diff --git a/src/ClickZen.App/App.xaml.cs b/src/ClickZen.App/App.xaml.cs
index 186e53c..e57c32f 100644
--- a/src/ClickZen.App/App.xaml.cs
+++ b/src/ClickZen.App/App.xaml.cs
@@ -59,6 +59,7 @@ public App()
         // Devices
         sc.AddSingleton<AdbServerHost>();
         sc.AddSingleton<AdbService>();
+        sc.AddSingleton<ClickZen.Device.Adb.Wireless.IAdbMdnsDiscovery, ClickZen.Device.Adb.Wireless.AdbMdnsDiscovery>();
         sc.AddSingleton<DeviceWatcher>();
         sc.AddSingleton<SavedDeviceStore>();
         sc.AddSingleton(sp => new ClickZen.Core.Devices.EmulatorProfileStore(sp.GetRequiredService<AppPaths>(), sp.GetRequiredService<ILogger<ClickZen.Core.Devices.EmulatorProfileStore>>()));
diff --git a/src/ClickZen.App/Services/DeviceHub.cs b/src/ClickZen.App/Services/DeviceHub.cs
index 642b6c2..67bf352 100644
--- a/src/ClickZen.App/Services/DeviceHub.cs
+++ b/src/ClickZen.App/Services/DeviceHub.cs
@@ -214,6 +214,19 @@ public DeviceHub(AdbServerHost server, AdbService adb, DeviceWatcher watcher, Au
         _watcher.DevicesChanged += OnDevicesChanged;
         _watcher.TrackingChanged += (_, tracking) => Ui(() => IsAdbAvailable = tracking);
         _profiles.Changed += (_, _) => Ui(SyncProfiles);
+        _settings.Changed += OnSettingsChanged;
+    }
+
+    private void OnSettingsChanged(object? sender, ClickZen.Core.Settings.AppSettings settings)
+    {
+        var suppress = settings.Devices.SuppressSoftKeyboard;
+        foreach (var entry in Devices.ToArray())
+        {
+            if (entry.Session is { } session)
+            {
+                _ = session.SetSuppressSoftKeyboardAsync(suppress);
+            }
+        }
     }
 
     public ObservableCollection<DeviceEntry> Devices { get; } = [];
@@ -291,25 +304,21 @@ public async Task RefreshAsync(CancellationToken ct = default)
         var pref = _settings.Current.Devices.InputMethod;
         if (pref == InputMethodPreference.Root)
         {
-            var (touch, raw) = await RootInputOfAsync(entry.Serial, ct);
-            if (touch is not null)
-            {
-                return new ClickZen.Device.Input.RootSendeventInjector(
-                    (cmd, c) => _adb.RootShellAsync(entry.Serial, cmd, c), touch,
-                    () => entry.EffectivePhysicalSize,
-                    () => entry.Session is { } s && !s.VideoSize.IsEmpty && s.VideoSize.IsLandscape != entry.EffectivePhysicalSize.IsLandscape
-                        ? ClickZen.Core.Geometry.DisplayRotation.Rotation90
-                        : ClickZen.Core.Geometry.DisplayRotation.Rotation0,
-                    raw);
-            }
-
-            _log.LogWarning("No touchscreen found for root input on {Serial}; using adb input as root", entry.Serial);
-            return ClickZen.Device.Input.AdbInputInjector.For(_adb, entry.Serial, entry.Info.SdkLevel, asRoot: true, () => entry.ActiveDisplayId);
+            return await GetRootInjectorCoreAsync(entry, ct);
         }
 
-        if (pref == InputMethodPreference.Scrcpy && entry.Session is { IsControlAvailable: true } session)
+        if (pref == InputMethodPreference.Scrcpy && entry.Session is { } session)
         {
-            return session.Injector;
+            if (session.IsControlAvailable)
+            {
+                return session.Injector;
+            }
+
+            if (session.IsInputRejected && await HasRootAccessCachedAsync(entry.Serial, ct))
+            {
+                _log.LogInformation("ROM blocked scrcpy INJECT_EVENTS on {Serial}; automatically routing input via persistent root", entry.Serial);
+                return await GetRootInjectorCoreAsync(entry, ct);
+            }
         }
 
         return ClickZen.Device.Input.AdbInputInjector.For(_adb, entry.Serial, entry.Info.SdkLevel, asRoot: false, () => entry.ActiveDisplayId);
@@ -318,6 +327,68 @@ public async Task RefreshAsync(CancellationToken ct = default)
     private readonly System.Collections.Concurrent.ConcurrentDictionary<string, Task<(ClickZen.Device.Input.InputDeviceInfo? Touch, bool Raw)>> _rootInput =
         new(StringComparer.Ordinal);
 
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<string, ClickZen.Device.Input.PersistentRootInjector> _persistentRoot =
+        new(StringComparer.Ordinal);
+
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<string, Task<bool>> _rootAvailability =
+        new(StringComparer.Ordinal);
+
+    private async Task<ClickZen.Core.Input.ITouchInjector> GetRootInjectorCoreAsync(DeviceEntry entry, CancellationToken ct)
+    {
+        var (touch, raw) = await RootInputOfAsync(entry.Serial, ct);
+        if (touch is not null)
+        {
+            return _persistentRoot.GetOrAdd(entry.Serial, s =>
+            {
+                var fallback = new ClickZen.Device.Input.RootSendeventInjector(
+                    (cmd, c) => _adb.RootShellAsync(s, cmd, c), touch,
+                    () => entry.EffectivePhysicalSize,
+                    () => entry.Session is { } sess && !sess.VideoSize.IsEmpty && sess.VideoSize.IsLandscape != entry.EffectivePhysicalSize.IsLandscape
+                        ? ClickZen.Core.Geometry.DisplayRotation.Rotation90
+                        : ClickZen.Core.Geometry.DisplayRotation.Rotation0,
+                    raw);
+                return ClickZen.Device.Input.PersistentRootInjector.ForAdbSocket(
+                    _server.EndPoint,
+                    s,
+                    fallback,
+                    touch,
+                    raw,
+                    () => entry.ActiveDisplayId,
+                    logger: _loggers.CreateLogger<ClickZen.Device.Input.PersistentRootInjector>());
+            });
+        }
+
+        _log.LogWarning("No touchscreen found for root input on {Serial}; using adb input as root", entry.Serial);
+        return ClickZen.Device.Input.AdbInputInjector.For(_adb, entry.Serial, entry.Info.SdkLevel, asRoot: true, () => entry.ActiveDisplayId);
+    }
+
+    private async Task<bool> HasRootAccessCachedAsync(string serial, CancellationToken ct)
+    {
+        var task = _rootAvailability.GetOrAdd(serial, async s =>
+        {
+            try
+            {
+                var check = await _adb.CheckRootAsync(s, TimeSpan.FromSeconds(4), CancellationToken.None);
+                return check.IsRooted;
+            }
+            catch (Exception)
+            {
+                return false;
+            }
+        });
+        return await task.WaitAsync(ct);
+    }
+
+    private async Task ResetDeviceInputCachesAsync(string serial)
+    {
+        _rootInput.TryRemove(serial, out _);
+        _rootAvailability.TryRemove(serial, out _);
+        if (_persistentRoot.TryRemove(serial, out var rootInj))
+        {
+            await rootInj.DisposeAsync();
+        }
+    }
+
     /// <summary>
     /// Touchscreen node and raw-event support of a rooted device, probed once per connection (getevent -p and the
     /// shell probe cost about a second, which every tap paid before). Failed probes are not cached.
@@ -372,6 +443,7 @@ public async Task ConnectAsync(DeviceEntry entry, CancellationToken ct = default
             MaxFps = d.MaxFps,
             StayAwake = m.StayAwake,
             ShowTouches = m.ShowTouches,
+            SuppressSoftKeyboard = d.SuppressSoftKeyboard,
             AutoReconnect = d.AutoReconnect,
         }, _loggers.CreateLogger<ScrcpySession>())
         {
@@ -382,6 +454,7 @@ public async Task ConnectAsync(DeviceEntry entry, CancellationToken ct = default
             entry.SessionState = s;
             entry.SessionError = session.LastError;
         });
+        session.InputRejected += (_, _) => _ = HandleInputRejectedAsync(entry);
         entry.Session = session;
         Current ??= entry;
         await session.StartAsync(ct);
@@ -527,9 +600,22 @@ public async Task DisconnectAsync(DeviceEntry entry)
 
         entry.Session = null;
         await session.DisposeAsync();
+        await ResetDeviceInputCachesAsync(entry.Serial);
         entry.SessionState = SessionState.Disconnected;
     }
 
+    private async Task HandleInputRejectedAsync(DeviceEntry entry)
+    {
+        if (await HasRootAccessCachedAsync(entry.Serial, CancellationToken.None))
+        {
+            Ui(() => entry.SessionError = _loc["Devices_InputSwitchedToRoot"]);
+        }
+        else
+        {
+            Ui(() => entry.SessionError = _loc["Devices_InputPermissionHint"]);
+        }
+    }
+
     private void EnsureFfmpeg()
     {
         if (_ffmpegReady)
@@ -637,6 +723,7 @@ private void Ui(Action action)
 
     public async ValueTask DisposeAsync()
     {
+        _settings.Changed -= OnSettingsChanged;
         _windowMonitor?.Cancel();
         _displayMonitor?.Cancel();
         foreach (var e in Devices.ToList())
@@ -644,6 +731,12 @@ public async ValueTask DisposeAsync()
             await DisconnectAsync(e);
         }
 
+        foreach (var kv in _persistentRoot)
+        {
+            await kv.Value.DisposeAsync();
+        }
+
+        _persistentRoot.Clear();
         await _watcher.DisposeAsync();
     }
 }
diff --git a/src/ClickZen.App/Services/DeviceUi.cs b/src/ClickZen.App/Services/DeviceUi.cs
index 083d2ad..85d1fc1 100644
--- a/src/ClickZen.App/Services/DeviceUi.cs
+++ b/src/ClickZen.App/Services/DeviceUi.cs
@@ -76,7 +76,7 @@ public static string StateText(DeviceAdbState adb, SessionState session, string?
             },
         };
 
-        return string.IsNullOrEmpty(error) || session is SessionState.Streaming or SessionState.Connected
+        return string.IsNullOrEmpty(error)
             ? text
             : $"{text}: {error}";
     }
@@ -102,6 +102,9 @@ public static Visibility CanStart(DeviceAdbState adb, ILiveFrameSource? frames)
 
     public static Visibility IsNetwork(ConnectionKind kind) => kind is ConnectionKind.Wireless or ConnectionKind.Emulator ? Visibility.Visible : Visibility.Collapsed;
 
+    public static Visibility CanSwitchUsbToWireless(ConnectionKind kind, DeviceAdbState adb) =>
+        kind == ConnectionKind.Usb && adb == DeviceAdbState.Online ? Visibility.Visible : Visibility.Collapsed;
+
     public static Visibility IsWindowKind(ConnectionKind kind) => kind == ConnectionKind.Window ? Visibility.Visible : Visibility.Collapsed;
 
     /// <summary>"Start mirroring" for adb devices, "Start capture" / "Reconnect" for window devices.</summary>
diff --git a/src/ClickZen.App/Services/McpBackend.cs b/src/ClickZen.App/Services/McpBackend.cs
index 652da48..9ef765f 100644
--- a/src/ClickZen.App/Services/McpBackend.cs
+++ b/src/ClickZen.App/Services/McpBackend.cs
@@ -11,6 +11,7 @@
 using ClickZen.Core.Settings;
 using ClickZen.Core.Variables;
 using ClickZen.Device.Adb;
+using ClickZen.Device.Adb.Wireless;
 using ClickZen.Device.Scrcpy;
 using ClickZen.Mcp;
 using Microsoft.Extensions.Logging;
@@ -30,6 +31,9 @@ public sealed class McpBackend : IClickZenBackend
     private static readonly TimeSpan FreshFrameTimeout = TimeSpan.FromMilliseconds(600);
 
     private readonly DeviceHub _hub;
+    private readonly AdbService _adb;
+    private readonly IAdbMdnsDiscovery _mdns;
+    private readonly SavedDeviceStore _saved;
     private readonly EmulatorService _emulators;
     private readonly AutomationService _automation;
     private readonly RecordingService _recording;
@@ -45,10 +49,14 @@ public sealed class McpBackend : IClickZenBackend
     private CancellationTokenSource? _playCts;
     private McpPlaybackInfo? _playback;
 
-    public McpBackend(DeviceHub hub, EmulatorService emulators, AutomationService automation, RecordingService recording, VariableStore globals,
+    public McpBackend(DeviceHub hub, AdbService adb, IAdbMdnsDiscovery mdns, SavedDeviceStore saved,
+        EmulatorService emulators, AutomationService automation, RecordingService recording, VariableStore globals,
         IImageMatcher matcher, SettingsService settings, AppPaths paths, ILogger<McpBackend> log)
     {
         _hub = hub;
+        _adb = adb;
+        _mdns = mdns;
+        _saved = saved;
         _emulators = emulators;
         _automation = automation;
         _recording = recording;
@@ -216,6 +224,59 @@ public async Task<McpEmulatorBind> BindEmulatorWindowAsync(string? emulator, Can
         });
     }
 
