diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 3205b75..298a37d 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -3,6 +3,17 @@
 
     <uses-permission android:name="android.permission.INTERNET" />
 
+    <!--
+      🔴 **WebRTC aborts the PROCESS without this.** Its NetworkMonitor calls
+      ConnectivityManager.getNetworkState() on its own network thread, and the
+      JNI layer asserts RTC_CHECK(!env->ExceptionCheck()) straight afterwards.
+      Missing this permission makes that call throw, and the check turns a Java
+      exception into abort() — SIGABRT inside libjingle_peerconnection_so, no
+      AndroidRuntime trace, no catchable failure. Placing a call simply killed
+      the app.
+    -->
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+
     <!--
       Voice notes. Requested at runtime as well: on this minSdk a dangerous
       permission declared here is not granted here, and a recorder started
diff --git a/app/src/main/kotlin/io/flamenet/messenger/app/CallManager.kt b/app/src/main/kotlin/io/flamenet/messenger/app/CallManager.kt
index e39125c..19d32ad 100644
--- a/app/src/main/kotlin/io/flamenet/messenger/app/CallManager.kt
+++ b/app/src/main/kotlin/io/flamenet/messenger/app/CallManager.kt
@@ -118,14 +118,26 @@ class CallManager(
             override fun onIceCandidate(candidate: IceCandidate?) = Unit
             override fun onIceCandidatesRemoved(candidates: Array<out IceCandidate>?) = Unit
             override fun onSignalingChange(state: PeerConnection.SignalingState?) = Unit
+            // 🔴 **Nothing may throw out of here, and nothing may call back
+            // into WebRTC from here.** This runs on WebRTC's signaling thread,
+            // and its JNI asserts RTC_CHECK(!env->ExceptionCheck()) on the way
+            // out — so ANY escaping Kotlin exception aborts the process:
+            // SIGABRT, no AndroidRuntime trace, nothing to catch.
             override fun onIceConnectionChange(newState: PeerConnection.IceConnectionState?) {
+                runCatching {
                 when (newState) {
                     PeerConnection.IceConnectionState.CONNECTED,
                     PeerConnection.IceConnectionState.COMPLETED -> state = State.ACTIVE
-                    PeerConnection.IceConnectionState.FAILED,
-                    PeerConnection.IceConnectionState.CLOSED -> hangUp(notifyPeer = true)
+                    // ⚠️ CLOSED is what our OWN close() produces. Treating it as
+                    // a reason to hang up re-entered hangUp from inside this
+                    // callback, which then did a blocking network send AND
+                    // disposed the connection we are currently inside — and
+                    // killed the app every single time somebody pressed Hang up.
+                    PeerConnection.IceConnectionState.CLOSED -> Unit
+                    PeerConnection.IceConnectionState.FAILED -> hangUp(notifyPeer = true)
                     else -> Unit
                 }
+                }
             }
             override fun onIceConnectionReceivingChange(receiving: Boolean) = Unit
             override fun onIceGatheringChange(newState: PeerConnection.IceGatheringState?) = Unit
@@ -235,12 +247,34 @@ class CallManager(
      * Closing one without disposing the other leaves the mic live with no call
      * attached — the worst possible failure for this particular feature.
      */
+    /**
+     * ⚠️ **Re-entrancy-safe on purpose.** Tearing a connection down makes
+     * WebRTC fire state callbacks, and a callback that calls back in here
+     * would dispose the very object it is running inside.
+     */
+    private var tearingDown = false
+
     fun hangUp(notifyPeer: Boolean) {
+        if (tearingDown) return
+        tearingDown = true
+        try {
+            hangUpInner(notifyPeer)
+        } finally {
+            tearingDown = false
+        }
+    }
+
+    private fun hangUpInner(notifyPeer: Boolean) {
         val active = current
         if (notifyPeer && active != null) {
-            signal(active.peerId, Content.CallSignal(Content.CallSignal.END, active.callId))
+            // Best effort. Telling the other end is worth doing and is not
+            // worth failing the teardown over — the relay can be rate limiting
+            // us, or simply unreachable.
+            runCatching {
+                signal(active.peerId, Content.CallSignal(Content.CallSignal.END, active.callId))
+            }
         }
-        connection?.let { runCatching { it.close() }; it.dispose() }
+        connection?.let { runCatching { it.close() }; runCatching { it.dispose() } }
         connection = null
         audioTrack?.let { runCatching { it.dispose() } }
         audioTrack = null
diff --git a/app/src/main/kotlin/io/flamenet/messenger/app/MainActivity.kt b/app/src/main/kotlin/io/flamenet/messenger/app/MainActivity.kt
index 21cf7d8..4d76c92 100644
--- a/app/src/main/kotlin/io/flamenet/messenger/app/MainActivity.kt
+++ b/app/src/main/kotlin/io/flamenet/messenger/app/MainActivity.kt
@@ -78,6 +78,19 @@ private fun Root(model: MessengerViewModel = viewModel()) {
             // the lists below manage their own scrolling.
             is MessengerViewModel.Phase.SignedIn ->
                 Column(modifier = frame, verticalArrangement = Arrangement.spacedBy(12.dp)) {
+                    // 🔴 **Above the screen switch, not inside one branch.** An
+                    // incoming call has to be visible whatever screen somebody
+                    // is on, and this used to live inside SignedIn — which the
+                    // chat screen REPLACES. So a call arriving while you were
+                    // reading a thread showed nothing at all.
+                    //
+                    // Worse, the same banner renders the first-call privacy
+                    // prompt, and the only Call button is IN a chat. Tapping it
+                    // set the prompt state, nothing was composed to show it,
+                    // and the prompt gates placing the call — so calling could
+                    // not be started at all. The button looked simply dead.
+                    CallBanner(model, current)
+
                     val chat = current.openChat
                     if (chat != null) {
                         ChatScreen(model, chat, current.error, current.buddies)
@@ -314,10 +327,6 @@ private fun ColumnScope.SignedIn(
         color = Palette.SecondaryText,
         modifier = Modifier.testTag("device-id"))
 
-    // Above everything: an incoming call is the one thing that must be visible
-    // whatever screen somebody is on.
-    CallBanner(model, phase)
-
     // ⚠️ **Screen level, not inside Contacts.** There is ONE error slot shared
     // by everything on this screen, and it used to be rendered inside
     // BuddyList — so a story that failed to post, or a group that could not be