.RendezvousCoordinatorOptions options)
+  PROP System.Int32 PendingAttemptCount {get;}
+  PROP FinalFactory.Rendezvous.Client.RendezvousHostState State {get;}
+  EVENT System.EventHandler<FinalFactory.Rendezvous.Client.RendezvousHostAttemptCompletedEventArgs> AttemptCompleted
+  METHOD System.Void Dispose()
+  METHOD System.Void Poll()
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Int32>> RefreshJoinAttemptsAsync(System.Threading.CancellationToken cancellationToken)
+  METHOD System.String ToString()
+TYPE FinalFactory.Rendezvous.Client.RendezvousHostState
+  ENUM Active=1
+  ENUM ManagerStopped=2
+  ENUM Disposed=3
+TYPE FinalFactory.Rendezvous.Client.RendezvousJoinClient
+  CTOR (System.Net.Http.HttpClient httpClient, FinalFactory.Rendezvous.Client.RendezvousClientOptions options, FinalFactory.Rendezvous.Client.IRendezvousDelay delay)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Collections.Generic.IReadOnlyList<FinalFactory.Rendezvous.Contracts.HostJoinAttempt>>> BrowseAllForHostAsync(FinalFactory.Rendezvous.Client.PublishedSession session, System.Int32 maximumPages, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<FinalFactory.Rendezvous.Contracts.BrowseHostJoinAttemptsResponse>> BrowseForHostAsync(FinalFactory.Rendezvous.Client.PublishedSession session, System.Int32 pageSize, System.String cursor, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<System.Boolean>> CancelAsync(FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse attempt, System.Threading.CancellationToken cancellationToken)
+  METHOD System.Threading.Tasks.Task<FinalFactory.Rendezvous.Client.RendezvousClientResult<FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse>> CreateAsync(FinalFactory.Rendezvous.Contracts.CreateJoinAttemptRequest request, System.Threading.CancellationToken cancellationToken)
+TYPE FinalFactory.Rendezvous.Client.RendezvousNetListener
+  CTOR ()
+  PROP LiteNetLib.EventBasedNetListener GameplayEvents {get;}
+  PROP LiteNetLib.EventBasedNatPunchListener PunchEvents {get;}
+  METHOD LiteNetLib.NetManager CreateManager()
+  METHOD System.Void OnConnectionRequest(LiteNetLib.ConnectionRequest request)
+  METHOD System.Void OnMessageDelivered(LiteNetLib.NetPeer peer, System.Object userData)
+  METHOD System.Void OnNetworkError(System.Net.IPEndPoint endPoint, System.Net.Sockets.SocketError socketError)
+  METHOD System.Void OnNetworkLatencyUpdate(LiteNetLib.NetPeer peer, System.Int32 latency)
+  METHOD System.Void OnNetworkReceive(LiteNetLib.NetPeer peer, LiteNetLib.NetPacketReader reader, System.Byte channelNumber, LiteNetLib.DeliveryMethod deliveryMethod)
+  METHOD System.Void OnNetworkReceiveUnconnected(System.Net.IPEndPoint remoteEndPoint, LiteNetLib.NetPacketReader reader, LiteNetLib.UnconnectedMessageType messageType)
+  METHOD System.Void OnNtpResponse(LiteNetLib.Utils.NtpPacket packet)
+  METHOD System.Void OnPeerAddressChanged(LiteNetLib.NetPeer peer, System.Net.IPEndPoint previousAddress)
+  METHOD System.Void OnPeerConnected(LiteNetLib.NetPeer peer)
+  METHOD System.Void OnPeerDisconnected(LiteNetLib.NetPeer peer, LiteNetLib.DisconnectInfo disconnectInfo)
 TYPE FinalFactory.Rendezvous.Client.RendezvousPublisherClient
   CTOR (System.Net.Http.HttpClient httpClient, FinalFactory.Rendezvous.Client.RendezvousClientOptions options, FinalFactory.Rendezvous.Client.IRendezvousDelay delay)
   METHOD FinalFactory.Rendezvous.Client.SessionLeaseMaintainer CreateLeaseMaintainer(FinalFactory.Rendezvous.Client.PublishedSession session, System.String publisherCredential)

tests/FinalFactory.Rendezvous.Tests/TestData/Contracts/v1/contracts-public-api.txt