+    public async Task<IReadOnlyList<McpLanDevice>> DiscoverLanDevicesAsync(CancellationToken ct)
+    {
+        var list = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(1100), ct);
+        return list.Select(s => new McpLanDevice(
+            s.Address,
+            s.Host,
+            s.Port,
+            s.Kind switch
+            {
+                MdnsAdbServiceKind.TlsConnect => "tlsConnect",
+                MdnsAdbServiceKind.TlsPairing => "tlsPairing",
+                _ => "legacyTcp",
+            },
+            s.InstanceName)).ToList();
+    }
+
+    public async Task<McpWirelessEnableResult> EnableWirelessAdbAsync(string? device, int port, bool remember, CancellationToken ct)
+    {
+        var (serial, name) = await OnUi(() =>
+        {
+            var e = Resolve(device);
+            var adbSerial = e.IsWindow
+                ? e.AdbSerial ?? throw new McpToolException($"Device \"{e.Info.DisplayName}\" has no linked ADB device.")
+                : e.Serial;
+            return (adbSerial, e.Info.DisplayName);
+        });
+
+        var r = await _adb.EnableWirelessAsync(serial, port, ct: ct);
+        var saved = false;
+        if (r.Success && remember)
+        {
+            var colon = r.Address.LastIndexOf(':');
+            if (colon > 0 && int.TryParse(r.Address[(colon + 1)..], out var parsedPort))
+            {
+                _saved.AddOrUpdate(new SavedDevice
+                {
+                    Name = name,
+                    Host = r.Address[..colon],
+                    Port = parsedPort,
+                    AutoConnect = true,
+                });
+                saved = true;
+            }
+        }
+
+        if (r.Success)
+        {
+            await _hub.RefreshAsync(ct);
+        }
+
+        return new McpWirelessEnableResult(r.Success, r.Address, r.Message, saved);
+    }
+
     /// <summary>Detects again and resolves the argument; a clear error lists the running emulators when nothing matches.</summary>
     private async Task<DetectedEmulator> ResolveEmulatorAsync(string? emulator, CancellationToken ct)
     {
diff --git a/src/ClickZen.App/Strings/en-US/Resources.resw b/src/ClickZen.App/Strings/en-US/Resources.resw
index b132d8c..cf4e588 100644
--- a/src/ClickZen.App/Strings/en-US/Resources.resw
+++ b/src/ClickZen.App/Strings/en-US/Resources.resw
@@ -58,6 +58,7 @@
   <data name="Devices_StartMirror.Content" xml:space="preserve"><value>Start mirroring</value></data>
   <data name="Devices_StopMirror.Content" xml:space="preserve"><value>Stop mirroring</value></data>
   <data name="Devices_SetCurrent.Content" xml:space="preserve"><value>Set as current</value></data>
+  <data name="Devices_SwitchWireless.Content" xml:space="preserve"><value>Switch to Wi-Fi</value></data>
   <data name="Devices_DisconnectWireless.Content" xml:space="preserve"><value>Disconnect</value></data>
   <data name="Devices_SavedHeader.Text" xml:space="preserve"><value>Saved wireless devices</value></data>
   <data name="Devices_SavedEmpty.Text" xml:space="preserve"><value>Give a wireless device a name when connecting to save it for one-click or automatic reconnection.</value></data>
@@ -66,6 +67,9 @@
   <data name="Devices_RemoveSaved.ToolTipService.ToolTip" xml:space="preserve"><value>Remove</value></data>
   <data name="Devices_Connected" xml:space="preserve"><value>Connected to {0}</value></data>
   <data name="Devices_Disconnected" xml:space="preserve"><value>Disconnected {0}</value></data>
+  <data name="Devices_UsbSwitchedWireless" xml:space="preserve"><value>Wireless ADB enabled and connected to {0}; you can unplug USB now</value></data>
+  <data name="Devices_InputSwitchedToRoot" xml:space="preserve"><value>System blocked standard touch injection; switched to Root fast injection</value></data>
+  <data name="Devices_InputPermissionHint" xml:space="preserve"><value>System blocked touch injection: enable "USB debugging (Security settings)" or "Disable permission monitoring" in Developer options</value></data>
   <data name="Devices_Paired" xml:space="preserve"><value>Paired. Now enter the IP address and port shown on the phone's Wireless debugging screen to connect.</value></data>
   <data name="Devices_ScanNone" xml:space="preserve"><value>No local emulators found. Make sure the emulator is running with ADB enabled.</value></data>
   <data name="Devices_ScanFound" xml:space="preserve"><value>Connected {0} emulator(s).</value></data>
@@ -84,9 +88,20 @@
   <data name="AdbError_ServerStartFailed" xml:space="preserve"><value>The ADB server could not be started.</value></data>
   <data name="AdbError_ConnectionRefused" xml:space="preserve"><value>Connection refused. Check that wireless debugging is on and the address is correct.</value></data>
   <data name="AddWireless_Dialog.Title" xml:space="preserve"><value>Add wireless device</value></data>
+  <data name="AddWireless_TabQr.Text" xml:space="preserve"><value>QR &amp; LAN</value></data>
   <data name="AddWireless_TabDirect.Text" xml:space="preserve"><value>Connect by IP</value></data>
   <data name="AddWireless_TabPair.Text" xml:space="preserve"><value>Pair with code</value></data>
   <data name="AddWireless_TabScan.Text" xml:space="preserve"><value>Scan emulators</value></data>
+  <data name="AddWireless_QrHint.Text" xml:space="preserve"><value>Android 11+: on the phone open Developer options -&gt; Wireless debugging -&gt; Pair device with QR code and scan below to pair and connect automatically.</value></data>
+  <data name="AddWireless_QrRefresh.Content" xml:space="preserve"><value>New QR code</value></data>
+  <data name="AddWireless_QrWaiting" xml:space="preserve"><value>Waiting for phone to scan…</value></data>
+  <data name="AddWireless_QrPairing" xml:space="preserve"><value>Phone found at {0}, pairing…</value></data>
+  <data name="AddWireless_QrConnecting" xml:space="preserve"><value>Paired; connecting to wireless debugging port…</value></data>
+  <data name="AddWireless_QrPairedManualPort" xml:space="preserve"><value>Paired, but no connect port was broadcast; enter the connect address on the Pair tab.</value></data>
+  <data name="AddWireless_QrFailed" xml:space="preserve"><value>QR pairing did not finish; generate a new QR code and try again.</value></data>
+  <data name="AddWireless_LanHeader.Text" xml:space="preserve"><value>Discovered on LAN (mDNS)</value></data>
+  <data name="AddWireless_LanRefresh.Content" xml:space="preserve"><value>Refresh</value></data>
+  <data name="AddWireless_LanEmpty.Text" xml:space="preserve"><value>No wireless debugging broadcasts found on LAN yet. Turn on Wireless debugging on the phone to appear here.</value></data>
   <data name="AddWireless_DirectHint.Text" xml:space="preserve"><value>For devices with TCP debugging enabled (adb tcpip) or emulators on the network. Port defaults to 5555.</value></data>
   <data name="AddWireless_Address.Header" xml:space="preserve"><value>Address</value></data>
   <data name="AddWireless_Address.PlaceholderText" xml:space="preserve"><value>192.168.1.20:5555</value></data>
@@ -684,6 +699,7 @@
   <data name="Settings_Devices_VideoBitRateMbps" xml:space="preserve"><value>Bit rate (Mbps)</value></data>
   <data name="Settings_Devices_MaxFps" xml:space="preserve"><value>Maximum FPS</value></data>
   <data name="Settings_Devices_InputMethod" xml:space="preserve"><value>Input method</value></data>
+  <data name="Settings_Devices_SuppressSoftKeyboard" xml:space="preserve"><value>Suppress on-screen soft keyboard (UHID hardware keyboard)</value></data>
   <data name="Settings_Mirror_HighQualityScaling" xml:space="preserve"><value>High-quality scaling</value></data>
   <data name="Settings_Mirror_ShowTouches" xml:space="preserve"><value>Show touches</value></data>
   <data name="Settings_Mirror_StayAwake" xml:space="preserve"><value>Stay awake</value></data>
diff --git a/src/ClickZen.App/Strings/strings.settings.tsv b/src/ClickZen.App/Strings/strings.settings.tsv
index 1694336..fc34cf0 100644
--- a/src/ClickZen.App/Strings/strings.settings.tsv
+++ b/src/ClickZen.App/Strings/strings.settings.tsv
@@ -16,6 +16,7 @@ Settings_Devices_MaxSize	最长边（0 为原始分辨率）	Maximum edge (0 for
 Settings_Devices_VideoBitRateMbps	码率（Mbps）	Bit rate (Mbps)
 Settings_Devices_MaxFps	最大帧率	Maximum FPS
 Settings_Devices_InputMethod	输入方式	Input method
+Settings_Devices_SuppressSoftKeyboard	抑制手机软键盘弹出（UHID 外接键盘模式）	Suppress on-screen soft keyboard (UHID hardware keyboard)
 Settings_Mirror_HighQualityScaling	高质量缩放	High-quality scaling
 Settings_Mirror_ShowTouches	显示触点	Show touches
 Settings_Mirror_StayAwake	保持常亮	Stay awake
diff --git a/src/ClickZen.App/Strings/strings.tsv b/src/ClickZen.App/Strings/strings.tsv
index e45b481..4599a0e 100644
--- a/src/ClickZen.App/Strings/strings.tsv
+++ b/src/ClickZen.App/Strings/strings.tsv
@@ -57,6 +57,7 @@ Devices_CurrentBadge.Text	当前设备	Current
 Devices_StartMirror.Content	开始投屏	Start mirroring
 Devices_StopMirror.Content	停止投屏	Stop mirroring
 Devices_SetCurrent.Content	设为当前	Set as current
+Devices_SwitchWireless.Content	转为无线	Switch to Wi-Fi
 Devices_DisconnectWireless.Content	断开	Disconnect
 Devices_SavedHeader.Text	已保存的无线设备	Saved wireless devices
 Devices_SavedEmpty.Text	连接无线设备时填写名称即可保存，之后可一键连接或开机自动连接。	Give a wireless device a name when connecting to save it for one-click or automatic reconnection.
@@ -65,6 +66,9 @@ Devices_Connect.Content	连接	Connect
 Devices_RemoveSaved.ToolTipService.ToolTip	删除	Remove
 Devices_Connected	已连接 {0}	Connected to {0}
 Devices_Disconnected	已断开 {0}	Disconnected {0}
+Devices_UsbSwitchedWireless	已开启无线调试并连接 {0}，现在可拔下数据线	Wireless ADB enabled and connected to {0}; you can unplug USB now
+Devices_InputSwitchedToRoot	系统拦截了普通模拟点击，已自动切换至 Root 极速注入	System blocked standard touch injection; switched to Root fast injection
+Devices_InputPermissionHint	系统拦截了模拟点击：请在手机“开发者选项”中开启“USB 调试（安全设置）”或“禁止权限监控”	System blocked touch injection: enable "USB debugging (Security settings)" or "Disable permission monitoring" in Developer options
 Devices_Paired	配对成功。请在下方输入手机“无线调试”页面上显示的 IP 地址和端口完成连接。	Paired. Now enter the IP address and port shown on the phone's Wireless debugging screen to connect.
 Devices_ScanNone	没有发现本地模拟器。请确认模拟器已启动并开启了 ADB 调试。	No local emulators found. Make sure the emulator is running with ADB enabled.
 Devices_ScanFound	已连接 {0} 个模拟器。	Connected {0} emulator(s).
@@ -84,9 +88,20 @@ AdbError_ServerStartFailed	ADB 服务无法启动。	The ADB server could not be
 AdbError_ConnectionRefused	连接被拒绝。请确认设备已开启无线调试且地址正确。	Connection refused. Check that wireless debugging is on and the address is correct.
 # ---- Add wireless dialog ----
 AddWireless_Dialog.Title	添加无线设备	Add wireless device
+AddWireless_TabQr.Text	扫码与局域网	QR & LAN
 AddWireless_TabDirect.Text	IP 直连	Connect by IP
 AddWireless_TabPair.Text	配对码配对	Pair with code
 AddWireless_TabScan.Text	扫描模拟器	Scan emulators
+AddWireless_QrHint.Text	Android 11 及以上：在手机“开发者选项 → 无线调试 → 使用二维码配对设备”扫描下方二维码，配对与连接将自动完成。	Android 11+: on the phone open Developer options -> Wireless debugging -> Pair device with QR code and scan below to pair and connect automatically.
+AddWireless_QrRefresh.Content	刷新二维码	New QR code
+AddWireless_QrWaiting	等待手机扫码…	Waiting for phone to scan…
+AddWireless_QrPairing	检测到手机 {0}，正在自动配对…	Phone found at {0}, pairing…
+AddWireless_QrConnecting	配对成功，正在连接无线调试端口…	Paired; connecting to wireless debugging port…
+AddWireless_QrPairedManualPort	配对成功，但未收到连接端口广播；请切换到“配对码配对”页填写连接地址。	Paired, but no connect port was broadcast; enter the connect address on the Pair tab.
+AddWireless_QrFailed	扫码配对未完成，请刷新二维码重试。	QR pairing did not finish; generate a new QR code and try again.
+AddWireless_LanHeader.Text	局域网已发现设备（mDNS）	Discovered on LAN (mDNS)
+AddWireless_LanRefresh.Content	刷新列表	Refresh
+AddWireless_LanEmpty.Text	暂未发现局域网广播的无线调试设备。开启手机“无线调试”后将自动出现在此处。	No wireless debugging broadcasts found on LAN yet. Turn on Wireless debugging on the phone to appear here.
 AddWireless_DirectHint.Text	适用于已开启 TCP 调试（adb tcpip）的设备或局域网内的模拟器。不填端口时默认 5555。	For devices with TCP debugging enabled (adb tcpip) or emulators on the network. Port defaults to 5555.
 AddWireless_Address.Header	地址	Address
 AddWireless_Address.PlaceholderText	192.168.1.20:5555	192.168.1.20:5555
diff --git a/src/ClickZen.App/Strings/zh-CN/Resources.resw b/src/ClickZen.App/Strings/zh-CN/Resources.resw
index 77869ca..5654f84 100644
--- a/src/ClickZen.App/Strings/zh-CN/Resources.resw
+++ b/src/ClickZen.App/Strings/zh-CN/Resources.resw
@@ -58,6 +58,7 @@
   <data name="Devices_StartMirror.Content" xml:space="preserve"><value>开始投屏</value></data>
   <data name="Devices_StopMirror.Content" xml:space="preserve"><value>停止投屏</value></data>
   <data name="Devices_SetCurrent.Content" xml:space="preserve"><value>设为当前</value></data>
+  <data name="Devices_SwitchWireless.Content" xml:space="preserve"><value>转为无线</value></data>
   <data name="Devices_DisconnectWireless.Content" xml:space="preserve"><value>断开</value></data>
   <data name="Devices_SavedHeader.Text" xml:space="preserve"><value>已保存的无线设备</value></data>
   <data name="Devices_SavedEmpty.Text" xml:space="preserve"><value>连接无线设备时填写名称即可保存，之后可一键连接或开机自动连接。</value></data>
@@ -66,6 +67,9 @@
   <data name="Devices_RemoveSaved.ToolTipService.ToolTip" xml:space="preserve"><value>删除</value></data>
   <data name="Devices_Connected" xml:space="preserve"><value>已连接 {0}</value></data>
   <data name="Devices_Disconnected" xml:space="preserve"><value>已断开 {0}</value></data>
+  <data name="Devices_UsbSwitchedWireless" xml:space="preserve"><value>已开启无线调试并连接 {0}，现在可拔下数据线</value></data>
+  <data name="Devices_InputSwitchedToRoot" xml:space="preserve"><value>系统拦截了普通模拟点击，已自动切换至 Root 极速注入</value></data>
+  <data name="Devices_InputPermissionHint" xml:space="preserve"><value>系统拦截了模拟点击：请在手机“开发者选项”中开启“USB 调试（安全设置）”或“禁止权限监控”</value></data>
   <data name="Devices_Paired" xml:space="preserve"><value>配对成功。请在下方输入手机“无线调试”页面上显示的 IP 地址和端口完成连接。</value></data>
   <data name="Devices_ScanNone" xml:space="preserve"><value>没有发现本地模拟器。请确认模拟器已启动并开启了 ADB 调试。</value></data>
   <data name="Devices_ScanFound" xml:space="preserve"><value>已连接 {0} 个模拟器。</value></data>
@@ -84,9 +88,20 @@
   <data name="AdbError_ServerStartFailed" xml:space="preserve"><value>ADB 服务无法启动。</value></data>
   <data name="AdbError_ConnectionRefused" xml:space="preserve"><value>连接被拒绝。请确认设备已开启无线调试且地址正确。</value></data>
   <data name="AddWireless_Dialog.Title" xml:space="preserve"><value>添加无线设备</value></data>
+  <data name="AddWireless_TabQr.Text" xml:space="preserve"><value>扫码与局域网</value></data>
   <data name="AddWireless_TabDirect.Text" xml:space="preserve"><value>IP 直连</value></data>
   <data name="AddWireless_TabPair.Text" xml:space="preserve"><value>配对码配对</value></data>
   <data name="AddWireless_TabScan.Text" xml:space="preserve"><value>扫描模拟器</value></data>
+  <data name="AddWireless_QrHint.Text" xml:space="preserve"><value>Android 11 及以上：在手机“开发者选项 → 无线调试 → 使用二维码配对设备”扫描下方二维码，配对与连接将自动完成。</value></data>
+  <data name="AddWireless_QrRefresh.Content" xml:space="preserve"><value>刷新二维码</value></data>
+  <data name="AddWireless_QrWaiting" xml:space="preserve"><value>等待手机扫码…</value></data>
+  <data name="AddWireless_QrPairing" xml:space="preserve"><value>检测到手机 {0}，正在自动配对…</value></data>
+  <data name="AddWireless_QrConnecting" xml:space="preserve"><value>配对成功，正在连接无线调试端口…</value></data>
+  <data name="AddWireless_QrPairedManualPort" xml:space="preserve"><value>配对成功，但未收到连接端口广播；请切换到“配对码配对”页填写连接地址。</value></data>
+  <data name="AddWireless_QrFailed" xml:space="preserve"><value>扫码配对未完成，请刷新二维码重试。</value></data>
+  <data name="AddWireless_LanHeader.Text" xml:space="preserve"><value>局域网已发现设备（mDNS）</value></data>
+  <data name="AddWireless_LanRefresh.Content" xml:space="preserve"><value>刷新列表</value></data>
+  <data name="AddWireless_LanEmpty.Text" xml:space="preserve"><value>暂未发现局域网广播的无线调试设备。开启手机“无线调试”后将自动出现在此处。</value></data>
   <data name="AddWireless_DirectHint.Text" xml:space="preserve"><value>适用于已开启 TCP 调试（adb tcpip）的设备或局域网内的模拟器。不填端口时默认 5555。</value></data>
   <data name="AddWireless_Address.Header" xml:space="preserve"><value>地址</value></data>
   <data name="AddWireless_Address.PlaceholderText" xml:space="preserve"><value>192.168.1.20:5555</value></data>
@@ -684,6 +699,7 @@
   <data name="Settings_Devices_VideoBitRateMbps" xml:space="preserve"><value>码率（Mbps）</value></data>
   <data name="Settings_Devices_MaxFps" xml:space="preserve"><value>最大帧率</value></data>
   <data name="Settings_Devices_InputMethod" xml:space="preserve"><value>输入方式</value></data>
+  <data name="Settings_Devices_SuppressSoftKeyboard" xml:space="preserve"><value>抑制手机软键盘弹出（UHID 外接键盘模式）</value></data>
   <data name="Settings_Mirror_HighQualityScaling" xml:space="preserve"><value>高质量缩放</value></data>
   <data name="Settings_Mirror_ShowTouches" xml:space="preserve"><value>显示触点</value></data>
   <data name="Settings_Mirror_StayAwake" xml:space="preserve"><value>保持常亮</value></data>
diff --git a/src/ClickZen.App/ViewModels/DevicesViewModel.cs b/src/ClickZen.App/ViewModels/DevicesViewModel.cs
index 5d90c30..d2b79e9 100644
--- a/src/ClickZen.App/ViewModels/DevicesViewModel.cs
+++ b/src/ClickZen.App/ViewModels/DevicesViewModel.cs
@@ -2,6 +2,7 @@
 using ClickZen.App.Services;
 using ClickZen.Core.Devices;
 using ClickZen.Device.Adb;
+using ClickZen.Device.Adb.Wireless;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using Microsoft.Extensions.Logging;
@@ -40,15 +41,17 @@ public sealed partial class DevicesViewModel : ObservableObject
 {
     private readonly DeviceHub _hub;
     private readonly AdbService _adb;
+    private readonly IAdbMdnsDiscovery _mdns;
     private readonly SavedDeviceStore _saved;
     private readonly EmulatorService _emulators;
     private readonly ILocalizer _loc;
     private readonly ILogger<DevicesViewModel> _log;
 
-    public DevicesViewModel(DeviceHub hub, AdbService adb, SavedDeviceStore saved, EmulatorService emulators, ILocalizer loc, ILogger<DevicesViewModel> log)
+    public DevicesViewModel(DeviceHub hub, AdbService adb, IAdbMdnsDiscovery mdns, SavedDeviceStore saved, EmulatorService emulators, ILocalizer loc, ILogger<DevicesViewModel> log)
     {
         _hub = hub;
         _adb = adb;
+        _mdns = mdns;
         _saved = saved;
         _emulators = emulators;
         _loc = loc;
@@ -270,6 +273,31 @@ await RunAsync(async () =>
         });
     }
 
+    [RelayCommand]
+    private async Task SwitchUsbToWirelessAsync(DeviceEntry entry)
+    {
+        await RunAsync(async () =>
+        {
+            var r = await _adb.EnableWirelessAsync(entry.Serial);
+            if (r.Success && TrySplit(r.Address, out var host, out var port))
+            {
+                _saved.AddOrUpdate(new SavedDevice
+                {
+                    Name = entry.Info.DisplayName,
+                    Host = host,
+                    Port = port,
+                    AutoConnect = true,
+                });
+                await _hub.RefreshAsync();
+                Report(_loc.Format("Devices_UsbSwitchedWireless", r.Address), false);
+            }
+            else
+            {
+                Report(r.Message, true);
+            }
+        });
+    }
+
     [RelayCommand]
     private async Task ConnectSavedAsync(SavedDeviceItem item)
     {
@@ -277,7 +305,24 @@ private async Task ConnectSavedAsync(SavedDeviceItem item)
         try
         {
             var r = await _adb.ConnectAsync(item.Address);
-            Report(r.Success ? _loc.Format("Devices_Connected", item.Address) : r.Message, !r.Success);
+            if (!r.Success)
+            {
+                // Android 11+ randomizes Wireless Debugging ports across Wi-Fi/reboot cycles; probe mDNS to heal.
+                var services = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(1100));
+                var healed = services.FirstOrDefault(s =>
+                    s.Kind is MdnsAdbServiceKind.TlsConnect or MdnsAdbServiceKind.LegacyTcp
+                    && string.Equals(s.Host, item.Model.Host.Trim('[', ']'), StringComparison.OrdinalIgnoreCase));
+                if (healed is not null && healed.Port != item.Model.Port)
+                {
+                    r = await _adb.ConnectAsync(healed.Address);
+                    if (r.Success)
+                    {
+                        _saved.UpdatePortForHost(item.Model.Host, item.Model.Port, healed.Port);
+                    }
+                }
+            }
+
+            Report(r.Success ? _loc.Format("Devices_Connected", r.Address) : r.Message, !r.Success);
         }
         catch (Exception ex)
         {
@@ -323,6 +368,43 @@ public async Task<AdbConnectResult> PairAsync(string address, string code, Cance
         return r;
     }
 
+    public WirelessQrPairCoordinator CreateQrPairCoordinator() => new(_adb, _mdns);
+
+    public async Task<IReadOnlyList<MdnsAdbService>> DiscoverLanDevicesAsync(CancellationToken ct = default)
+    {
+        var all = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(1100), ct);
+        return all.Where(s => s.Kind is MdnsAdbServiceKind.TlsConnect or MdnsAdbServiceKind.LegacyTcp).ToArray();
+    }
+
+    public async Task RememberConnectedDeviceAsync(string address, string? fallbackName = null)
+    {
+        if (!TrySplit(address, out var host, out var port))
+        {
+            return;
+        }
+
+        await _hub.RefreshAsync();
+        var live = _hub.Devices.FirstOrDefault(d => string.Equals(d.Serial, address, StringComparison.OrdinalIgnoreCase));
+        var name = live?.Info.DisplayName;
+        if (string.IsNullOrWhiteSpace(name) || string.Equals(name, address, StringComparison.OrdinalIgnoreCase))
+        {
+            name = !string.IsNullOrWhiteSpace(fallbackName) ? fallbackName.Trim() : host;
+        }
+
+        // Update any prior port for this LAN host in place, or add a new saved wireless device.
+        var existingSameHost = _saved.GetAll().FirstOrDefault(s => string.Equals(s.Host.Trim('[', ']'), host.Trim('[', ']'), StringComparison.OrdinalIgnoreCase));
+        if (existingSameHost is not null && existingSameHost.Port != port)
+        {
+            _saved.UpdatePortForHost(existingSameHost.Host, existingSameHost.Port, port);
+        }
+        else
+        {
+            _saved.AddOrUpdate(new SavedDevice { Name = name, Host = host, Port = port, AutoConnect = true });
+        }
+
+        Report(_loc.Format("Devices_Connected", address), false);
+    }
+
     /// <summary>
     /// The scan tab: connect every detected emulator (exact ports from process detection), then try the port table for
     /// emulators detection does not know. Returns the addresses / serials now connected.
diff --git a/src/ClickZen.App/Views/AddWirelessDialog.xaml b/src/ClickZen.App/Views/AddWirelessDialog.xaml
index 47623c0..f44a83a 100644
--- a/src/ClickZen.App/Views/AddWirelessDialog.xaml
+++ b/src/ClickZen.App/Views/AddWirelessDialog.xaml
@@ -3,11 +3,12 @@
     x:Class="ClickZen.App.Views.AddWirelessDialog"
     xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
     xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+    xmlns:local="using:ClickZen.App.Views"
     x:Uid="AddWireless_Dialog"
     DefaultButton="None"
     Style="{StaticResource DefaultContentDialogStyle}">
 
-    <Grid MinWidth="460" RowSpacing="12">
+    <Grid MinWidth="480" RowSpacing="12">
         <Grid.RowDefinitions>
             <RowDefinition Height="Auto" />
             <RowDefinition Height="Auto" />
@@ -15,13 +16,60 @@
         </Grid.RowDefinitions>
 
         <SelectorBar x:Name="Tabs" SelectionChanged="OnTabChanged">
-            <SelectorBarItem x:Uid="AddWireless_TabDirect" Tag="direct" IsSelected="True" />
+            <SelectorBarItem x:Uid="AddWireless_TabQr" Tag="qr" IsSelected="True" />
+            <SelectorBarItem x:Uid="AddWireless_TabDirect" Tag="direct" />
             <SelectorBarItem x:Uid="AddWireless_TabPair" Tag="pair" />
             <SelectorBarItem x:Uid="AddWireless_TabScan" Tag="scan" />
         </SelectorBar>
 
