A sound implementation does not ask users to refresh until it works. Each phase has an input, an output, a timeout, and a terminal state. Wi-Fi-to-cellular invalidates host and srflx candidates and changes cost. Transport recovery is not consent to continue a large file or high-bitrate screen.
Network diagnostics separates observed facts from inference. Candidate type, selected route, and stage timing describe connectivity; complete IP addresses or one probe are unnecessary and insufficient evidence.
Define the system contract first
Turn the important choices into durable contracts: validate inputs, assign state ownership, define cleanup, and specify fallback for older peers. Later optimization must not change those semantics.
- Start a bounded ICE restart and pause bulk reads; after new-pair confirmation reset bandwidth control and ask before continuation when data-saving policy applies.
- Bound every input by size, count, and time, returning a stable actionable error code when a budget is exceeded.
- Retries need an idempotency key, backoff, and deadline; after the deadline create a new task instead of reviving old callbacks.
The delivery standard for Handoffs Between Wi-Fi and Cellular Without Losing Session Intent is a usable normal path, convergent failures, bounded resources, and a state users can understand. The result is a production capability that can be explained, degraded safely, and rolled back—not a demo that works once.
What can break that contract
Boundaries turn hidden assumptions into incidents. Weak networks, refresh, concurrency, and capacity need combined coverage because retries can hide each one in isolation.
- A late recovery event from the old pair can overwrite cellular state, while automatic multi-GB resume can consume a data plan without consent.
- Refresh and network change start two recovery paths, and duplicate side effects look like two genuine user actions.
- An untested fallback receives all traffic during a primary failure and becomes the slower, more expensive bottleneck.
How to test the contract line by line
Write the expected state trace before injecting faults. At every phase, reconcile user-visible outcome, both protocol endpoints, persistent records, and resource counts to prove the loop.
- Switch repeatedly among Wi-Fi, 4G, and 5G during file and screen use with data saver, weak signal, and VPN; verify epoch, pause policy, bitrate, and choice.
- Drive the state machine with reordered, duplicate, and delayed messages, proving stale versions are ignored and explicit stop survives recovery.
- Use fault injection to prove alerts precede user reports and operators can locate the failing phase from bounded evidence.
Completion is not one passing path. Every terminal state reconciles, automation stays below user intent, and every operational cost has an explicit ceiling.