@@ -49,6 +49,7 @@ TYPE FinalFactory.Rendezvous.Contracts.ContractLimits
   FIELD System.Int32 ConnectionTicketMaxCharacters=192
   FIELD System.Int32 ContractVersion=1
   FIELD System.Int32 CursorMaxCharacters=512
+  FIELD System.Int32 DerivedCredentialCharacters=43
   FIELD System.Int32 DiagnosticCodeMaxCharacters=64
   FIELD System.Int32 DisplayNameMaxBytes=128
   FIELD System.Int32 EnvironmentIdMaxCharacters=32
@@ -61,6 +62,7 @@ TYPE FinalFactory.Rendezvous.Contracts.ContractLimits
   FIELD System.Int32 MetadataMaxBytes=4096
   FIELD System.Int32 MetadataMaxKeys=32
   FIELD System.Int32 MetadataValueMaxBytes=256
+  FIELD System.Int32 NatPunchRequestTokenCharacters=192
   FIELD System.Int32 OpaqueHttpCredentialMaxCharacters=1024
   FIELD System.Int32 RegionIdMaxCharacters=32
   FIELD System.Int32 SessionCapacityMaxPlayers=10000
@@ -96,6 +98,7 @@ TYPE FinalFactory.Rendezvous.Contracts.CreateJoinAttemptResponse
   CTOR ()
   PROP FinalFactory.Rendezvous.Contracts.JoinAttemptId AttemptId {get;set;}
   PROP System.String ClientPunchCapability {get;set;}
+  PROP System.String ConnectionTicketDigest {get;set;}
   PROP System.Int32 ContractVersion {get;set;}
   PROP FinalFactory.Rendezvous.Contracts.NetworkEndpoint DedicatedFallback {get;set;}
   PROP System.DateTimeOffset ExpiresAt {get;set;}
@@ -135,8 +138,10 @@ TYPE FinalFactory.Rendezvous.Contracts.HealthResponse
 TYPE FinalFactory.Rendezvous.Contracts.HostJoinAttempt
   CTOR ()
   PROP FinalFactory.Rendezvous.Contracts.JoinAttemptId AttemptId {get;set;}
+  PROP System.String ConnectionTicketDigest {get;set;}
   PROP System.DateTimeOffset ExpiresAt {get;set;}
   PROP System.String HostPunchCapability {get;set;}
+  PROP System.Boolean IsCancelled {get;set;}
   PROP FinalFactory.Rendezvous.Contracts.MediationHandle MediationHandle {get;set;}
 TYPE FinalFactory.Rendezvous.Contracts.JoinAttemptId
   CTOR (System.Guid value)
@@ -171,6 +176,31 @@ TYPE FinalFactory.Rendezvous.Contracts.MediationHandle
   METHOD System.Boolean TryParse(System.String value, FinalFactory.Rendezvous.Contracts.MediationHandle& id)
   METHOD System.Boolean op_Equality(FinalFactory.Rendezvous.Contracts.MediationHandle left, FinalFactory.Rendezvous.Contracts.MediationHandle right)
   METHOD System.Boolean op_Inequality(FinalFactory.Rendezvous.Contracts.MediationHandle left, FinalFactory.Rendezvous.Contracts.MediationHandle right)
+TYPE FinalFactory.Rendezvous.Contracts.NatIntroductionToken
+  CTOR ()
+  PROP FinalFactory.Rendezvous.Contracts.JoinAttemptId AttemptId {get;set;}
+  PROP System.String ConnectionTicket {get;set;}
+  METHOD System.String ToString()
+TYPE FinalFactory.Rendezvous.Contracts.NatIntroductionTokenCodec
+  FIELD System.Int32 EncodedLength=43
+  METHOD System.String ComputeDigest(System.String connectionTicket)
+  METHOD System.String Encode(FinalFactory.Rendezvous.Contracts.JoinAttemptId attemptId, System.String derivedAuthenticator)
+  METHOD System.Boolean MatchesDigest(System.String connectionTicket, System.String expectedDigest)
+  METHOD System.Boolean TryDecode(System.String encoded, FinalFactory.Rendezvous.Contracts.NatIntroductionToken& token)
+TYPE FinalFactory.Rendezvous.Contracts.NatPunchPeerRole
+  ENUM HostPresence=1
+  ENUM Host=2
+  ENUM Client=3
+TYPE FinalFactory.Rendezvous.Contracts.NatPunchRequestToken
+  CTOR ()
+  PROP System.String Capability {get;set;}
+  PROP FinalFactory.Rendezvous.Contracts.MediationHandle MediationHandle {get;set;}
+  PROP FinalFactory.Rendezvous.Contracts.NatPunchPeerRole Role {get;set;}
+  METHOD System.String ToString()
+TYPE FinalFactory.Rendezvous.Contracts.NatPunchRequestTokenCodec
+  FIELD System.Int32 EncodedLength=192
+  METHOD System.String Encode(FinalFactory.Rendezvous.Contracts.NatPunchPeerRole role, FinalFactory.Rendezvous.Contracts.MediationHandle mediationHandle, System.String capability)
+  METHOD System.Boolean TryDecode(System.String encoded, FinalFactory.Rendezvous.Contracts.NatPunchRequestToken& token)
 TYPE FinalFactory.Rendezvous.Contracts.NetworkEndpoint
   CTOR ()
   PROP System.String Address {get;set;}

tests/FinalFactory.Rendezvous.Tests/TestData/Contracts/v1/create-join-response.json

@@ -1 +1 @@
-{"contractVersion":1,"attemptId":"11112233-4455-6677-8899-aabbccddeeff","mediationHandle":"22222233-4455-6677-8899-aabbccddeeff","clientPunchCapability":"Abc_123-xYz","expiresAt":"2026-07-16T12:00:00+00:00","dedicatedFallback":{"addressFamily":"ipv6","address":"2001:db8::10","port":9050}}
+{"contractVersion":1,"attemptId":"11112233-4455-6677-8899-aabbccddeeff","mediationHandle":"22222233-4455-6677-8899-aabbccddeeff","clientPunchCapability":"Abc_123-xYz","connectionTicketDigest":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","expiresAt":"2026-07-16T12:00:00+00:00","dedicatedFallback":{"addressFamily":"ipv6","address":"2001:db8::10","port":9050}}