+        <!-- QR Code Pairing + LAN mDNS Discovery (All-in-One) -->
+        <StackPanel x:Name="QrPanel" Grid.Row="1" Spacing="12">
+            <TextBlock x:Uid="AddWireless_QrHint" Style="{StaticResource SecondaryCaptionTextBlockStyle}" TextWrapping="Wrap" />
+            <Grid ColumnSpacing="16">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="Auto" />
+                    <ColumnDefinition Width="*" />
+                </Grid.ColumnDefinitions>
+                <Border Padding="8" CornerRadius="8" Background="#FFFFFFFF" BorderBrush="{ThemeResource CardStrokeColorDefaultBrush}" BorderThickness="1" VerticalAlignment="Top">
+                    <Image x:Name="QrImage" Width="168" Height="168" Stretch="Uniform" />
+                </Border>
+                <StackPanel Grid.Column="1" Spacing="8" VerticalAlignment="Center">
+                    <TextBlock x:Name="QrStatusText" Style="{StaticResource BodyStrongTextBlockStyle}" TextWrapping="Wrap" />
+                    <TextBlock x:Name="QrCodeMetaText" Style="{StaticResource SecondaryCaptionTextBlockStyle}" FontFamily="{StaticResource MonoFontFamily}" IsTextSelectionEnabled="True" TextWrapping="Wrap" />
+                    <Button x:Name="RefreshQrButton" x:Uid="AddWireless_QrRefresh" Click="OnRefreshQrClick" />
+                </StackPanel>
+            </Grid>
+
+            <Grid ColumnSpacing="8">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*" />
+                    <ColumnDefinition Width="Auto" />
+                </Grid.ColumnDefinitions>
+                <TextBlock x:Uid="AddWireless_LanHeader" Style="{StaticResource BodyStrongTextBlockStyle}" VerticalAlignment="Center" />
+                <Button x:Name="RefreshLanButton" x:Uid="AddWireless_LanRefresh" Grid.Column="1" Click="OnRefreshLanClick" />
+            </Grid>
+            <TextBlock x:Name="LanEmptyText" x:Uid="AddWireless_LanEmpty" Style="{StaticResource SecondaryCaptionTextBlockStyle}" TextWrapping="Wrap" />
+            <ListView x:Name="LanDevicesList" MaxHeight="140" SelectionMode="None" Visibility="Collapsed">
+                <ListView.ItemTemplate>
+                    <DataTemplate x:DataType="local:DiscoveredLanDeviceItem">
+                        <Grid Padding="0,4" ColumnSpacing="8">
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*" />
+                                <ColumnDefinition Width="Auto" />
+                            </Grid.ColumnDefinitions>
+                            <StackPanel>
+                                <TextBlock Text="{x:Bind Address}" FontFamily="{StaticResource MonoFontFamily}" Style="{StaticResource BodyStrongTextBlockStyle}" />
+                                <TextBlock Text="{x:Bind Subtitle}" Style="{StaticResource SecondaryCaptionTextBlockStyle}" TextTrimming="CharacterEllipsis" />
+                            </StackPanel>
+                            <Button Grid.Column="1" x:Uid="Devices_Connect" Click="OnConnectLanItemClick" Tag="{x:Bind}" />
+                        </Grid>
+                    </DataTemplate>
+                </ListView.ItemTemplate>
+            </ListView>
+        </StackPanel>
+
         <!-- Direct connect -->
-        <StackPanel x:Name="DirectPanel" Grid.Row="1" Spacing="12">
+        <StackPanel x:Name="DirectPanel" Grid.Row="1" Spacing="12" Visibility="Collapsed">
             <TextBlock x:Uid="AddWireless_DirectHint" Style="{StaticResource SecondaryCaptionTextBlockStyle}" />
             <TextBox x:Name="DirectAddress" x:Uid="AddWireless_Address" />
             <TextBox x:Name="DirectName" x:Uid="AddWireless_SaveAs" />
diff --git a/src/ClickZen.App/Views/AddWirelessDialog.xaml.cs b/src/ClickZen.App/Views/AddWirelessDialog.xaml.cs
index 4d2c294..a1839af 100644
--- a/src/ClickZen.App/Views/AddWirelessDialog.xaml.cs
+++ b/src/ClickZen.App/Views/AddWirelessDialog.xaml.cs
@@ -1,18 +1,25 @@
+using System.Runtime.InteropServices.WindowsRuntime;
 using ClickZen.App.Services;
 using ClickZen.App.ViewModels;
 using ClickZen.Core.Emulators;
+using ClickZen.Core.Wireless;
 using ClickZen.Device.Adb;
+using ClickZen.Device.Adb.Wireless;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.UI.Xaml;
 using Microsoft.UI.Xaml.Controls;
 using Microsoft.UI.Xaml.Media;
+using Microsoft.UI.Xaml.Media.Imaging;
 
 namespace ClickZen.App.Views;
 
+public sealed record DiscoveredLanDeviceItem(string Address, string Subtitle);
+
 public sealed partial class AddWirelessDialog : ContentDialog
 {
     private readonly DevicesViewModel _vm;
     private readonly ILocalizer _loc;
+    private CancellationTokenSource? _qrCts;
 
     public AddWirelessDialog(DevicesViewModel vm)
     {
@@ -22,15 +29,178 @@ public AddWirelessDialog(DevicesViewModel vm)
         CloseButtonText = _loc["Common_Close"];
         PresetList.Text = string.Join(Environment.NewLine,
             EmulatorPresets.All.Select(p => $"{p.Name}: {string.Join(", ", p.Ports.Select(x => "127.0.0.1:" + x))}"));
+        Opened += OnOpened;
+        Closed += OnClosed;
+    }
+
+    private void OnOpened(ContentDialog sender, ContentDialogOpenedEventArgs args)
+    {
+        StartQrSession();
+        _ = RefreshLanDevicesAsync();
     }
 
+    private void OnClosed(ContentDialog sender, ContentDialogClosedEventArgs args) => StopQrSession();
+
     private void OnTabChanged(SelectorBar sender, SelectorBarSelectionChangedEventArgs args)
     {
         var tag = sender.SelectedItem?.Tag as string;
+        if (QrPanel is null)
+        {
+            return;
+        }
+
+        QrPanel.Visibility = tag == "qr" ? Visibility.Visible : Visibility.Collapsed;
         DirectPanel.Visibility = tag == "direct" ? Visibility.Visible : Visibility.Collapsed;
         PairPanel.Visibility = tag == "pair" ? Visibility.Visible : Visibility.Collapsed;
         ScanPanel.Visibility = tag == "scan" ? Visibility.Visible : Visibility.Collapsed;
         Result.Text = "";
+
+        if (tag == "qr")
+        {
+            if (_qrCts is null)
+            {
+                StartQrSession();
+            }
+
+            _ = RefreshLanDevicesAsync();
+        }
+        else
+        {
+            StopQrSession();
+        }
+    }
+
+    private void OnRefreshQrClick(object sender, RoutedEventArgs e) => StartQrSession();
+
+    private async void OnRefreshLanClick(object sender, RoutedEventArgs e) => await RefreshLanDevicesAsync();
+
+    private async void OnConnectLanItemClick(object sender, RoutedEventArgs e)
+    {
+        if (sender is not FrameworkElement { Tag: DiscoveredLanDeviceItem item })
+        {
+            return;
+        }
+
+        await RunAsync(RefreshLanButton, async () =>
+        {
+            var r = await _vm.ConnectAddressAsync(item.Address, item.Address);
+            if (r.Success)
+            {
+                await _vm.RememberConnectedDeviceAsync(r.Address);
+                Show(_loc.Format("Devices_Connected", r.Address), true);
+            }
+            else
+            {
+                Show(r.Message, false);
+            }
+        });
+    }
+
+    private void StartQrSession()
+    {
+        StopQrSession();
+        var creds = AdbWirelessQrCredentials.CreateRandom();
+        RenderQrBitmap(creds.Payload);
+        QrCodeMetaText.Text = $"{creds.ServiceName}  ·  PIN {creds.Password}";
+        QrStatusText.Text = _loc["AddWireless_QrWaiting"];
+
+        var cts = new CancellationTokenSource();
+        _qrCts = cts;
+        _ = RunQrLoopAsync(creds, cts.Token);
+    }
+
+    private void StopQrSession()
+    {
+        var cts = _qrCts;
+        _qrCts = null;
+        if (cts is not null)
+        {
+            cts.Cancel();
+            cts.Dispose();
+        }
+    }
+
+    private void RenderQrBitmap(string payload)
+    {
+        var matrix = QrCodeEncoder.Encode(payload);
+        var (width, height, bgra) = matrix.ToBgraPixels(modulePixels: 5, quietZoneModules: 3);
+        var bmp = new WriteableBitmap(width, height);
+        using (var stream = bmp.PixelBuffer.AsStream())
+        {
+            stream.Write(bgra, 0, bgra.Length);
+        }
+
+        bmp.Invalidate();
+        QrImage.Source = bmp;
+    }
+
+    private async Task RunQrLoopAsync(AdbWirelessQrCredentials creds, CancellationToken ct)
+    {
+        var coordinator = _vm.CreateQrPairCoordinator();
+        var progress = new Progress<WirelessQrPairProgress>(p => DispatcherQueue.TryEnqueue(() =>
+        {
+            QrStatusText.Text = p.Stage switch
+            {
+                WirelessQrPairStage.WaitingForScan => _loc["AddWireless_QrWaiting"],
+                WirelessQrPairStage.Pairing => _loc.Format("AddWireless_QrPairing", p.PairAddress ?? ""),
+                WirelessQrPairStage.Connecting => _loc["AddWireless_QrConnecting"],
+                WirelessQrPairStage.Connected => _loc.Format("Devices_Connected", p.ConnectAddress ?? ""),
+                WirelessQrPairStage.PairedNeedsConnectPort => _loc["AddWireless_QrPairedManualPort"],
+                WirelessQrPairStage.Failed => p.ErrorMessage ?? _loc["AddWireless_QrFailed"],
+                _ => _loc["AddWireless_QrWaiting"],
+            };
+        }));
+
+        try
+        {
+            var outcome = await coordinator.PairAndConnectAsync(creds, progress, ct);
+            if (outcome.Stage == WirelessQrPairStage.Connected && !string.IsNullOrEmpty(outcome.ConnectAddress))
+            {
+                await _vm.RememberConnectedDeviceAsync(outcome.ConnectAddress);
+                Show(_loc.Format("Devices_Connected", outcome.ConnectAddress), true);
+                await RefreshLanDevicesAsync();
+            }
+            else if (outcome.Stage == WirelessQrPairStage.PairedNeedsConnectPort)
+            {
+                Show(_loc["AddWireless_QrPairedManualPort"], true);
+                await RefreshLanDevicesAsync();
+            }
+            else if (outcome.Stage == WirelessQrPairStage.Failed)
+            {
+                Show(outcome.ErrorMessage ?? _loc["AddWireless_QrFailed"], false);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+        }
+        catch (Exception ex)
+        {
+            Show(ex.Message, false);
+        }
+    }
+
+    private async Task RefreshLanDevicesAsync()
+    {
+        try
+        {
+            RefreshLanButton.IsEnabled = false;
+            var list = await _vm.DiscoverLanDevicesAsync();
+            var items = list.Select(s => new DiscoveredLanDeviceItem(
+                s.Address,
+                s.Kind == MdnsAdbServiceKind.TlsConnect
+                    ? $"{s.InstanceName}  ·  TLS"
+                    : $"{s.InstanceName}  ·  TCP")).ToList();
+            LanDevicesList.ItemsSource = items;
+            LanDevicesList.Visibility = items.Count > 0 ? Visibility.Visible : Visibility.Collapsed;
+            LanEmptyText.Visibility = items.Count == 0 ? Visibility.Visible : Visibility.Collapsed;
+        }
+        catch (Exception)
+        {
+        }
+        finally
+        {
+            RefreshLanButton.IsEnabled = true;
+        }
     }
 
     private async void OnDirectConnect(object sender, RoutedEventArgs e)
@@ -59,12 +229,34 @@ private async void OnPair(object sender, RoutedEventArgs e)
         await RunAsync(PairButton, async () =>
         {
             var r = await _vm.PairAsync(PairAddress.Text, PairCode.Text);
-            Show(r.Success ? _loc["Devices_Paired"] : r.Message, r.Success);
-            if (r.Success && string.IsNullOrWhiteSpace(PairConnectAddress.Text))
+            if (!r.Success)
+            {
+                Show(r.Message, false);
+                return;
+            }
+
+            var host = PairAddress.Text.Trim();
+            var colon = host.LastIndexOf(':');
+            var cleanHost = (colon > 0 ? host[..colon] : host).Trim('[', ']');
+
+            // Auto-discover the random connect port on the same LAN host via mDNS so the user doesn't have to type it.
+            var discovered = await _vm.DiscoverLanDevicesAsync();
+            var autoTarget = discovered.FirstOrDefault(s => string.Equals(s.Host, cleanHost, StringComparison.OrdinalIgnoreCase));
+            if (autoTarget is not null)
+            {
+                PairConnectAddress.Text = autoTarget.Address;
+                var cr = await _vm.ConnectAddressAsync(autoTarget.Address, null);
+                if (cr.Success)
+                {
+                    await _vm.RememberConnectedDeviceAsync(cr.Address);
+                    Show(_loc.Format("Devices_Connected", cr.Address), true);
+                    return;
+                }
+            }
+
+            Show(_loc["Devices_Paired"], true);
+            if (string.IsNullOrWhiteSpace(PairConnectAddress.Text))
             {
-                // Same host, the user still has to type the connect port shown on the phone.
-                var host = PairAddress.Text.Trim();
-                var colon = host.LastIndexOf(':');
                 PairConnectAddress.Text = (colon > 0 ? host[..colon] : host) + ":";
                 PairConnectAddress.Focus(FocusState.Programmatic);
                 PairConnectAddress.SelectionStart = PairConnectAddress.Text.Length;
@@ -83,6 +275,11 @@ private async void OnPairConnect(object sender, RoutedEventArgs e)
         await RunAsync(PairConnectButton, async () =>
         {
             var r = await _vm.ConnectAddressAsync(PairConnectAddress.Text, null);
+            if (r.Success)
+            {
+                await _vm.RememberConnectedDeviceAsync(r.Address);
+            }
+
             Show(r.Success ? _loc.Format("Devices_Connected", r.Address) : r.Message, r.Success);
         });
     }
diff --git a/src/ClickZen.App/Views/DevicesPage.xaml b/src/ClickZen.App/Views/DevicesPage.xaml
index 1eda492..5572367 100644
--- a/src/ClickZen.App/Views/DevicesPage.xaml
+++ b/src/ClickZen.App/Views/DevicesPage.xaml
@@ -159,6 +159,9 @@
                                             <Button x:Uid="Devices_SetCurrent"
                                                     Visibility="{x:Bind svc:DeviceUi.NotTrue(IsCurrent), Mode=OneWay}"
                                                     Click="OnSetCurrentClick" Tag="{x:Bind}" />
+                                            <Button x:Uid="Devices_SwitchWireless"
+                                                    Visibility="{x:Bind svc:DeviceUi.CanSwitchUsbToWireless(Info.Kind, Info.State), Mode=OneWay}"
+                                                    Click="OnSwitchWirelessClick" Tag="{x:Bind}" />
                                             <Button x:Uid="Devices_DisconnectWireless"
                                                     Visibility="{x:Bind svc:DeviceUi.IsNetwork(Info.Kind), Mode=OneWay}"
                                                     Click="OnDisconnectWirelessClick" Tag="{x:Bind}" />
diff --git a/src/ClickZen.App/Views/DevicesPage.xaml.cs b/src/ClickZen.App/Views/DevicesPage.xaml.cs
index 3fc2825..4510d09 100644
--- a/src/ClickZen.App/Views/DevicesPage.xaml.cs
+++ b/src/ClickZen.App/Views/DevicesPage.xaml.cs
@@ -66,6 +66,8 @@ private async void OnBindEmulatorClick(object sender, RoutedEventArgs e)
 
     private void OnSetCurrentClick(object sender, RoutedEventArgs e) => ViewModel.SetCurrentCommand.Execute(Tagged<DeviceEntry>(sender));
 
+    private void OnSwitchWirelessClick(object sender, RoutedEventArgs e) => ViewModel.SwitchUsbToWirelessCommand.Execute(Tagged<DeviceEntry>(sender));
+
     private void OnDisconnectWirelessClick(object sender, RoutedEventArgs e) => ViewModel.DisconnectWirelessCommand.Execute(Tagged<DeviceEntry>(sender));
 
     private void OnConnectSavedClick(object sender, RoutedEventArgs e) => ViewModel.ConnectSavedCommand.Execute(Tagged<SavedDeviceItem>(sender));
diff --git a/src/ClickZen.Core/Settings/AppSettings.cs b/src/ClickZen.Core/Settings/AppSettings.cs
index 3eb24c1..b59613e 100644
--- a/src/ClickZen.Core/Settings/AppSettings.cs
+++ b/src/ClickZen.Core/Settings/AppSettings.cs
@@ -66,6 +66,8 @@ public sealed class DeviceDefaults
     public int VideoBitRateMbps { get; set; } = 8;
     public int MaxFps { get; set; } = 60;
     public InputMethodPreference InputMethod { get; set; } = InputMethodPreference.Scrcpy;
+    /// <summary>Registers a virtual UHID physical keyboard over scrcpy so Android suppresses the soft on-screen keyboard.</summary>
+    public bool SuppressSoftKeyboard { get; set; }
 }
 
 public sealed class MirrorSettings
diff --git a/src/ClickZen.Core/Wireless/AdbWirelessQr.cs b/src/ClickZen.Core/Wireless/AdbWirelessQr.cs
new file mode 100644
index 0000000..77d8f1a
--- /dev/null
+++ b/src/ClickZen.Core/Wireless/AdbWirelessQr.cs
@@ -0,0 +1,110 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace ClickZen.Core.Wireless;
+
+/// <summary>
+/// Android 11+ Wireless Debugging QR code pairing payload (<c>WIFI:T:ADB;S:&lt;serviceName&gt;;P:&lt;password&gt;;;</c>,
+/// matching AOSP's <c>WirelessDebuggingFragment</c> and Android Studio's QR pairing flow).
+/// </summary>
+public sealed record AdbWirelessQrCredentials(string ServiceName, string Password, string Payload)
+{
+    private const string Prefix = "WIFI:T:ADB;";
+
+    /// <summary>Generates a fresh random pairing credential set (<c>clickzen-&lt;8 hex&gt;</c> + 6-digit numeric code).</summary>
+    public static AdbWirelessQrCredentials CreateRandom()
+    {
+        Span<byte> rand = stackalloc byte[4];
+        RandomNumberGenerator.Fill(rand);
+        var suffix = Convert.ToHexStringLower(rand);
+        var code = RandomNumberGenerator.GetInt32(100_000, 1_000_000).ToString(System.Globalization.CultureInfo.InvariantCulture);
+        return Create($"clickzen-{suffix}", code);
+    }
+
+    public static AdbWirelessQrCredentials Create(string serviceName, string password)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(serviceName);
+        ArgumentException.ThrowIfNullOrWhiteSpace(password);
+        var s = serviceName.Trim();
+        var p = password.Trim();
+        var payload = $"{Prefix}S:{Escape(s)};P:{Escape(p)};;";
+        return new AdbWirelessQrCredentials(s, p, payload);
+    }
+
+    public static bool TryParse(string? payload, out AdbWirelessQrCredentials? credentials)
+    {
+        credentials = null;
+        if (string.IsNullOrWhiteSpace(payload) || !payload.StartsWith(Prefix, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        string? service = null;
+        string? password = null;
+        var body = payload[Prefix.Length..];
+        var i = 0;
+        while (i < body.Length)
+        {
+            if (body[i] == ';')
+            {
+                i++;
+                continue;
+            }
+
+            var colon = body.IndexOf(':', i);
+            if (colon <= i)
+            {
+                break;
+            }
+
+            var key = body[i..colon];
+            var sb = new StringBuilder();
+            var j = colon + 1;
+            while (j < body.Length && body[j] != ';')
+            {
+                if (body[j] == '\\' && j + 1 < body.Length)
+                {
+                    j++;
+                }
+
+                sb.Append(body[j]);
+                j++;
+            }
+
+            if (key == "S")
+            {
+                service = sb.ToString();
+            }
+            else if (key == "P")
+            {
+                password = sb.ToString();
+            }
+
+            i = j + 1;
+        }
+
+        if (string.IsNullOrEmpty(service) || string.IsNullOrEmpty(password))
+        {
+            return false;
+        }
+
+        credentials = new AdbWirelessQrCredentials(service, password, payload);
+        return true;
+    }
+
+    private static string Escape(string value)
+    {
+        var sb = new StringBuilder(value.Length);
+        foreach (var ch in value)
+        {
+            if (ch is '\\' or ';' or ',' or ':' or '"')
+            {
+                sb.Append('\\');
+            }
+
+            sb.Append(ch);
+        }
+
+        return sb.ToString();
+    }
+}
diff --git a/src/ClickZen.Core/Wireless/QrCodeEncoder.cs b/src/ClickZen.Core/Wireless/QrCodeEncoder.cs
new file mode 100644
index 0000000..ec9e393
--- /dev/null
+++ b/src/ClickZen.Core/Wireless/QrCodeEncoder.cs
@@ -0,0 +1,527 @@
+using System.Text;
+
+namespace ClickZen.Core.Wireless;
+
+/// <summary>
+/// Self-contained ISO/IEC 18004 QR Code encoder (Byte mode, Error Correction Level M, Versions 1–6, up to 106 UTF-8 bytes)
+/// used to render Android 11+ Wireless Debugging QR codes without external dependencies.
+/// </summary>
+public sealed class QrMatrix
+{
+    private readonly bool[,] _modules;
+
+    internal QrMatrix(int version, int mask, bool[,] modules)
+    {
+        Version = version;
+        Mask = mask;
+        _modules = modules;
+        Size = modules.GetLength(0);
+    }
+
+    public int Version { get; }
+
+    public int Mask { get; }
+
+    /// <summary>Module count per side (<c>17 + 4 * Version</c>).</summary>
+    public int Size { get; }
+
+    /// <summary>True when module <c>(row, col)</c> is dark (black).</summary>
+    public bool this[int row, int col] => _modules[row, col];
+
+    /// <summary>Renders the QR matrix into a top-down 32-bit BGRA pixel buffer with a white quiet zone.</summary>
+    public (int Width, int Height, byte[] Bgra) ToBgraPixels(int modulePixels = 8, int quietZoneModules = 4)
+    {
+        ArgumentOutOfRangeException.ThrowIfLessThan(modulePixels, 1);
+        ArgumentOutOfRangeException.ThrowIfLessThan(quietZoneModules, 0);
+
+        var totalModules = Size + 2 * quietZoneModules;
+        var dim = totalModules * modulePixels;
+        var bgra = new byte[dim * dim * 4];
+        // Initialize full background to opaque white (255, 255, 255, 255).
+        Array.Fill(bgra, (byte)255);
+
+        for (var r = 0; r < Size; r++)
+        {
+            for (var c = 0; c < Size; c++)
+            {
+                if (!_modules[r, c])
+                {
+                    continue;
+                }
+
+                var y0 = (r + quietZoneModules) * modulePixels;
+                var x0 = (c + quietZoneModules) * modulePixels;
+                for (var py = 0; py < modulePixels; py++)
+                {
+                    var rowOffset = ((y0 + py) * dim + x0) * 4;
+                    for (var px = 0; px < modulePixels; px++)
+                    {
+                        var idx = rowOffset + px * 4;
+                        bgra[idx] = 0;     // B
+                        bgra[idx + 1] = 0; // G
+                        bgra[idx + 2] = 0; // R
+                        bgra[idx + 3] = 255;
+                    }
+                }
+            }
+        }
+
+        return (dim, dim, bgra);
+    }
+}
+
+public static class QrCodeEncoder
+{
+    // ISO/IEC 18004 Table 9 — Error Correction Level M parameters for Versions 1..6:
+    // (Version, DataCodewordsPerBlock, EcCodewordsPerBlock, BlockCount, AlignmentCoord)
+    private sealed record VersionSpec(int Version, int DataPerBlock, int EcPerBlock, int Blocks, int AlignmentCenter)
+    {
+        public int TotalDataCodewords => DataPerBlock * Blocks;
+    }
+
+    private static readonly VersionSpec[] Specs =
+    [
+        new(1, 16, 10, 1, 0),
+        new(2, 28, 16, 1, 18),
+        new(3, 44, 26, 1, 22),
+        new(4, 32, 18, 2, 26),
+        new(5, 43, 24, 2, 30),
+        new(6, 27, 16, 4, 34),
+    ];
+
+    /// <summary>Encodes <paramref name="text"/> as an Error Correction Level M QR Code.</summary>
+    public static QrMatrix Encode(string text)
+    {
+        ArgumentNullException.ThrowIfNull(text);
+        return Encode(Encoding.UTF8.GetBytes(text));
+    }
+
+    /// <summary>Encodes raw bytes in QR Byte Mode (Error Correction Level M, Versions 1–6).</summary>
+    public static QrMatrix Encode(ReadOnlySpan<byte> payload)
+    {
+        // Byte mode header: 4-bit mode (0100) + 8-bit byte count = 12 bits -> max payload = TotalDataCodewords - 2.
+        var payloadLength = payload.Length;
+        var spec = Specs.FirstOrDefault(s => payloadLength + 2 <= s.TotalDataCodewords)
+            ?? throw new ArgumentOutOfRangeException(nameof(payload), $"Payload length {payloadLength} exceeds QR Version 6-M capacity (106 bytes).");
+
+        var dataCodewords = BuildDataCodewords(payload, spec.TotalDataCodewords);
+        var allCodewords = BuildInterleavedCodewords(dataCodewords, spec);
+
+        var size = 17 + 4 * spec.Version;
+        var baseModules = new bool[size, size];
+        var isFunction = new bool[size, size];
+        DrawFunctionPatterns(spec, baseModules, isFunction);
+        DrawCodewords(allCodewords, baseModules, isFunction);
+
+        var bestMask = 0;
+        var bestPenalty = int.MaxValue;
+        bool[,]? bestGrid = null;
+
+        for (var mask = 0; mask < 8; mask++)
+        {
+            var candidate = (bool[,])baseModules.Clone();
+            ApplyMask(mask, candidate, isFunction);
+            DrawFormatBits(mask, candidate, isFunction);
+            var penalty = ComputePenalty(candidate);
+            if (penalty < bestPenalty)
+            {
+                bestPenalty = penalty;
+                bestMask = mask;
+                bestGrid = candidate;
+            }
+        }
+
+        return new QrMatrix(spec.Version, bestMask, bestGrid!);
+    }
+
+    private static byte[] BuildDataCodewords(ReadOnlySpan<byte> payload, int capacity)
+    {
+        var bits = new List<bool>(capacity * 8);
+        AppendBits(bits, 0b0100, 4); // Byte mode indicator
+        AppendBits(bits, payload.Length, 8);
+        foreach (var b in payload)
+        {
+            AppendBits(bits, b, 8);
+        }
+
+        var maxBits = capacity * 8;
+        var terminator = Math.Min(4, maxBits - bits.Count);
+        AppendBits(bits, 0, terminator);
+        while (bits.Count % 8 != 0)
+        {
+            bits.Add(false);
+        }
+
+        var result = new byte[capacity];
+        var byteCount = bits.Count / 8;
+        for (var i = 0; i < byteCount; i++)
+        {
+            byte v = 0;
+            for (var b = 0; b < 8; b++)
+            {
+                v = (byte)((v << 1) | (bits[i * 8 + b] ? 1 : 0));
+            }
+
+            result[i] = v;
+        }
+
+        byte pad = 0xEC;
+        for (var i = byteCount; i < capacity; i++)
+        {
+            result[i] = pad;
+            pad = pad == 0xEC ? (byte)0x11 : (byte)0xEC;
+        }
+
+        return result;
+    }
+
+    private static byte[] BuildInterleavedCodewords(byte[] data, VersionSpec spec)
+    {
+        var generator = BuildReedSolomonGenerator(spec.EcPerBlock);
+        var dataBlocks = new byte[spec.Blocks][];
+        var ecBlocks = new byte[spec.Blocks][];
+
+        for (var b = 0; b < spec.Blocks; b++)
+        {
+            dataBlocks[b] = data.AsSpan(b * spec.DataPerBlock, spec.DataPerBlock).ToArray();
+            ecBlocks[b] = ComputeReedSolomonRemainder(dataBlocks[b], generator);
+        }
+
+        var output = new byte[(spec.DataPerBlock + spec.EcPerBlock) * spec.Blocks];
+        var pos = 0;
+        for (var i = 0; i < spec.DataPerBlock; i++)
+        {
+            for (var b = 0; b < spec.Blocks; b++)
+            {
+                output[pos++] = dataBlocks[b][i];
+            }
+        }
+
+        for (var i = 0; i < spec.EcPerBlock; i++)
+        {
+            for (var b = 0; b < spec.Blocks; b++)
+            {
+                output[pos++] = ecBlocks[b][i];
+            }
+        }
+
+        return output;
+    }
+
+    private static void DrawFunctionPatterns(VersionSpec spec, bool[,] modules, bool[,] isFunction)
+    {
+        var size = modules.GetLength(0);
+
+        // Timing patterns (row 6 and col 6).
+        for (var i = 0; i < size; i++)
+        {
+            SetFunction(6, i, i % 2 == 0, modules, isFunction);
+            SetFunction(i, 6, i % 2 == 0, modules, isFunction);
+        }
+
+        // Three 7x7 finder patterns + white separators.
+        DrawFinderPattern(3, 3, modules, isFunction);
+        DrawFinderPattern(3, size - 4, modules, isFunction);
+        DrawFinderPattern(size - 4, 3, modules, isFunction);
+
+        // Alignment pattern (Versions 2..6 have one 5x5 alignment pattern at bottom-right).
+        if (spec.AlignmentCenter > 0)
+        {
+            DrawAlignmentPattern(spec.AlignmentCenter, spec.AlignmentCenter, modules, isFunction);
+        }
+
+        // Reserve format info slots + dark module (filled again for each mask).
+        DrawFormatBits(0, modules, isFunction);
+    }
+
+    private static void DrawFinderPattern(int centerRow, int centerCol, bool[,] modules, bool[,] isFunction)
+    {
+        var size = modules.GetLength(0);
+        for (var dy = -4; dy <= 4; dy++)
+        {
+            for (var dx = -4; dx <= 4; dx++)
+            {
+                var r = centerRow + dy;
+                var c = centerCol + dx;
+                if (r >= 0 && r < size && c >= 0 && c < size)
+                {
+                    var dist = Math.Max(Math.Abs(dx), Math.Abs(dy));
+                    SetFunction(r, c, dist != 2 && dist != 4, modules, isFunction);
+                }
+            }
+        }
+    }
+
+    private static void DrawAlignmentPattern(int centerRow, int centerCol, bool[,] modules, bool[,] isFunction)
+    {
+        for (var dy = -2; dy <= 2; dy++)
+        {
+            for (var dx = -2; dx <= 2; dx++)
+            {
+                var dist = Math.Max(Math.Abs(dx), Math.Abs(dy));
+                SetFunction(centerRow + dy, centerCol + dx, dist != 1, modules, isFunction);
+            }
+        }
+    }
+
+    private static void DrawFormatBits(int mask, bool[,] modules, bool[,] isFunction)
+    {
+        var size = modules.GetLength(0);
+        // EC Level M indicator = 0b00.
+        var data = (0b00 << 3) | mask;
+        var rem = data;
+        for (var i = 0; i < 10; i++)
+        {
+            rem = (rem << 1) ^ ((rem >> 9) * 0x537);
+        }
+
+        var bits = ((data << 10) | rem) ^ 0x5412;
+
+        // First copy around top-left finder.
+        for (var i = 0; i <= 5; i++)
+        {
+            SetFunction(i, 8, GetBit(bits, i), modules, isFunction);
+        }
+
+        SetFunction(7, 8, GetBit(bits, 6), modules, isFunction);
+        SetFunction(8, 8, GetBit(bits, 7), modules, isFunction);
+        SetFunction(8, 7, GetBit(bits, 8), modules, isFunction);
+        for (var i = 9; i < 15; i++)
+        {
+            SetFunction(8, 14 - i, GetBit(bits, i), modules, isFunction);
+        }
+
+        // Second copy split across top-right and bottom-left finders.
+        for (var i = 0; i < 8; i++)
+        {
+            SetFunction(8, size - 1 - i, GetBit(bits, i), modules, isFunction);
+        }
+
+        for (var i = 8; i < 15; i++)
+        {
+            SetFunction(size - 15 + i, 8, GetBit(bits, i), modules, isFunction);
+        }
+
+        // Always-dark module.
+        SetFunction(size - 8, 8, true, modules, isFunction);
+    }
+
+    private static void DrawCodewords(byte[] codewords, bool[,] modules, bool[,] isFunction)
+    {
+        var size = modules.GetLength(0);
+        var bitIndex = 0;
+        var totalBits = codewords.Length * 8;
+        var upward = true;
+
+        for (var right = size - 1; right >= 1; right -= 2)
+        {
+            if (right == 6)
+            {
+                right = 5; // Skip vertical timing column.
+            }
+
+            for (var vert = 0; vert < size; vert++)
+            {
+                var r = upward ? size - 1 - vert : vert;
+                for (var j = 0; j < 2; j++)
+                {
+                    var c = right - j;
+                    if (!isFunction[r, c])
+                    {
+                        var dark = bitIndex < totalBits && GetBit(codewords[bitIndex >> 3], 7 - (bitIndex & 7));
+                        modules[r, c] = dark;
+                        bitIndex++;
+                    }
+                }
+            }
+
+            upward = !upward;
+        }
+    }
+
+    private static void ApplyMask(int mask, bool[,] modules, bool[,] isFunction)
+    {
+        var size = modules.GetLength(0);
+        for (var r = 0; r < size; r++)
+        {
+            for (var c = 0; c < size; c++)
+            {
+                if (!isFunction[r, c] && MaskMatches(mask, r, c))
+                {
+                    modules[r, c] = !modules[r, c];
+                }
+            }
+        }
+    }
+
+    private static bool MaskMatches(int mask, int r, int c) => mask switch
+    {
+        0 => (r + c) % 2 == 0,
+        1 => r % 2 == 0,
+        2 => c % 3 == 0,
+        3 => (r + c) % 3 == 0,
+        4 => (r / 2 + c / 3) % 2 == 0,
+        5 => r * c % 2 + r * c % 3 == 0,
+        6 => (r * c % 2 + r * c % 3) % 2 == 0,
+        7 => ((r + c) % 2 + r * c % 3) % 2 == 0,
+        _ => false,
+    };
+
+    private static int ComputePenalty(bool[,] modules)
+    {
+        var size = modules.GetLength(0);
+        var penalty = 0;
+
+        // N1: Adjacent identical modules in row/column (5+ run -> 3 + (len - 5)).
+        for (var i = 0; i < size; i++)
+        {
+            var rowRun = 1;
+            var colRun = 1;
+            for (var j = 1; j < size; j++)
+            {
+                if (modules[i, j] == modules[i, j - 1])
+                {
+                    rowRun++;
+                    if (rowRun == 5) penalty += 3;
+                    else if (rowRun > 5) penalty++;
+                }
+                else
+                {
+                    rowRun = 1;
+                }
+
+                if (modules[j, i] == modules[j - 1, i])
+                {
+                    colRun++;
+                    if (colRun == 5) penalty += 3;
+                    else if (colRun > 5) penalty++;
+                }
+                else
+                {
+                    colRun = 1;
+                }
+            }
+        }
+
+        // N2: 2x2 blocks of identical color (+3 each).
+        for (var r = 0; r < size - 1; r++)
+        {
+            for (var c = 0; c < size - 1; c++)
+            {
+                var v = modules[r, c];
+                if (v == modules[r, c + 1] && v == modules[r + 1, c] && v == modules[r + 1, c + 1])
+                {
+                    penalty += 3;
+                }
+            }
+        }
+
+        // N3: 1:1:3:1:1 finder-like patterns preceded/followed by 4 light modules (+40).
+        for (var i = 0; i < size; i++)
+        {
+            for (var j = 0; j <= size - 11; j++)
+            {
+                if (MatchesFinderLikeRow(modules, i, j)) penalty += 40;
+                if (MatchesFinderLikeCol(modules, j, i)) penalty += 40;
+            }
+        }
+
+        // N4: Dark module balance from 50%.
+        var darkCount = 0;
+        foreach (var m in modules)
+        {
+            if (m) darkCount++;
+        }
+
+        var total = size * size;
+        var k = Math.Abs(darkCount * 20 - total * 10) / total;
+        penalty += k * 10;
+        return penalty;
+    }
+
+    private static bool MatchesFinderLikeRow(bool[,] m, int r, int c)
+    {
+        // 10111010000 or 00001011101
+        bool p1 = m[r, c] && !m[r, c + 1] && m[r, c + 2] && m[r, c + 3] && m[r, c + 4] && !m[r, c + 5] && m[r, c + 6]
+                  && !m[r, c + 7] && !m[r, c + 8] && !m[r, c + 9] && !m[r, c + 10];
+        bool p2 = !m[r, c] && !m[r, c + 1] && !m[r, c + 2] && !m[r, c + 3]
+                  && m[r, c + 4] && !m[r, c + 5] && m[r, c + 6] && m[r, c + 7] && m[r, c + 8] && !m[r, c + 9] && m[r, c + 10];
+        return p1 || p2;
+    }
+
+    private static bool MatchesFinderLikeCol(bool[,] m, int r, int c)
+    {
+        bool p1 = m[r, c] && !m[r + 1, c] && m[r + 2, c] && m[r + 3, c] && m[r + 4, c] && !m[r + 5, c] && m[r + 6, c]
+                  && !m[r + 7, c] && !m[r + 8, c] && !m[r + 9, c] && !m[r + 10, c];
+        bool p2 = !m[r, c] && !m[r + 1, c] && !m[r + 2, c] && !m[r + 3, c]
+                  && m[r + 4, c] && !m[r + 5, c] && m[r + 6, c] && m[r + 7, c] && m[r + 8, c] && !m[r + 9, c] && m[r + 10, c];
+        return p1 || p2;
+    }
+
+    private static void SetFunction(int r, int c, bool dark, bool[,] modules, bool[,] isFunction)
+    {
+        modules[r, c] = dark;
+        isFunction[r, c] = true;
+    }
+
+    private static void AppendBits(List<bool> list, int val, int len)
+    {
+        for (var i = len - 1; i >= 0; i--)
+        {
+            list.Add(((val >> i) & 1) != 0);
+        }
+    }
+
+    private static bool GetBit(int val, int bit) => ((val >> bit) & 1) != 0;
+
+    private static byte[] BuildReedSolomonGenerator(int degree)
+    {
+        var result = new byte[degree];
+        result[degree - 1] = 1;
+        byte root = 1;
+        for (var i = 0; i < degree; i++)
+        {
+            for (var j = 0; j < degree; j++)
+            {
+                result[j] = GfMultiply(result[j], root);
+                if (j + 1 < degree)
+                {
+                    result[j] ^= result[j + 1];
+                }
+            }
+
+            root = GfMultiply(root, 0x02);
+        }
+
+        return result;
+    }
+
+    private static byte[] ComputeReedSolomonRemainder(ReadOnlySpan<byte> data, ReadOnlySpan<byte> generator)
+    {
+        var result = new byte[generator.Length];
+        foreach (var b in data)
+        {
+            var factor = (byte)(b ^ result[0]);
+            Array.Copy(result, 1, result, 0, result.Length - 1);
+            result[^1] = 0;
+            for (var j = 0; j < generator.Length; j++)
+            {
+                result[j] ^= GfMultiply(generator[j], factor);
+            }
+        }
+
+        return result;
+    }
+
+    private static byte GfMultiply(byte x, byte y)
+    {
+        var z = 0;
+        for (var i = 7; i >= 0; i--)
+        {
+            z = (z << 1) ^ ((z >> 7) * 0x11D);
+            z ^= ((y >> i) & 1) * x;
+        }
+
+        return (byte)z;
+    }
+}
diff --git a/src/ClickZen.Device/Adb/AdbService.cs b/src/ClickZen.Device/Adb/AdbService.cs
index 2b5e847..ec6d76d 100644
--- a/src/ClickZen.Device/Adb/AdbService.cs
+++ b/src/ClickZen.Device/Adb/AdbService.cs
@@ -527,6 +527,63 @@ await RunAsync(serial, "push", PushTimeout, async t =>
         return IpParser.ParseRouteSource(route);
     }
 
+    /// <summary>
+    /// Switches a USB-connected Android phone into wireless TCP/IP mode (<c>adb tcpip 5555</c>), discovers its
+    /// Wi-Fi IPv4 address, and connects to <c>&lt;ip&gt;:&lt;port&gt;</c> so the USB cable can be unplugged.
+    /// </summary>
+    public async Task<AdbConnectResult> EnableWirelessAsync(
+        string usbSerial,
+        int port = HostPortParser.DefaultAdbPort,
+        Func<string, int, CancellationToken, Task>? tcpIpRequester = null,
+        CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(usbSerial);
+        if (port is < 1 or > 65535)
+        {
+            throw new ArgumentOutOfRangeException(nameof(port), port, "Port must be 1-65535.");
+        }
+
+        var ip = await GetDeviceIpAsync(usbSerial, ct);
+        if (string.IsNullOrWhiteSpace(ip))
+        {
+            return new AdbConnectResult(false, ConnectResultKind.Failed, "Could not determine the device's Wi-Fi IP address (check Wi-Fi is connected to the same LAN).", "");
+        }
+
+        var requester = tcpIpRequester ?? SendTcpIpRequestAsync;
+        await RunAsync(usbSerial, "tcpip", HostCommandTimeout, async t =>
+        {
+            await requester(usbSerial, port, t);
+            return true;
+        }, ct);
+
+        var target = HostPortParser.Format(ip, port);
+        // adbd restarts in TCP mode; retry connect briefly while it comes back up.
+        AdbConnectResult last = new(false, ConnectResultKind.Failed, "Timed out waiting for wireless adbd.", target);
+        for (var attempt = 0; attempt < 6; attempt++)
+        {
+            if (attempt > 0)
+            {
+                await Task.Delay(TimeSpan.FromMilliseconds(450), ct);
+            }
+
+            last = await ConnectAsync(target, ct);
+            if (last.Success)
+            {
+                return last;
+            }
+        }
+
+        return last;
+    }
+
+    private async Task SendTcpIpRequestAsync(string serial, int port, CancellationToken ct)
+    {
+        using var socket = new AdbSocket(_client.EndPoint, null);
+        await socket.SetDeviceAsync(Device(serial), ct);
+        await socket.SendAdbRequestAsync($"tcpip:{port.ToString(CultureInfo.InvariantCulture)}", ct);
+        _ = await socket.ReadAdbResponseAsync(ct);
+    }
+
     // ------------------------------------------------------------------ port forwarding
 
     /// <summary><c>adb forward local remote</c>, e.g. <c>("tcp:27183", "localabstract:scrcpy_1234")</c>. Returns the bound port when <paramref name="local"/> is <c>tcp:0</c>.</summary>
diff --git a/src/ClickZen.Device/Adb/AutoConnector.cs b/src/ClickZen.Device/Adb/AutoConnector.cs
index a742e1f..76e951d 100644
--- a/src/ClickZen.Device/Adb/AutoConnector.cs
+++ b/src/ClickZen.Device/Adb/AutoConnector.cs
@@ -1,4 +1,7 @@
+using System.Net;
+using ClickZen.Core.Devices;
 using ClickZen.Core.Settings;
+using ClickZen.Device.Adb.Wireless;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 
@@ -10,25 +13,28 @@ public sealed class AutoConnector
     private readonly AdbService _adb;
     private readonly SavedDeviceStore _store;
     private readonly Func<bool> _enabled;
+    private readonly IAdbMdnsDiscovery? _mdns;
     private readonly ILogger _logger;
 
-    public AutoConnector(AdbService adb, SavedDeviceStore store, SettingsService settings, ILogger<AutoConnector>? logger = null)
-        : this(adb, store, () => settings.Current.Devices.AutoConnectSaved, logger)
+    public AutoConnector(AdbService adb, SavedDeviceStore store, SettingsService settings, IAdbMdnsDiscovery? mdns = null, ILogger<AutoConnector>? logger = null)
+        : this(adb, store, () => settings.Current.Devices.AutoConnectSaved, mdns, logger)
     {
         ArgumentNullException.ThrowIfNull(settings);
     }
 
-    internal AutoConnector(AdbService adb, SavedDeviceStore store, Func<bool> enabled, ILogger? logger)
+    internal AutoConnector(AdbService adb, SavedDeviceStore store, Func<bool> enabled, IAdbMdnsDiscovery? mdns = null, ILogger? logger = null)
     {
         _adb = adb ?? throw new ArgumentNullException(nameof(adb));
         _store = store ?? throw new ArgumentNullException(nameof(store));
         _enabled = enabled;
+        _mdns = mdns;
         _logger = logger ?? NullLogger.Instance;
     }
 
     /// <summary>
     /// Tries every saved device with <c>AutoConnect = true</c> in parallel, unless
-    /// <c>Devices.AutoConnectSaved</c> is off. Returns one result per attempted device.
+    /// <c>Devices.AutoConnectSaved</c> is off. When a saved LAN device refuses its previous port (Android 11+
+    /// randomizes Wireless Debugging ports across Wi-Fi/reboot cycles), probes mDNS once to heal the port.
     /// </summary>
     public async Task<IReadOnlyList<AdbConnectResult>> ConnectSavedAsync(CancellationToken ct = default)
     {
@@ -45,33 +51,90 @@ public async Task<IReadOnlyList<AdbConnectResult>> ConnectSavedAsync(Cancellatio
         }
 
         _logger.LogInformation("Auto-connecting {Count} saved device(s)", targets.Length);
-        var results = await Task.WhenAll(targets.Select(async d =>
+        var results = await Task.WhenAll(targets.Select(d => TryConnectOneAsync(d, ct)));
+
+        // If any non-loopback LAN target failed and mDNS discovery is available, sweep mDNS once to heal shifted TLS ports.
+        if (_mdns is not null)
         {
-            try
+            var failedIndices = Enumerable.Range(0, targets.Length)
+                .Where(i => !results[i].Success && IsLanHost(targets[i].Host))
+                .ToArray();
+            if (failedIndices.Length > 0)
             {
-                var r = await _adb.ConnectAsync(d.Address, ct);
-                if (r.Success)
+                IReadOnlyList<MdnsAdbService> discovered = [];
+                try
                 {
-                    _logger.LogInformation("Auto-connect {Name} ({Address}): {Message}", d.Name, r.Address, r.Message);
+                    discovered = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(1100), ct);
                 }
-                else
+                catch (Exception ex) when (ex is not OperationCanceledException || !ct.IsCancellationRequested)
                 {
-                    _logger.LogWarning("Auto-connect {Name} ({Address}) failed [{Kind}]: {Message}", d.Name, r.Address, r.Kind, r.Message);
+                    _logger.LogDebug(ex, "mDNS fallback sweep during auto-connect failed");
                 }
 
-                return r;
+                foreach (var idx in failedIndices)
+                {
+                    var d = targets[idx];
+                    var match = discovered.FirstOrDefault(s =>
+                        s.Kind is MdnsAdbServiceKind.TlsConnect or MdnsAdbServiceKind.LegacyTcp
+                        && s.Port != d.Port
+                        && string.Equals(s.Host, d.Host.Trim('[', ']'), StringComparison.OrdinalIgnoreCase));
+                    if (match is null)
+                    {
+                        continue;
+                    }
+
+                    _logger.LogInformation("mDNS discovered updated port for {Name}: {OldAddress} -> {NewAddress}", d.Name, d.Address, match.Address);
+                    var healed = await TryConnectAddressAsync(d.Name, match.Address, ct);
+                    if (healed.Success)
+                    {
+                        _ = _store.UpdatePortForHost(d.Host, d.Port, match.Port);
+                        results[idx] = healed;
+                    }
+                }
             }
-            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        }
+
+        return results;
+    }
+
+    private Task<AdbConnectResult> TryConnectOneAsync(SavedDevice d, CancellationToken ct) =>
+        TryConnectAddressAsync(d.Name, d.Address, ct);
+
+    private async Task<AdbConnectResult> TryConnectAddressAsync(string name, string address, CancellationToken ct)
+    {
+        try
+        {
+            var r = await _adb.ConnectAsync(address, ct);
+            if (r.Success)
             {
-                throw;
+                _logger.LogInformation("Auto-connect {Name} ({Address}): {Message}", name, r.Address, r.Message);
             }
-            catch (Exception ex)
+            else
             {
-                _logger.LogWarning(ex, "Auto-connect {Name} ({Address}) failed", d.Name, d.Address);
-                return new AdbConnectResult(false, Parsing.ConnectResultKind.Failed, ex.Message, d.Address);
+                _logger.LogWarning("Auto-connect {Name} ({Address}) failed [{Kind}]: {Message}", name, r.Address, r.Kind, r.Message);
             }
-        }));
 
-        return results;
+            return r;
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Auto-connect {Name} ({Address}) failed", name, address);
+            return new AdbConnectResult(false, Parsing.ConnectResultKind.Failed, ex.Message, address);
+        }
+    }
+
+    private static bool IsLanHost(string host)
+    {
+        var trimmed = host.Trim().Trim('[', ']');
+        if (string.IsNullOrEmpty(trimmed) || string.Equals(trimmed, "localhost", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        return !IPAddress.TryParse(trimmed, out var ip) || !IPAddress.IsLoopback(ip);
     }
 }
diff --git a/src/ClickZen.Device/Adb/SavedDeviceStore.cs b/src/ClickZen.Device/Adb/SavedDeviceStore.cs
index 1b4b26e..25ead30 100644
--- a/src/ClickZen.Device/Adb/SavedDeviceStore.cs
+++ b/src/ClickZen.Device/Adb/SavedDeviceStore.cs
@@ -119,6 +119,39 @@ public bool Remove(string address)
         return true;
     }
 
+    /// <summary>
+    /// Updates the port of an existing saved wireless device on <paramref name="host"/> (e.g. when Android 11+
+    /// Wireless Debugging assigns a new random TLS port on the same LAN IP). Returns true if an entry changed.
+    /// </summary>
+    public bool UpdatePortForHost(string host, int oldPort, int newPort)
+    {
+        if (string.IsNullOrWhiteSpace(host) || newPort is < 1 or > 65535 || oldPort == newPort)
+        {
+            return false;
+        }
+
+        var changed = false;
+        lock (_gate)
+        {
+            var existing = _doc.Saved.FirstOrDefault(d => Matches(d, host, oldPort));
+            if (existing is not null)
+            {
+                // Drop any stale duplicate already carrying host:newPort before updating in place.
+                _doc.Saved.RemoveAll(d => !ReferenceEquals(d, existing) && Matches(d, host, newPort));
+                existing.Port = newPort;
+                Persist();
+                changed = true;
+            }
+        }
+
+        if (changed)
+        {
+            Changed?.Invoke(this, EventArgs.Empty);
+        }
+
+        return changed;
+    }
+
     private void Persist()
     {
         try
diff --git a/src/ClickZen.Device/Adb/Wireless/AdbMdnsDiscovery.cs b/src/ClickZen.Device/Adb/Wireless/AdbMdnsDiscovery.cs
new file mode 100644
index 0000000..8931a26
--- /dev/null
+++ b/src/ClickZen.Device/Adb/Wireless/AdbMdnsDiscovery.cs
@@ -0,0 +1,354 @@
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Net;
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+using ClickZen.Core.Wireless;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClickZen.Device.Adb.Wireless;
+
+/// <summary>Discovers Android Wireless Debugging endpoints (<c>_adb-tls-connect</c>, <c>_adb-tls-pairing</c>, <c>_adb</c>) on the LAN.</summary>
+public interface IAdbMdnsDiscovery
+{
+    Task<IReadOnlyList<MdnsAdbService>> DiscoverAsync(TimeSpan duration, CancellationToken ct = default);
+}
+
+/// <summary>
+/// Pure-C# multicast mDNS querier/listener (<c>224.0.0.251:5353</c> across active IPv4 LAN interfaces, plus
+/// <c>adb mdns services</c> CLI supplement when available) so Wireless Debugging QR pairing and random-port
+/// auto-recovery work out of the box on Windows without installing Bonjour.
+/// </summary>
+public sealed class AdbMdnsDiscovery : IAdbMdnsDiscovery
+{
+    private static readonly IPAddress MulticastGroup = IPAddress.Parse("224.0.0.251");
+    private static readonly IPEndPoint MulticastEndpoint = new(MulticastGroup, 5353);
+
+    private readonly AdbServerHost? _serverHost;
+    private readonly ILogger _logger;
+
+    public AdbMdnsDiscovery(AdbServerHost? serverHost = null, ILogger<AdbMdnsDiscovery>? logger = null)
+    {
+        _serverHost = serverHost;
+        _logger = (ILogger?)logger ?? NullLogger.Instance;
+    }
+
+    public async Task<IReadOnlyList<MdnsAdbService>> DiscoverAsync(TimeSpan duration, CancellationToken ct = default)
+    {
+        var found = new ConcurrentDictionary<(MdnsAdbServiceKind, string, string, int), MdnsAdbService>();
+        using var windowCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        windowCts.CancelAfter(duration < TimeSpan.FromMilliseconds(250) ? TimeSpan.FromMilliseconds(250) : duration);
+
+        var tasks = new List<Task>
+        {
+            ProbeUdpMulticastAsync(found, windowCts.Token),
+            ProbeAdbMdnsCliAsync(found, windowCts.Token),
+        };
+
+        try
+        {
+            await Task.WhenAll(tasks);
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+        }
+
+        return found.Values
+            .OrderBy(s => s.Kind)
+            .ThenBy(s => s.Host, StringComparer.OrdinalIgnoreCase)
+            .ThenBy(s => s.Port)
+            .ToArray();
+    }
+
+    private async Task ProbeUdpMulticastAsync(
+        ConcurrentDictionary<(MdnsAdbServiceKind, string, string, int), MdnsAdbService> found,
+        CancellationToken ct)
+    {
+        var sockets = new List<Socket>();
+        try
+        {
+            // Shared multicast listener on UDP 5353 so standard multicast replies reach us.
+            try
+            {
+                var shared = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+                shared.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.ReuseAddress, true);
+                shared.Bind(new IPEndPoint(IPAddress.Any, 5353));
+                foreach (var ifaceIp in GetLanIpv4Addresses())
+                {
+                    try
+                    {
+                        shared.SetSocketOption(
+                            SocketOptionLevel.IP,
+                            SocketOptionName.AddMembership,
+                            new MulticastOption(MulticastGroup, ifaceIp));
+                    }
+                    catch (SocketException)
+                    {
+                    }
+                }
+
+                sockets.Add(shared);
+            }
+            catch (SocketException ex)
+            {
+                _logger.LogDebug(ex, "Could not bind shared UDP 5353 socket; relying on per-interface QU queries");
+            }
+
+            // Per-interface ephemeral sockets sending QU (unicast-response) + QM queries out of the right NIC.
+            foreach (var ifaceIp in GetLanIpv4Addresses())
+            {
+                try
+                {
+                    var s = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+                    s.Bind(new IPEndPoint(ifaceIp, 0));
+                    s.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.MulticastTimeToLive, 255);
+                    sockets.Add(s);
+                }
+                catch (SocketException)
+                {
+                }
+            }
+
+            if (sockets.Count == 0)
+            {
+                return;
+            }
+
+            var receivers = sockets.Select(s => ReceiveLoopAsync(s, found, ct)).ToArray();
+            var qmPacket = MdnsPacket.BuildPtrQuery(unicastResponse: false);
+            var quPacket = MdnsPacket.BuildPtrQuery(unicastResponse: true);
+
+            while (!ct.IsCancellationRequested)
+            {
+                foreach (var s in sockets)
+                {
+                    try
+                    {
+                        var payload = ((IPEndPoint)s.LocalEndPoint!).Port == 5353 ? qmPacket : quPacket;
+                        _ = await s.SendToAsync(payload, SocketFlags.None, MulticastEndpoint, ct);
+                    }
+                    catch (Exception ex) when (ex is SocketException or ObjectDisposedException)
+                    {
+                    }
+                }
+
+                await Task.Delay(TimeSpan.FromMilliseconds(450), ct);
+            }
+
+            await Task.WhenAll(receivers);
+        }
+        finally
+        {
+            foreach (var s in sockets)
+            {
+                try
+                {
+                    s.Dispose();
+                }
+                catch (ObjectDisposedException)
+                {
+                }
+            }
+        }
+    }
+
+    private static async Task ReceiveLoopAsync(
+        Socket socket,
+        ConcurrentDictionary<(MdnsAdbServiceKind, string, string, int), MdnsAdbService> found,
+        CancellationToken ct)
+    {
+        var buffer = new byte[4096];
+        EndPoint any = new IPEndPoint(IPAddress.Any, 0);
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                var received = await socket.ReceiveFromAsync(buffer, SocketFlags.None, any, ct);
+                if (received.ReceivedBytes <= 0)
+                {
+                    continue;
+                }
+
+                var senderIp = (received.RemoteEndPoint as IPEndPoint)?.Address;
+                foreach (var svc in MdnsPacket.ParseMessage(buffer.AsSpan(0, received.ReceivedBytes), senderIp))
+                {
+                    found[(svc.Kind, svc.InstanceName, svc.Host, svc.Port)] = svc;
+                }
+            }
+            catch (OperationCanceledException)
+            {
+                break;
+            }
+            catch (Exception ex) when (ex is SocketException or ObjectDisposedException)
+            {
+                break;
+            }
+        }
+    }
+
+    private async Task ProbeAdbMdnsCliAsync(
+        ConcurrentDictionary<(MdnsAdbServiceKind, string, string, int), MdnsAdbService> found,
+        CancellationToken ct)
+    {
+        if (_serverHost is null)
+        {
+            return;
+        }
+
+        var adbPath = _serverHost.ResolveAdbPath();
+        if (string.IsNullOrWhiteSpace(adbPath) || !File.Exists(adbPath))
+        {
+            return;
+        }
+
+        try
+        {
+            using var proc = new Process
+            {
+                StartInfo = new ProcessStartInfo
+                {
+                    FileName = adbPath,
+                    Arguments = "mdns services",
+                    CreateNoWindow = true,
+                    UseShellExecute = false,
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                },
+            };
+            if (!proc.Start())
+            {
+                return;
+            }
+
+            var output = await proc.StandardOutput.ReadToEndAsync(ct);
+            await proc.WaitForExitAsync(ct);
+            foreach (var svc in MdnsPacket.ParseAdbMdnsServicesOutput(output))
+            {
+                found[(svc.Kind, svc.InstanceName, svc.Host, svc.Port)] = svc;
+            }
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogDebug(ex, "adb mdns services probe skipped");
+        }
+    }
+
+    private static IReadOnlyList<IPAddress> GetLanIpv4Addresses()
+    {
+        var list = new List<IPAddress>();
+        try
+        {
+            foreach (var nic in NetworkInterface.GetAllNetworkInterfaces())
+            {
+                if (nic.OperationalStatus != OperationalStatus.Up
+                    || nic.NetworkInterfaceType == NetworkInterfaceType.Loopback)
+                {
+                    continue;
+                }
+
+                foreach (var uni in nic.GetIPProperties().UnicastAddresses)
+                {
+                    if (uni.Address.AddressFamily == AddressFamily.InterNetwork && !IPAddress.IsLoopback(uni.Address))
+                    {
+                        list.Add(uni.Address);
+                    }
+                }
+            }
+        }
+        catch (NetworkInformationException)
+        {
+        }
+
+        return list;
+    }
+}
+
+public enum WirelessQrPairStage
+{
+    WaitingForScan,
+    Pairing,
+    Connecting,
+    Connected,
+    PairedNeedsConnectPort,
+    Failed,
+}
+
+public sealed record WirelessQrPairProgress(
+    WirelessQrPairStage Stage,
+    string? PairAddress = null,
+    string? ConnectAddress = null,
+    string? ErrorMessage = null);
+
+/// <summary>
+/// Coordinates Android 11+ QR Code Wireless Debugging pairing: watches LAN mDNS for the phone's
+/// <c>&lt;serviceName&gt;._adb-tls-pairing._tcp</c> broadcast when the QR code is scanned, pairs automatically,
+/// then resolves and connects to the phone's <c>_adb-tls-connect._tcp</c> port on the same IP.
+/// </summary>
+public sealed class WirelessQrPairCoordinator
+{
+    private readonly AdbService _adb;
+    private readonly IAdbMdnsDiscovery _mdns;
+
+    public WirelessQrPairCoordinator(AdbService adb, IAdbMdnsDiscovery mdns)
+    {
+        _adb = adb ?? throw new ArgumentNullException(nameof(adb));
+        _mdns = mdns ?? throw new ArgumentNullException(nameof(mdns));
+    }
+
+    public async Task<WirelessQrPairProgress> PairAndConnectAsync(
+        AdbWirelessQrCredentials credentials,
+        IProgress<WirelessQrPairProgress>? progress = null,
+        CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(credentials);
+        progress?.Report(new WirelessQrPairProgress(WirelessQrPairStage.WaitingForScan));
+
+        MdnsAdbService? pairingSvc = null;
+        while (!ct.IsCancellationRequested && pairingSvc is null)
+        {
+            var services = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(950), ct);
+            pairingSvc = services.FirstOrDefault(s =>
+                s.Kind == MdnsAdbServiceKind.TlsPairing
+                && (string.Equals(s.InstanceName, credentials.ServiceName, StringComparison.OrdinalIgnoreCase)
+                    || s.InstanceName.Contains(credentials.ServiceName, StringComparison.OrdinalIgnoreCase)));
+        }
+
+        ct.ThrowIfCancellationRequested();
+        var pairAddr = pairingSvc!.Address;
+        progress?.Report(new WirelessQrPairProgress(WirelessQrPairStage.Pairing, PairAddress: pairAddr));
+
+        var pairResult = await _adb.PairAsync(pairAddr, credentials.Password, ct);
+        if (!pairResult.Success)
+        {
+            var fail = new WirelessQrPairProgress(WirelessQrPairStage.Failed, PairAddress: pairAddr, ErrorMessage: pairResult.Message);
+            progress?.Report(fail);
+            return fail;
+        }
+
+        progress?.Report(new WirelessQrPairProgress(WirelessQrPairStage.Connecting, PairAddress: pairAddr));
+
+        // After pairing succeeds, find the phone's _adb-tls-connect._tcp service on the same host IP (up to ~6s).
+        for (var attempt = 0; attempt < 6 && !ct.IsCancellationRequested; attempt++)
+        {
+            var services = await _mdns.DiscoverAsync(TimeSpan.FromMilliseconds(900), ct);
+            var connectSvc = services.FirstOrDefault(s =>
+                s.Kind is MdnsAdbServiceKind.TlsConnect or MdnsAdbServiceKind.LegacyTcp
+                && string.Equals(s.Host, pairingSvc.Host, StringComparison.OrdinalIgnoreCase));
+            if (connectSvc is not null)
+            {
+                var connectResult = await _adb.ConnectAsync(connectSvc.Address, ct);
+                if (connectResult.Success)
+                {
+                    var done = new WirelessQrPairProgress(WirelessQrPairStage.Connected, pairAddr, connectResult.Address);
+                    progress?.Report(done);
+                    return done;
+                }
+            }
+        }
+
+        var partial = new WirelessQrPairProgress(WirelessQrPairStage.PairedNeedsConnectPort, PairAddress: pairAddr);
+        progress?.Report(partial);
+        return partial;
+    }
+}
diff --git a/src/ClickZen.Device/Adb/Wireless/MdnsPacket.cs b/src/ClickZen.Device/Adb/Wireless/MdnsPacket.cs
new file mode 100644
index 0000000..b9c112c
--- /dev/null
+++ b/src/ClickZen.Device/Adb/Wireless/MdnsPacket.cs
@@ -0,0 +1,407 @@
+using System.Buffers.Binary;
+using System.Net;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace ClickZen.Device.Adb.Wireless;
+
+public enum MdnsAdbServiceKind
+{
+    /// <summary><c>_adb-tls-connect._tcp.local.</c> — Android 11+ Wireless Debugging TLS endpoint.</summary>
+    TlsConnect,
+    /// <summary><c>_adb-tls-pairing._tcp.local.</c> — Android 11+ Wireless Debugging QR / code pairing endpoint.</summary>
+    TlsPairing,
+    /// <summary><c>_adb._tcp.local.</c> — Legacy TCP/IP wireless ADB endpoint (e.g. port 5555).</summary>
+    LegacyTcp,
+}
+
+/// <summary>An Android wireless ADB endpoint discovered over LAN mDNS.</summary>
+public sealed record MdnsAdbService(
+    MdnsAdbServiceKind Kind,
+    string InstanceName,
+    string Host,
+    int Port,
+    IReadOnlyDictionary<string, string>? Properties = null)
+{
+    public string Address => Host.Contains(':', StringComparison.Ordinal) && !Host.StartsWith('[')
+        ? $"[{Host}]:{Port}"
+        : $"{Host}:{Port}";
+}
+
+/// <summary>
+/// Minimal, bounds-checked RFC 6762 / RFC 6763 mDNS query builder and response parser for Android ADB DNS-SD services,
+/// plus a parser for <c>adb mdns services</c> CLI output.
+/// </summary>
+public static partial class MdnsPacket
+{
+    public const string TlsConnectService = "_adb-tls-connect._tcp.local.";
+    public const string TlsPairingService = "_adb-tls-pairing._tcp.local.";
+    public const string LegacyTcpService = "_adb._tcp.local.";
+
+    private static readonly string[] DefaultServices = [TlsConnectService, TlsPairingService, LegacyTcpService];
+
+    private const ushort TypeA = 1;
+    private const ushort TypePtr = 12;
+    private const ushort TypeTxt = 16;
+    private const ushort TypeAaaa = 28;
+    private const ushort TypeSrv = 33;
+    private const ushort ClassIn = 1;
+
+    /// <summary>Builds a standard DNS-SD PTR query packet asking for one or more service types.</summary>
+    public static byte[] BuildPtrQuery(bool unicastResponse = false, params ReadOnlySpan<string> serviceTypes)
+    {
+        if (serviceTypes.Length == 0)
+        {
+            serviceTypes = DefaultServices;
+        }
+
+        using var ms = new MemoryStream(128);
+        Span<byte> header = stackalloc byte[12];
+        BinaryPrimitives.WriteUInt16BigEndian(header[0..], 0); // Transaction ID = 0 for mDNS
+        BinaryPrimitives.WriteUInt16BigEndian(header[2..], 0); // Standard query flags
+        BinaryPrimitives.WriteUInt16BigEndian(header[4..], (ushort)serviceTypes.Length); // QDCOUNT
+        ms.Write(header);
+
+        ushort qclass = unicastResponse ? (ushort)(ClassIn | 0x8000) : ClassIn;
+        Span<byte> tail = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt16BigEndian(tail[0..], TypePtr);
+        BinaryPrimitives.WriteUInt16BigEndian(tail[2..], qclass);
+
+        foreach (var svc in serviceTypes)
+        {
+            WriteDomainName(ms, svc);
+            ms.Write(tail);
+        }
+
+        return ms.ToArray();
+    }
+
+    /// <summary>
+    /// Extracts Android ADB DNS-SD endpoints from an incoming mDNS UDP packet.
+    /// <paramref name="senderAddress"/> is used as a last-resort host fallback if the responder sent SRV without A/AAAA in the same datagram.
+    /// </summary>
+    public static IReadOnlyList<MdnsAdbService> ParseMessage(ReadOnlySpan<byte> packet, IPAddress? senderAddress = null)
+    {
+        if (packet.Length < 12)
+        {
+            return [];
+        }
+
+        var qdCount = BinaryPrimitives.ReadUInt16BigEndian(packet[4..]);
+        var anCount = BinaryPrimitives.ReadUInt16BigEndian(packet[6..]);
+        var nsCount = BinaryPrimitives.ReadUInt16BigEndian(packet[8..]);
+        var arCount = BinaryPrimitives.ReadUInt16BigEndian(packet[10..]);
+        var totalRecords = anCount + nsCount + arCount;
+        if (totalRecords == 0)
+        {
+            return [];
+        }
+
+        var offset = 12;
+        for (var q = 0; q < qdCount; q++)
+        {
+            if (!TryReadName(packet, ref offset, out _) || offset + 4 > packet.Length)
+            {
+                return [];
+            }
+
+            offset += 4;
+        }
+
+        var srvRecords = new List<(string FullName, string Target, int Port, uint Ttl)>();
+        var ipv4ByHost = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var ipv6ByHost = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var txtByFullName = new Dictionary<string, Dictionary<string, string>>(StringComparer.OrdinalIgnoreCase);
+
+        for (var r = 0; r < totalRecords && offset < packet.Length; r++)
+        {
+            if (!TryReadName(packet, ref offset, out var rrName) || offset + 10 > packet.Length)
+            {
+                break;
+            }
+
+            var rrType = BinaryPrimitives.ReadUInt16BigEndian(packet[offset..]);
+            var ttl = BinaryPrimitives.ReadUInt32BigEndian(packet[(offset + 4)..]);
+            var rdLen = BinaryPrimitives.ReadUInt16BigEndian(packet[(offset + 8)..]);
+            offset += 10;
+            if (offset + rdLen > packet.Length)
+            {
+                break;
+            }
+
+            var rdataOffset = offset;
+            offset += rdLen;
+            if (ttl == 0)
+            {
+                // Goodbye record (TTL=0 means service went offline).
+                continue;
+            }
+
+            switch (rrType)
+            {
+                case TypeA when rdLen == 4:
+                {
+                    var ip = new IPAddress(packet.Slice(rdataOffset, 4));
+                    if (!IPAddress.IsLoopback(ip))
+                    {
+                        ipv4ByHost[NormalizeDomain(rrName)] = ip.ToString();
+                    }
+
+                    break;
+                }
+                case TypeAaaa when rdLen == 16:
+                {
+                    var ip = new IPAddress(packet.Slice(rdataOffset, 16));
+                    if (!IPAddress.IsLoopback(ip) && !ip.IsIPv6LinkLocal)
+                    {
+                        ipv6ByHost[NormalizeDomain(rrName)] = ip.ToString();
+                    }
+
+                    break;
+                }
+                case TypeSrv when rdLen >= 6:
+                {
+                    var port = BinaryPrimitives.ReadUInt16BigEndian(packet[(rdataOffset + 4)..]);
+                    var targetCursor = rdataOffset + 6;
+                    if (port > 0 && TryReadName(packet, ref targetCursor, out var target))
+                    {
+                        srvRecords.Add((NormalizeDomain(rrName), NormalizeDomain(target), port, ttl));
+                    }
+
+                    break;
+                }
+                case TypeTxt when rdLen > 0:
+                {
+                    txtByFullName[NormalizeDomain(rrName)] = ParseTxtRecord(packet.Slice(rdataOffset, rdLen));
+                    break;
+                }
+                case TypePtr:
+                {
+                    // PTR maps service type -> instance name; SRV carries actual port + target.
+                    var ptrCursor = rdataOffset;
+                    _ = TryReadName(packet, ref ptrCursor, out _);
+                    break;
+                }
+            }
+        }
+
+        var services = new List<MdnsAdbService>();
+        foreach (var srv in srvRecords)
+        {
+            if (!TryClassifyServiceName(srv.FullName, out var kind, out var instanceName))
+            {
+                continue;
+            }
+
+            string? host = null;
+            if (ipv4ByHost.TryGetValue(srv.Target, out var v4))
+            {
+                host = v4;
+            }
+            else if (ipv6ByHost.TryGetValue(srv.Target, out var v6))
+            {
+                host = v6;
+            }
+            else if (senderAddress is not null && !IPAddress.IsLoopback(senderAddress))
+            {
+                host = senderAddress.IsIPv4MappedToIPv6 ? senderAddress.MapToIPv4().ToString() : senderAddress.ToString();
+            }
+
+            if (string.IsNullOrEmpty(host))
+            {
+                continue;
+            }
+
+            txtByFullName.TryGetValue(srv.FullName, out var props);
+            services.Add(new MdnsAdbService(kind, instanceName, host, srv.Port, props));
+        }
+
+        return services;
+    }
+
+    /// <summary>
+    /// Parses the output of <c>adb mdns services</c>, e.g.:
+    /// <c>adb-R5CT123-abc	_adb-tls-connect._tcp.	192.168.1.42:39123</c>.
+    /// </summary>
+    public static IReadOnlyList<MdnsAdbService> ParseAdbMdnsServicesOutput(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return [];
+        }
+
+        var list = new List<MdnsAdbService>();
+        foreach (var rawLine in text.Split('\n'))
+        {
+            var line = rawLine.Trim();
+            if (line.Length == 0 || line.StartsWith("List of discovered", StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            var m = AdbMdnsLineRegex().Match(line);
+            if (!m.Success)
+            {
+                continue;
+            }
+
+            var instance = m.Groups["inst"].Value.Trim();
+            var svcType = m.Groups["type"].Value.Trim().TrimEnd('.');
+            var host = m.Groups["host"].Value.Trim().Trim('[', ']');
+            if (!int.TryParse(m.Groups["port"].Value, System.Globalization.NumberStyles.None, System.Globalization.CultureInfo.InvariantCulture, out var port)
+                || port is <= 0 or > 65535)
+            {
+                continue;
+            }
+
+            MdnsAdbServiceKind? kind = svcType.ToLowerInvariant() switch
+            {
+                "_adb-tls-connect._tcp" => MdnsAdbServiceKind.TlsConnect,
+                "_adb-tls-pairing._tcp" => MdnsAdbServiceKind.TlsPairing,
+                "_adb._tcp" => MdnsAdbServiceKind.LegacyTcp,
+                _ => null,
+            };
+            if (kind is { } k)
+            {
+                list.Add(new MdnsAdbService(k, instance, host, port));
+            }
+        }
+
+        return list;
+    }
+
+    private static bool TryClassifyServiceName(string fullName, out MdnsAdbServiceKind kind, out string instanceName)
+    {
+        foreach (var (suffix, k) in new[]
+                 {
+                     ("._adb-tls-connect._tcp.local", MdnsAdbServiceKind.TlsConnect),
+                     ("._adb-tls-pairing._tcp.local", MdnsAdbServiceKind.TlsPairing),
+                     ("._adb._tcp.local", MdnsAdbServiceKind.LegacyTcp),
+                 })
+        {
+            if (fullName.EndsWith(suffix, StringComparison.OrdinalIgnoreCase) && fullName.Length > suffix.Length)
+            {
+                kind = k;
+                instanceName = fullName[..^suffix.Length];
+                return true;
+            }
+        }
+
+        kind = default;
+        instanceName = "";
+        return false;
+    }
+
+    private static Dictionary<string, string> ParseTxtRecord(ReadOnlySpan<byte> rdata)
+    {
+        var dict = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        var i = 0;
+        while (i < rdata.Length)
+        {
+            var len = rdata[i++];
+            if (len == 0 || i + len > rdata.Length)
+            {
+                break;
+            }
+
+            var entry = Encoding.UTF8.GetString(rdata.Slice(i, len));
+            i += len;
+            var eq = entry.IndexOf('=', StringComparison.Ordinal);
+            if (eq > 0)
+            {
+                dict[entry[..eq]] = entry[(eq + 1)..];
+            }
+        }
+
+        return dict;
+    }
+
+    private static void WriteDomainName(Stream stream, string domain)
+    {
+        foreach (var label in domain.Trim('.').Split('.', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var bytes = Encoding.UTF8.GetBytes(label);
+            if (bytes.Length is 0 or > 63)
+            {
+                throw new ArgumentException($"Invalid DNS label '{label}'.", nameof(domain));
+            }
+
+            stream.WriteByte((byte)bytes.Length);
+            stream.Write(bytes);
+        }
+
+        stream.WriteByte(0);
+    }
+
+    private static bool TryReadName(ReadOnlySpan<byte> packet, ref int offset, out string name)
+    {
+        name = "";
+        if (offset < 0 || offset >= packet.Length)
+        {
+            return false;
+        }
+
+        var sb = new StringBuilder();
+        var cursor = offset;
+        var jumped = false;
+        var nextOffset = offset;
+        var hops = 0;
+
+        while (true)
+        {
+            if (cursor < 0 || cursor >= packet.Length || ++hops > 64)
+            {
+                return false;
+            }
+
+            var len = packet[cursor];
+            if (len == 0)
+            {
+                if (!jumped)
+                {
+                    nextOffset = cursor + 1;
+                }
+
+                offset = nextOffset;
+                name = sb.ToString();
+                return true;
+            }
+
+            if ((len & 0xC0) == 0xC0)
+            {
+                if (cursor + 1 >= packet.Length)
+                {
+                    return false;
+                }
+
+                var pointer = ((len & 0x3F) << 8) | packet[cursor + 1];
+                if (!jumped)
+                {
+                    nextOffset = cursor + 2;
+                    jumped = true;
+                }
+
+                cursor = pointer;
+                continue;
+            }
+
+            if ((len & 0xC0) != 0 || cursor + 1 + len > packet.Length)
+            {
+                return false;
+            }
+
+            if (sb.Length > 0)
+            {
+                sb.Append('.');
+            }
+
+            sb.Append(Encoding.UTF8.GetString(packet.Slice(cursor + 1, len)));
+            cursor += 1 + len;
+        }
+    }
+
+    private static string NormalizeDomain(string name) => name.Trim().TrimEnd('.');
+
+    [GeneratedRegex(@"^(?<inst>\S+)\s+(?<type>_adb(?:-tls-(?:connect|pairing))?\._tcp\.?)\s+(?<host>\S+):(?<port>\d+)\s*$")]
+    private static partial Regex AdbMdnsLineRegex();
+}
diff --git a/src/ClickZen.Device/Input/PersistentRootInjector.cs b/src/ClickZen.Device/Input/PersistentRootInjector.cs
new file mode 100644
index 0000000..0c55f5c
--- /dev/null
+++ b/src/ClickZen.Device/Input/PersistentRootInjector.cs
@@ -0,0 +1,470 @@
+using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using ClickZen.Core;
+using ClickZen.Core.Geometry;
+using ClickZen.Core.Input;
+using ClickZen.Device.Adb;
+using Microsoft.Extensions.Logging;
+
+namespace ClickZen.Device.Input;
+
+/// <summary>
+/// High-speed root touch/key injector that keeps a single persistent <c>uid=0</c> shell open over an ADB socket
+/// (instead of spawning <c>su -c</c> per gesture) and paces binary <c>input_event</c> writes from the host monotonic
+/// clock. Cuts per-tap overhead from ~80–150 ms down to ~1–2 ms and bypasses ROM <c>INJECT_EVENTS</c> blocks.
+/// </summary>
+public sealed class PersistentRootInjector : ITouchInjector, IAsyncDisposable
+{
+    private const string ReadyMarker = "__CZ_ROOT_OK__";
+
+    private readonly Func<CancellationToken, Task<Stream>> _openRootStream;
+    private readonly RootSendeventInjector _fallback;
+    private readonly InputDeviceInfo _touch;
+    private readonly bool _rawEvents;
+    private readonly Func<int>? _displayId;
+    private readonly IClock _clock;
+    private readonly ILogger? _logger;
+    private readonly SemaphoreSlim _lock = new(1, 1);
+
+    private Stream? _stream;
+    private bool _disposed;
+
+    public PersistentRootInjector(
+        Func<CancellationToken, Task<Stream>> openRootStream,
+        RootSendeventInjector fallback,
+        InputDeviceInfo touch,
+        bool rawEvents,
+        Func<int>? displayId = null,
+        IClock? clock = null,
+        ILogger? logger = null)
+    {
+        _openRootStream = openRootStream ?? throw new ArgumentNullException(nameof(openRootStream));
+        _fallback = fallback ?? throw new ArgumentNullException(nameof(fallback));
+        _touch = touch ?? throw new ArgumentNullException(nameof(touch));
+        _rawEvents = rawEvents;
+        _displayId = displayId;
+        _clock = clock ?? SystemClock.Instance;
+        _logger = logger;
+    }
+
+    /// <summary>Creates a <see cref="PersistentRootInjector"/> backed by <paramref name="adbEndpoint"/> (<c>127.0.0.1:5037</c>).</summary>
+    public static PersistentRootInjector ForAdbSocket(
+        EndPoint adbEndpoint,
+        string serial,
+        RootSendeventInjector fallback,
+        InputDeviceInfo touch,
+        bool rawEvents,
+        Func<int>? displayId = null,
+        IClock? clock = null,
+        ILogger? logger = null)
+    {
+        ArgumentNullException.ThrowIfNull(adbEndpoint);
+        ArgumentException.ThrowIfNullOrEmpty(serial);
+        return new PersistentRootInjector(
+            ct => OpenAdbRootShellStreamAsync(adbEndpoint, serial, ct),
+            fallback,
+            touch,
+            rawEvents,
+            displayId,
+            clock,
+            logger);
+    }
+
+    public string Name => _rawEvents ? "root (persistent)" : "root (persistent sendevent)";
+
+    public bool SupportsMultiTouch => _fallback.SupportsMultiTouch;
+
+    public Task TapAsync(PointI point, int durationMs, CancellationToken ct) =>
+        PlayFingersAsync([[new TimedPoint(point.X, point.Y, 0), new TimedPoint(point.X, point.Y, Math.Max(1, durationMs))]], ct);
+
+    public Task StrokeAsync(IReadOnlyList<TimedPoint> path, CancellationToken ct) =>
+        path.Count == 0 ? Task.CompletedTask : PlayFingersAsync([path], ct);
+
+    public Task MultiStrokeAsync(IReadOnlyList<IReadOnlyList<TimedPoint>> fingers, CancellationToken ct)
+    {
+        var usable = fingers.Where(f => f.Count > 0).Take(SupportsMultiTouch ? _touch.MaxSlot + 1 : 1).ToArray();
+        return usable.Length == 0 ? Task.CompletedTask : PlayFingersAsync(usable, ct);
+    }
+
+    public async Task KeyAsync(int keyCode, CancellationToken ct)
+    {
+        var prefix = DisplayPrefix();
+        var cmd = $"{prefix}keyevent {keyCode.ToString(CultureInfo.InvariantCulture)}\n";
+        if (!await TryWriteCommandAsync(cmd, ct))
+        {
+            await _fallback.KeyAsync(keyCode, ct);
+        }
+    }
+
+    public async Task TextAsync(string text, CancellationToken ct)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return;
+        }
+
+        var prefix = DisplayPrefix();
+        var cmd = $"{prefix}text {AdbInputInjector.EscapeInputText(text)}\n";
+        if (!await TryWriteCommandAsync(cmd, ct))
+        {
+            await _fallback.TextAsync(text, ct);
+        }
+    }
+
+    private string DisplayPrefix()
+    {
+        var d = _displayId?.Invoke() ?? 0;
+        return d > 0 ? $"input -d {d.ToString(CultureInfo.InvariantCulture)} " : "input ";
+    }
+
+    private async Task PlayFingersAsync(IReadOnlyList<IReadOnlyList<TimedPoint>> fingers, CancellationToken ct)
+    {
+        await _lock.WaitAsync(ct);
+        try
+        {
+            var stream = await EnsureStreamCoreAsync(ct);
+            if (stream is null)
+            {
+                await _fallback.MultiStrokeAsync(fingers, ct);
+                return;
+            }
+
+            try
+            {
+                await StreamTimelineAsync(stream, fingers, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Ensure no touch slot remains held down in the kernel input device when cancelled mid-gesture.
+                await ReleaseAllSlotsQuietlyAsync(stream, fingers.Count);
+                throw;
+            }
+            catch (Exception ex) when (ex is IOException or SocketException or ObjectDisposedException)
+            {
+                _logger?.LogDebug(ex, "Persistent root shell dropped during gesture; falling back and resetting stream");
+                await CloseStreamCoreAsync();
+                await _fallback.MultiStrokeAsync(fingers, ct);
+            }
+        }
+        finally
+        {
+            _lock.Release();
+        }
+    }
+
+    private async Task StreamTimelineAsync(Stream stream, IReadOnlyList<IReadOnlyList<TimedPoint>> fingers, CancellationToken ct)
+    {
+        var sb = new StringBuilder(256);
+        foreach (var item in _fallback.Timeline(fingers))
+        {
+            if (item.SleepMs > 0)
+            {
+                await _clock.DelayAsync(TimeSpan.FromMilliseconds(item.SleepMs), ct);
+                continue;
+            }
+
+            sb.Clear();
+            FormatBatchCommand(sb, item.Events);
+            var bytes = Encoding.ASCII.GetBytes(sb.ToString());
+            await stream.WriteAsync(bytes, ct);
+            await stream.FlushAsync(ct);
+        }
+    }
+
+    internal void FormatBatchCommand(StringBuilder sb, IReadOnlyList<(int Type, int Code, int Value)> events)
+    {
+        if (_rawEvents)
+        {
+            sb.Append("print -n \"");
+            foreach (var (type, code, value) in events)
+            {
+                sb.Append("$z");
+                AppendLe(sb, type, 2);
+                AppendLe(sb, code, 2);
+                AppendLe(sb, value, 4);
+            }
+
+            sb.Append("\">&4\n");
+            return;
+        }
+
+        for (var i = 0; i < events.Count; i++)
+        {
+            if (i > 0)
+            {
+                sb.Append(';');
+            }
+
+            var (type, code, value) = events[i];
+            sb.Append(CultureInfo.InvariantCulture, $"sendevent {_touch.Path} {type} {code} {value}");
+        }
+
+        sb.Append('\n');
+    }
+
+    private async Task ReleaseAllSlotsQuietlyAsync(Stream stream, int fingerCount)
+    {
+        try
+        {
+            var cleanup = new List<(int Type, int Code, int Value)>();
+            var slots = Math.Max(1, fingerCount);
+            for (var s = 0; s < slots; s++)
+            {
+                if (_touch.HasSlots)
+                {
+                    cleanup.Add((3, InputDeviceInfo.AbsMtSlot, s));
+                }
+
+                cleanup.Add((3, InputDeviceInfo.AbsMtTrackingId, -1));
+            }
+
+            if (_touch.Keys.Contains(InputDeviceInfo.BtnTouch))
+            {
+                cleanup.Add((1, InputDeviceInfo.BtnTouch, 0));
+            }
+
+            cleanup.Add((0, 0, 0)); // SYN_REPORT
+            var sb = new StringBuilder(128);
+            FormatBatchCommand(sb, cleanup);
+            var bytes = Encoding.ASCII.GetBytes(sb.ToString());
+            await stream.WriteAsync(bytes, CancellationToken.None);
+            await stream.FlushAsync(CancellationToken.None);
+        }
+        catch (Exception)
+        {
+        }
+    }
+
+    private async Task<bool> TryWriteCommandAsync(string command, CancellationToken ct)
+    {
+        await _lock.WaitAsync(ct);
+        try
+        {
+            var stream = await EnsureStreamCoreAsync(ct);
+            if (stream is null)
+            {
+                return false;
+            }
+
+            try
+            {
+                var bytes = Encoding.UTF8.GetBytes(command);
+                await stream.WriteAsync(bytes, ct);
+                await stream.FlushAsync(ct);
+                return true;
+            }
+            catch (Exception ex) when (ex is IOException or SocketException or ObjectDisposedException)
+            {
+                await CloseStreamCoreAsync();
+                return false;
+            }
+        }
+        finally
+        {
+            _lock.Release();
+        }
+    }
+
+    private async Task<Stream?> EnsureStreamCoreAsync(CancellationToken ct)
+    {
+        if (_disposed)
+        {
+            return null;
+        }
+
+        if (_stream is not null)
+        {
+            return _stream;
+        }
+
+        try
+        {
+            var stream = await _openRootStream(ct);
+            var init = _rawEvents
+                ? $"z='\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0';exec 4>{_touch.Path} && echo {ReadyMarker}$(id -u)\n"
+                : $"echo {ReadyMarker}$(id -u)\n";
+            var initBytes = Encoding.ASCII.GetBytes(init);
+            await stream.WriteAsync(initBytes, ct);
+            await stream.FlushAsync(ct);
+
+            using var verifyCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            verifyCts.CancelAfter(TimeSpan.FromSeconds(4));
+            if (!await WaitForReadyBannerAsync(stream, verifyCts.Token))
+            {
+                await stream.DisposeAsync();
+                return null;
+            }
+
+            // Drain any subsequent stdout asynchronously so the kernel pipe never fills up.
+            _ = DrainStdoutAsync(stream);
+            _stream = stream;
+            return stream;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException || !ct.IsCancellationRequested)
+        {
+            _logger?.LogDebug(ex, "Could not open persistent root shell; using per-command fallback");
+            return null;
+        }
+    }
+
+    private static async Task<bool> WaitForReadyBannerAsync(Stream stream, CancellationToken ct)
+    {
+        var buf = new byte[256];
+        var acc = new StringBuilder();
+        while (acc.Length < 4096)
+        {
+            var n = await stream.ReadAsync(buf, ct);
+            if (n <= 0)
+            {
+                return false;
+            }
+
+            acc.Append(Encoding.UTF8.GetString(buf.AsSpan(0, n)));
+            var s = acc.ToString();
+            var idx = s.IndexOf(ReadyMarker, StringComparison.Ordinal);
+            if (idx >= 0)
+            {
+                var after = s[(idx + ReadyMarker.Length)..];
+                if (after.StartsWith("0\n", StringComparison.Ordinal) || after.StartsWith("0\r", StringComparison.Ordinal))
+                {
+                    return true;
+                }
+
+                if (after.Contains('\n', StringComparison.Ordinal))
+                {
+                    return false;
+                }
+            }
+
+            if (s.Contains("Permission denied", StringComparison.OrdinalIgnoreCase)
+                || s.Contains("not found", StringComparison.OrdinalIgnoreCase))
+            {
+                return false;
+            }
+        }
+
+        return false;
+    }
+
+    private static async Task DrainStdoutAsync(Stream stream)
+    {
+        var discard = new byte[512];
+        try
+        {
+            while (await stream.ReadAsync(discard, CancellationToken.None) > 0)
+            {
+            }
+        }
+        catch (Exception)
+        {
+        }
+    }
+
+    private async Task CloseStreamCoreAsync()
+    {
+        var s = _stream;
+        _stream = null;
+        if (s is not null)
+        {
+            try
+            {
+                await s.DisposeAsync();
+            }
+            catch (Exception)
+            {
+            }
+        }
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _disposed = true;
+        await _lock.WaitAsync();
+        try
+        {
+            if (_stream is { } s)
+            {
+                try
+                {
+                    var exit = Encoding.ASCII.GetBytes("exec 4>&- 2>/dev/null; exit\n");
+                    await s.WriteAsync(exit, CancellationToken.None);
+                    await s.FlushAsync(CancellationToken.None);
+                }
+                catch (Exception)
+                {
+                }
+            }
+
+            await CloseStreamCoreAsync();
+        }
+        finally
+        {
+            _lock.Release();
+            _lock.Dispose();
+        }
+    }
+
+    private static async Task<Stream> OpenAdbRootShellStreamAsync(EndPoint adbEndpoint, string serial, CancellationToken ct)
+    {
+        // Try standard Magisk/KernelSU/SuperSU `su` first, then AOSP `su 0 sh` on userdebug images.
+        foreach (var shellCmd in new[] { "shell:su", "shell:su 0 sh" })
+        {
+            Socket? tcp = null;
+            try
+            {
+                tcp = new Socket(adbEndpoint.AddressFamily, SocketType.Stream, ProtocolType.Tcp) { NoDelay = true };
+                await tcp.ConnectAsync(adbEndpoint, ct);
+                var net = new NetworkStream(tcp, ownsSocket: true);
+                tcp = null;
+
+                await SendAdbFrameAsync(net, $"host:transport:{serial}", ct);
+                await ExpectOkayAsync(net, ct);
+                await SendAdbFrameAsync(net, shellCmd, ct);
+                await ExpectOkayAsync(net, ct);
+                return net;
+            }
+            catch (Exception)
+            {
+                tcp?.Dispose();
+            }
+        }
+
+        throw new IOException($"Could not open persistent root ADB shell for {serial}.");
+    }
+
+    private static async Task SendAdbFrameAsync(Stream stream, string payload, CancellationToken ct)
+    {
+        var body = Encoding.UTF8.GetBytes(payload);
+        var header = Encoding.ASCII.GetBytes(body.Length.ToString("x4", CultureInfo.InvariantCulture));
+        await stream.WriteAsync(header, ct);
+        await stream.WriteAsync(body, ct);
+        await stream.FlushAsync(ct);
+    }
+
+    private static async Task ExpectOkayAsync(Stream stream, CancellationToken ct)
+    {
+        var status = new byte[4];
+        await stream.ReadExactlyAsync(status, ct);
+        if (status[0] != (byte)'O' || status[1] != (byte)'K' || status[2] != (byte)'A' || status[3] != (byte)'Y')
+        {
+            throw new IOException("ADB server rejected shell request.");
+        }
+    }
+
+    private static void AppendLe(StringBuilder sb, int value, int bytes)
+    {
+        var u = unchecked((uint)value);
+        for (var i = 0; i < bytes; i++)
+        {
+            var b = (u >> (8 * i)) & 0xFF;
+            sb.Append(b == 0 ? "\\0" : string.Create(CultureInfo.InvariantCulture, $"\\x{b:x2}"));
+        }
+    }
+}
diff --git a/src/ClickZen.Device/Scrcpy/Protocol/ControlMessageWriter.cs b/src/ClickZen.Device/Scrcpy/Protocol/ControlMessageWriter.cs
index 65ac391..971b137 100644
--- a/src/ClickZen.Device/Scrcpy/Protocol/ControlMessageWriter.cs
+++ b/src/ClickZen.Device/Scrcpy/Protocol/ControlMessageWriter.cs
@@ -18,6 +18,12 @@ public enum ControlMessageType : byte
     SetClipboard = 9,
     SetDisplayPower = 10,
     RotateDevice = 11,
+    UhidCreate = 12,
+    UhidInput = 13,
+    UhidDestroy = 14,
+    OpenHardKeyboardSettings = 15,
+    StartApp = 16,
+    ResetVideo = 17,
 }
 
 /// <summary>Android <c>KeyEvent</c> actions.</summary>
@@ -51,6 +57,21 @@ public static class ControlMessageWriter
 
     public const int ButtonPrimary = 1;
 
+    /// <summary>UHID device id scrcpy uses for its virtual USB keyboard (<c>SC_HID_ID_KEYBOARD = 1</c>).</summary>
+    public const ushort DefaultKeyboardUhidId = 1;
+
+    /// <summary>Standard 63-byte USB HID Boot Keyboard report descriptor from scrcpy (<c>app/src/hid/hid_keyboard.c</c>).</summary>
+    public static ReadOnlySpan<byte> HidKeyboardReportDescriptor =>
+    [
+        0x05, 0x01, 0x09, 0x06, 0xA1, 0x01,
+        0x05, 0x07, 0x19, 0xE0, 0x29, 0xE7, 0x15, 0x00, 0x25, 0x01, 0x75, 0x01, 0x95, 0x08, 0x81, 0x02,
+        0x75, 0x08, 0x95, 0x01, 0x81, 0x01,
+        0x05, 0x08, 0x19, 0x01, 0x29, 0x05, 0x75, 0x01, 0x95, 0x05, 0x91, 0x02,
+        0x75, 0x03, 0x95, 0x01, 0x91, 0x01,
+        0x05, 0x07, 0x19, 0x00, 0x29, 0x65, 0x15, 0x00, 0x25, 0x65, 0x75, 0x08, 0x95, 0x06, 0x81, 0x00,
+        0xC0,
+    ];
+
     /// <summary>INJECT_KEYCODE – 14 bytes.</summary>
     public static int WriteKeycode(Span<byte> buf, KeyAction action, int keycode, int repeat = 0, int metaState = 0)
     {
@@ -120,11 +141,12 @@ public static int WriteSetDisplayPower(Span<byte> buf, bool on)
         return 2;
     }
 
-    /// <summary>Single-byte messages: panels, rotate.</summary>
+    /// <summary>Single-byte messages: panels, rotate, hard keyboard settings, reset video.</summary>
     public static int WriteSimple(Span<byte> buf, ControlMessageType type)
     {
         if (type is not (ControlMessageType.ExpandNotificationPanel or ControlMessageType.ExpandSettingsPanel
-            or ControlMessageType.CollapsePanels or ControlMessageType.RotateDevice))
+            or ControlMessageType.CollapsePanels or ControlMessageType.RotateDevice
+            or ControlMessageType.OpenHardKeyboardSettings or ControlMessageType.ResetVideo))
         {
             throw new ArgumentOutOfRangeException(nameof(type), type, "Not a payload-less message.");
         }
@@ -133,6 +155,37 @@ public static int WriteSimple(Span<byte> buf, ControlMessageType type)
         return 1;
     }
 
+    /// <summary>
+    /// UHID_CREATE – registers a virtual USB HID keyboard in Android (<c>/dev/uhid</c>), causing Android to treat
+    /// a physical keyboard as attached and suppress the soft on-screen IME popup.
+    /// Layout: type(1) + id(2) + vendorId(2) + productId(2) + nameLen(1) + name + descLen(2) + desc.
+    /// </summary>
+    public static int WriteUhidCreateKeyboard(Span<byte> buf, ushort id = DefaultKeyboardUhidId, string name = "ClickZen")
+    {
+        var nameBytes = Encoding.UTF8.GetBytes(name ?? "");
+        var nameLen = Utf8TruncationIndex(nameBytes, 127);
+        var desc = HidKeyboardReportDescriptor;
+
+        buf[0] = (byte)ControlMessageType.UhidCreate;
+        BinaryPrimitives.WriteUInt16BigEndian(buf[1..], id);
+        BinaryPrimitives.WriteUInt16BigEndian(buf[3..], 0); // vendorId
+        BinaryPrimitives.WriteUInt16BigEndian(buf[5..], 0); // productId
+        buf[7] = (byte)nameLen;
+        nameBytes.AsSpan(0, nameLen).CopyTo(buf[8..]);
+        var descOffset = 8 + nameLen;
+        BinaryPrimitives.WriteUInt16BigEndian(buf[descOffset..], (ushort)desc.Length);
+        desc.CopyTo(buf[(descOffset + 2)..]);
+        return descOffset + 2 + desc.Length;
+    }
+
+    /// <summary>UHID_DESTROY – 3 bytes (<c>type + u16 id</c>). Removes the virtual UHID device so soft IME returns.</summary>
+    public static int WriteUhidDestroy(Span<byte> buf, ushort id = DefaultKeyboardUhidId)
+    {
+        buf[0] = (byte)ControlMessageType.UhidDestroy;
+        BinaryPrimitives.WriteUInt16BigEndian(buf[1..], id);
+        return 3;
+    }
+
     private static void WritePosition(Span<byte> buf, int x, int y, int w, int h)
     {
         BinaryPrimitives.WriteInt32BigEndian(buf, x);
diff --git a/src/ClickZen.Device/Scrcpy/ScrcpySession.cs b/src/ClickZen.Device/Scrcpy/ScrcpySession.cs
index a4007fc..dac3871 100644
--- a/src/ClickZen.Device/Scrcpy/ScrcpySession.cs
+++ b/src/ClickZen.Device/Scrcpy/ScrcpySession.cs
@@ -31,6 +31,7 @@ public sealed record ScrcpySessionOptions
     public int MaxFps { get; init; } = 60;
     public bool StayAwake { get; init; } = true;
     public bool ShowTouches { get; init; }
+    public bool SuppressSoftKeyboard { get; init; }
     public bool AutoReconnect { get; init; } = true;
     public TimeSpan MaxBackoff { get; init; } = TimeSpan.FromSeconds(30);
 }
@@ -53,6 +54,8 @@ public sealed class ScrcpySession : ILiveFrameSource, IAsyncDisposable
     private CancellationTokenSource? _attemptCts;
     private volatile int _displayId;
     private volatile bool _switchingDisplay;
+    private volatile bool _suppressSoftKeyboard;
+    private volatile bool _inputRejected;
     private Frame? _latest;
     private long _sequence;
     private TaskCompletionSource _frameSignal = new(TaskCreationOptions.RunContinuationsAsynchronously);
@@ -70,6 +73,7 @@ public ScrcpySession(string serial, IScrcpyTransport transport, ScrcpySessionOpt
         _transport = transport;
         _options = options ?? new ScrcpySessionOptions();
         _displayId = Math.Max(0, _options.DisplayId);
+        _suppressSoftKeyboard = _options.SuppressSoftKeyboard;
         _logger = logger;
         _clock = clock ?? SystemClock.Instance;
         Injector = new ScrcpyTouchInjector(SendAsync, () => _videoSize, () => DeviceSize, _clock);
@@ -122,11 +126,34 @@ private set
 
     public string? LastError { get; private set; }
 
+    /// <summary>True when Android rejected scrcpy control injection (<c>INJECT_EVENTS</c> / ROM security restriction).</summary>
+    public bool IsInputRejected => _inputRejected;
+
     /// <summary>Frames per second over the last second.</summary>
     public double Fps { get; private set; }
 
     public event EventHandler<SessionState>? StateChanged;
 
+    /// <summary>Raised when scrcpy-server reports that Android rejected input events.</summary>
+    public event EventHandler<string>? InputRejected;
+
+    /// <summary>Toggles virtual UHID keyboard registration on the live session so Android suppresses or restores soft IME.</summary>
+    public async Task SetSuppressSoftKeyboardAsync(bool enabled, CancellationToken ct = default)
+    {
+        _suppressSoftKeyboard = enabled;
+        if (_connection is not null && !_inputRejected)
+        {
+            try
+            {
+                await Injector.SetHardwareKeyboardAsync(enabled, ct);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                _logger?.LogDebug(ex, "UHID keyboard toggle ({Enabled}) ignored on {Serial}", enabled, Serial);
+            }
+        }
+    }
+
     /// <summary>Raised on the decode thread for every new frame.</summary>
     public event EventHandler<Frame>? FrameArrived;
 
@@ -252,11 +279,32 @@ private async Task RunAsync(TaskCompletionSource firstAttempt, CancellationToken
                     ShowTouches = _options.ShowTouches,
                 };
                 started = await _transport.StartAsync(Serial, options, attemptCts.Token);
+                started.InputRejected += reason =>
+                {
+                    if (!_inputRejected)
+                    {
+                        _inputRejected = true;
+                        _logger?.LogWarning("scrcpy control input rejected on {Serial}: {Reason}", Serial, reason);
+                        InputRejected?.Invoke(this, reason);
+                    }
+                };
                 _connection = started.Connection;
                 DeviceName = started.Connection.DeviceName;
                 LastError = null;
                 backoff = TimeSpan.FromSeconds(1);
                 State = started.Connection.HasVideo ? SessionState.Streaming : SessionState.Connected;
+                if (_suppressSoftKeyboard)
+                {
+                    try
+                    {
+                        await Injector.SetHardwareKeyboardAsync(true, attemptCts.Token);
+                    }
+                    catch (Exception ex) when (ex is not OperationCanceledException)
+                    {
+                        _logger?.LogDebug(ex, "Could not register UHID keyboard on {Serial}", Serial);
+                    }
+                }
+
                 firstAttempt.TrySetResult();
                 _logger?.LogInformation("scrcpy session for {Serial} ({Name}) connected on display {DisplayId}, video={Video}",
                     Serial, DeviceName, targetDisplay, started.Connection.HasVideo);
@@ -437,7 +485,7 @@ private Task SendAsync(Func<byte[], int> write, CancellationToken ct)
         return c.SendAsync(write, ct);
     }
 
-    public bool IsControlAvailable => _connection is not null;
+    public bool IsControlAvailable => _connection is not null && !_inputRejected;
 
     public async ValueTask DisposeAsync()
     {
diff --git a/src/ClickZen.Device/Scrcpy/ScrcpyTouchInjector.cs b/src/ClickZen.Device/Scrcpy/ScrcpyTouchInjector.cs
index 117d2bc..f6110b7 100644
--- a/src/ClickZen.Device/Scrcpy/ScrcpyTouchInjector.cs
+++ b/src/ClickZen.Device/Scrcpy/ScrcpyTouchInjector.cs
@@ -82,14 +82,57 @@ public async Task MultiStrokeAsync(IReadOnlyList<IReadOnlyList<TimedPoint>> fing
         }
     }
 
+    private long _clipboardSeq;
+
     public async Task KeyAsync(int keyCode, CancellationToken ct)
     {
         await _send(b => ControlMessageWriter.WriteKeycode(b, KeyAction.Down, keyCode), ct);
         await _send(b => ControlMessageWriter.WriteKeycode(b, KeyAction.Up, keyCode), CancellationToken.None);
     }
 
-    public Task TextAsync(string text, CancellationToken ct) =>
-        string.IsNullOrEmpty(text) ? Task.CompletedTask : _send(b => ControlMessageWriter.WriteText(b, text), ct);
+    /// <summary>
+    /// Injects text: pure printable ASCII within <see cref="ControlMessageWriter.InjectTextMaxLength"/> uses
+    /// <c>INJECT_TEXT</c>; non-ASCII text (Chinese/CJK/emoji) or longer strings automatically use
+    /// <c>SET_CLIPBOARD(paste: true)</c> so all Unicode characters land reliably on screen.
+    /// </summary>
+    public Task TextAsync(string text, CancellationToken ct)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return Task.CompletedTask;
+        }
+
+        if (RequiresClipboardPaste(text))
+        {
+            return SetClipboardAsync(text, paste: true, ct);
+        }
+
+        return _send(b => ControlMessageWriter.WriteText(b, text), ct);
+    }
+
+    /// <summary>True when <c>INJECT_TEXT</c> cannot represent <paramref name="text"/> losslessly (non-ASCII or &gt; 300 UTF-8 bytes).</summary>
+    public static bool RequiresClipboardPaste(string text)
+    {
+        if (string.IsNullOrEmpty(text))
+        {
+            return false;
+        }
+
+        if (System.Text.Encoding.UTF8.GetByteCount(text) > ControlMessageWriter.InjectTextMaxLength)
+        {
+            return true;
+        }
+
+        foreach (var ch in text)
+        {
+            if (ch > 0x7E || (ch < 0x20 && ch is not ('\n' or '\t')))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
 
     /// <summary>Mouse-wheel style scroll at a device point.</summary>
     public Task ScrollAsync(PointI point, float hscroll, float vscroll, CancellationToken ct)
@@ -104,8 +147,22 @@ public Task ScrollAsync(PointI point, float hscroll, float vscroll, Cancellation
 
     public Task RotateAsync(CancellationToken ct) => _send(b => ControlMessageWriter.WriteSimple(b, ControlMessageType.RotateDevice), ct);
 
-    public Task SetClipboardAsync(string text, bool paste, CancellationToken ct) =>
-        _send(b => ControlMessageWriter.WriteSetClipboard(b, Environment.TickCount64, paste, text), ct);
+    public Task SetClipboardAsync(string text, bool paste, CancellationToken ct)
+    {
+        var seq = Interlocked.Increment(ref _clipboardSeq);
+        if (seq <= 0)
+        {
+            seq = Math.Max(1, Environment.TickCount64);
+        }
+
+        return _send(b => ControlMessageWriter.WriteSetClipboard(b, seq, paste, text), ct);
+    }
+
+    /// <summary>Toggles a virtual UHID USB keyboard on the device so Android hides (or restores) the soft on-screen keyboard.</summary>
+    public Task SetHardwareKeyboardAsync(bool enabled, CancellationToken ct) =>
+        enabled
+            ? _send(b => ControlMessageWriter.WriteUhidCreateKeyboard(b), ct)
+            : _send(b => ControlMessageWriter.WriteUhidDestroy(b), ct);
 
     /// <summary>Low-level: one raw touch event (used by the mirror view for live input).</summary>
     public Task SendRawTouchAsync(MotionAction action, int pointerId, PointI devicePoint, CancellationToken ct) =>
diff --git a/src/ClickZen.Device/Scrcpy/ScrcpyTransport.cs b/src/ClickZen.Device/Scrcpy/ScrcpyTransport.cs
index 62c57f3..7470634 100644
--- a/src/ClickZen.Device/Scrcpy/ScrcpyTransport.cs
+++ b/src/ClickZen.Device/Scrcpy/ScrcpyTransport.cs
@@ -36,6 +36,19 @@ public ScrcpyStartResult(ScrcpyConnection connection, Task serverExited, Func<Va
     /// <summary>Completes when the device-side server process ends.</summary>
     public Task ServerExited { get; }
 
+    /// <summary>Fired when scrcpy-server reports that Android rejected control input (<c>INJECT_EVENTS</c> / SecurityException).</summary>
+    public event Action<string>? InputRejected;
+
+    public void NotifyInputRejected(string reason) => InputRejected?.Invoke(reason);
+
+    /// <summary>Detects ROM security permission errors (Xiaomi HyperOS/MIUI, VIVO, OPPO) in scrcpy-server stdout.</summary>
+    public static bool IsInputPermissionError(string? line) =>
+        !string.IsNullOrEmpty(line)
+        && (line.Contains("INJECT_EVENTS", StringComparison.OrdinalIgnoreCase)
+            || line.Contains("Injecting input events requires", StringComparison.OrdinalIgnoreCase)
+            || (line.Contains("SecurityException", StringComparison.OrdinalIgnoreCase)
+                && line.Contains("inject", StringComparison.OrdinalIgnoreCase)));
+
     public async ValueTask DisposeAsync()
     {
         await Connection.DisposeAsync();
@@ -85,10 +98,17 @@ private async Task<ScrcpyStartResult> StartReverseAsync(string serial, ScrcpySer
         var remote = "localabstract:" + options.SocketName;
         var serverCts = new CancellationTokenSource();
         Task? server = null;
+        ScrcpyStartResult? result = null;
         try
         {
             await _adb.CreateReverseAsync(serial, remote, $"tcp:{port}", ct: ct);
-            server = RunServerAsync(serial, options, serverCts.Token);
+            server = RunServerAsync(serial, options, line =>
+            {
+                if (ScrcpyStartResult.IsInputPermissionError(line))
+                {
+                    result?.NotifyInputRejected(line);
+                }
+            }, serverCts.Token);
 
             using var timeout = CancellationTokenSource.CreateLinkedTokenSource(ct);
             timeout.CancelAfter(ConnectTimeout);
@@ -101,13 +121,14 @@ private async Task<ScrcpyStartResult> StartReverseAsync(string serial, ScrcpySer
 
             var connection = await accept;
             listener.Stop();
-            return new ScrcpyStartResult(connection, server, async () =>
+            result = new ScrcpyStartResult(connection, server, async () =>
             {
                 await serverCts.CancelAsync();
                 await IgnoreErrors(_adb.RemoveReverseAsync(serial, remote, CancellationToken.None));
                 await IgnoreErrors(server);
                 serverCts.Dispose();
             });
+            return result;
         }
         catch
         {
@@ -129,19 +150,27 @@ private async Task<ScrcpyStartResult> StartForwardAsync(string serial, ScrcpySer
         var serverCts = new CancellationTokenSource();
         var port = 0;
         Task? server = null;
+        ScrcpyStartResult? result = null;
         try
         {
             port = await _adb.CreateForwardAsync(serial, "tcp:0", "localabstract:" + options.SocketName, ct: ct);
-            server = RunServerAsync(serial, options, serverCts.Token);
+            server = RunServerAsync(serial, options, line =>
+            {
+                if (ScrcpyStartResult.IsInputPermissionError(line))
+                {
+                    result?.NotifyInputRejected(line);
+                }
+            }, serverCts.Token);
             var connection = await ScrcpyConnection.ConnectAsync(new IPEndPoint(IPAddress.Loopback, port), options.Video, ConnectTimeout, ct);
             var p = port;
-            return new ScrcpyStartResult(connection, server, async () =>
+            result = new ScrcpyStartResult(connection, server, async () =>
             {
                 await serverCts.CancelAsync();
                 await IgnoreErrors(_adb.RemoveForwardAsync(serial, p, CancellationToken.None));
                 await IgnoreErrors(server);
                 serverCts.Dispose();
             });
+            return result;
         }
         catch
         {
@@ -161,7 +190,7 @@ private async Task<ScrcpyStartResult> StartForwardAsync(string serial, ScrcpySer
         }
     }
 
-    private Task RunServerAsync(string serial, ScrcpyServerOptions options, CancellationToken ct) =>
+    private Task RunServerAsync(string serial, ScrcpyServerOptions options, Action<string>? onLine, CancellationToken ct) =>
         Task.Run(async () =>
         {
             try
@@ -171,6 +200,7 @@ await _adb.ExecuteStreamingAsync(serial, options.BuildCommand(), line =>
                     if (!string.IsNullOrWhiteSpace(line))
                     {
                         _logger?.LogDebug("[scrcpy-server {Serial}] {Line}", serial, line);
+                        onLine?.Invoke(line);
                     }
                 }, ct);
             }
diff --git a/src/ClickZen.Mcp/ClickZenTools.cs b/src/ClickZen.Mcp/ClickZenTools.cs
index 7ab5934..87f1e62 100644
--- a/src/ClickZen.Mcp/ClickZenTools.cs
+++ b/src/ClickZen.Mcp/ClickZenTools.cs
@@ -153,6 +153,25 @@ public Task<string> BindEmulatorWindow(
         CancellationToken cancellationToken = default) => Run(async ct =>
         McpJson.Serialize(await B.BindEmulatorWindowAsync(emulator, ct)), cancellationToken);
 
+    [McpServerTool(Name = "discover_lan_devices", Title = "Discover LAN Android devices", ReadOnly = true, Idempotent = true, Destructive = false, OpenWorld = false)]
+    [McpCapability(McpCapability.Observe)]
+    [Description("Discovers Android devices on the local network advertising Wireless Debugging (_adb-tls-connect._tcp / _adb-tls-pairing._tcp) or legacy TCP ADB (_adb._tcp) via mDNS / DNS-SD. Useful when an Android 11+ phone's Wireless Debugging port changed after reconnecting to Wi-Fi.")]
+    public Task<string> DiscoverLanDevices(CancellationToken cancellationToken = default) => Run(async ct =>
+        McpJson.Serialize(await B.DiscoverLanDevicesAsync(ct)), cancellationToken);
+
+    [McpServerTool(Name = "enable_wireless_adb", Title = "Enable wireless ADB from USB", ReadOnly = false, Idempotent = true, Destructive = false, OpenWorld = false)]
+    [McpCapability(McpCapability.Observe)]
+    [Description("Switches a USB-connected Android device to wireless TCP/IP ADB mode (default port 5555), reads its Wi-Fi IP, connects over LAN, and optionally remembers it for automatic reconnection after unplugging USB.")]
+    public Task<string> EnableWirelessAdb(
+        [Description("USB device id or name from list_devices; omit for the current device.")] string? device = null,
+        [Description("TCP port to open on the phone (default 5555).")] int port = 5555,
+        [Description("Save this device for automatic wireless reconnection (default true).")] bool remember = true,
+        CancellationToken cancellationToken = default) => Run(async ct =>
+    {
+        var r = await B.EnableWirelessAdbAsync(device, Math.Clamp(port, 1024, 65535), remember, ct);
+        return r.Connected ? McpJson.Serialize(r) : throw new McpToolException(r.Message);
+    }, cancellationToken);
+
     [McpServerTool(Name = "take_screenshot", Title = "Take screenshot", ReadOnly = true, Idempotent = false, Destructive = false, OpenWorld = false)]
     [McpCapability(McpCapability.Observe)]
     [Description("Captures the device screen and returns it as an image (JPEG by default, scaled so the longest edge is maxSize). The text part tells how image pixels map to device pixels. To tap something seen on the image, pass its image coordinates to tap with refWidth/refHeight = the image size (full-screen screenshots only).")]
diff --git a/src/ClickZen.Mcp/IClickZenBackend.cs b/src/ClickZen.Mcp/IClickZenBackend.cs
index 54d5c55..1230152 100644
--- a/src/ClickZen.Mcp/IClickZenBackend.cs
+++ b/src/ClickZen.Mcp/IClickZenBackend.cs
@@ -184,6 +184,12 @@ public sealed record McpEmulatorConnect(bool Connected, string? Device, string M
 /// <param name="Method">How the Android screen was located ("aspectMatch", "renderWindow", "screenshotMatch", "edgeDetection", "clientArea").</param>
 public sealed record McpEmulatorBind(string WindowDevice, string Method, string? AdbDevice, int ScreenWidth, int ScreenHeight, string Message);
 
+/// <summary>An Android device discovered on the local network via mDNS / DNS-SD.</summary>
+public sealed record McpLanDevice(string Address, string Host, int Port, string Kind, string InstanceName);
+
+/// <summary>Outcome of enable_wireless_adb.</summary>
+public sealed record McpWirelessEnableResult(bool Connected, string Address, string Message, bool Saved);
+
 /// <summary>
 /// Everything the MCP tools need from ClickZen. <c>device</c> arguments are a device id from
 /// <see cref="ListDevicesAsync"/>, a display name, or null/empty for the current device.
@@ -204,6 +210,12 @@ public interface IClickZenBackend
     /// <summary>Binds a detected emulator's window as a window device (locates the Android screen automatically).</summary>
     Task<McpEmulatorBind> BindEmulatorWindowAsync(string? emulator, CancellationToken ct);
 
+    /// <summary>Discovers Android Wireless Debugging / TCP ADB services advertised on the LAN via mDNS.</summary>
+    Task<IReadOnlyList<McpLanDevice>> DiscoverLanDevicesAsync(CancellationToken ct);
+
+    /// <summary>Switches a USB-connected Android device to wireless TCP/IP ADB and connects to its LAN IP.</summary>
+    Task<McpWirelessEnableResult> EnableWirelessAdbAsync(string? device, int port, bool remember, CancellationToken ct);
+
     /// <summary>Starts mirroring (scrcpy session / window capture) if needed and waits for a picture.</summary>
     Task<McpDevice> ConnectAsync(string? device, CancellationToken ct);
 
diff --git a/tests/ClickZen.Core.Tests/Wireless/QrAndCredentialsTests.cs b/tests/ClickZen.Core.Tests/Wireless/QrAndCredentialsTests.cs
new file mode 100644
index 0000000..a4b4213
--- /dev/null
+++ b/tests/ClickZen.Core.Tests/Wireless/QrAndCredentialsTests.cs
@@ -0,0 +1,75 @@
+using System.Security.Cryptography;
+using System.Text;
+using ClickZen.Core.Wireless;
+
+namespace ClickZen.Core.Tests.Wireless;
+
+public sealed class QrAndCredentialsTests
+{
+    [Fact]
+    public void Random_credentials_generate_valid_android_adb_wifi_qr_payload_and_round_trip()
+    {
+        var creds = AdbWirelessQrCredentials.CreateRandom();
+
+        Assert.StartsWith("clickzen-", creds.ServiceName, StringComparison.Ordinal);
+        Assert.Equal(6, creds.Password.Length);
+        Assert.StartsWith("WIFI:T:ADB;S:", creds.Payload, StringComparison.Ordinal);
+        Assert.EndsWith(";;", creds.Payload, StringComparison.Ordinal);
+
+        Assert.True(AdbWirelessQrCredentials.TryParse(creds.Payload, out var parsed));
+        Assert.Equal(creds, parsed);
+    }
+
+    [Fact]
+    public void Credentials_escape_and_unescape_reserved_characters()
+    {
+        var creds = AdbWirelessQrCredentials.Create("cz;host:01", @"p\w,1""2");
+
+        Assert.Equal(@"WIFI:T:ADB;S:cz\;host\:01;P:p\\w\,1\""2;;", creds.Payload);
+        Assert.True(AdbWirelessQrCredentials.TryParse(creds.Payload, out var parsed));
+        Assert.NotNull(parsed);
+        Assert.Equal(creds.ServiceName, parsed.ServiceName);
+        Assert.Equal(creds.Password, parsed.Password);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("WIFI:T:WPA;S:home;P:123456;;")]
+    [InlineData("WIFI:T:ADB;S:;P:123456;;")]
+    public void Rejects_non_adb_or_incomplete_qr_payloads(string payload) =>
+        Assert.False(AdbWirelessQrCredentials.TryParse(payload, out _));
+
+    /// <summary>
+    /// Bit-for-bit ISO/IEC 18004 EC Level M golden module matrices verified against Nayuki QR-Code-generator
+    /// across all supported versions (1 through 6).
+    /// </summary>
+    [Theory]
+    [InlineData(1, "HELLO", "32fbc389880456d584e32bdf2c31372391c92f9f853e119a75bec5e14c380a23")]
+    [InlineData(2, "WIFI:T:ADB;S:c;P:123456;;", "46dd1079dcbab459dd9463d5cb8f671b1b110fe40f3e69df042ac3c21d7659e5")]
+    [InlineData(3, "WIFI:T:ADB;S:clickzen-a1b2c3d4;P:654321;;", "f9040d3d47c1b2135f3fe1eecaade9f2f946917827d822544c0bd6081b256e4c")]
+    [InlineData(4, "WIFI:T:ADB;S:clickzen-midlen0123;P:AbCdEfGh1234;;", "4a8b570736732d4801037c2edd5a9b82901110cb4703b4cec318db497598af8f")]
+    [InlineData(5, "https://github.com/Exmeaning/ClickZen/pull/6?feature=wireless-adb-qr-mdns-v5", "cbbe84520c0654d23b53f46ef54cb9438acd993c9efa17a189e4895e5f313fe2")]
+    [InlineData(6, "https://github.com/Exmeaning/ClickZen/releases/tag/v2.1.2?mode=lan-wireless-qr-verification-payload-v6", "c7dc9f21acd491376e2a06d211284e32fabab2c2537bbed2fabd728007723a50")]
+    public void Matches_iso18004_reference_module_matrix_across_versions_1_to_6(int expectedVersion, string payload, string expectedSha256)
+    {
+        var qr = QrCodeEncoder.Encode(payload);
+        Assert.Equal(expectedVersion, qr.Version);
+        Assert.Equal(17 + 4 * expectedVersion, qr.Size);
+
+        var sb = new StringBuilder(qr.Size * qr.Size);
+        for (var r = 0; r < qr.Size; r++)
+        {
+            for (var c = 0; c < qr.Size; c++)
+            {
+                sb.Append(qr[r, c] ? '1' : '0');
+            }
+        }
+
+        var actualHash = Convert.ToHexStringLower(SHA256.HashData(Encoding.ASCII.GetBytes(sb.ToString())));
+        Assert.Equal(expectedSha256, actualHash);
+    }
+
+    [Fact]
+    public void Qr_encoder_rejects_payloads_exceeding_version6_capacity() =>
+        Assert.Throws<ArgumentOutOfRangeException>(() => QrCodeEncoder.Encode(new string('A', 200)));
+}
diff --git a/tests/ClickZen.Device.Tests/Adb/WirelessMdnsAndCoordinatorTests.cs b/tests/ClickZen.Device.Tests/Adb/WirelessMdnsAndCoordinatorTests.cs
new file mode 100644
index 0000000..674e48a
--- /dev/null
+++ b/tests/ClickZen.Device.Tests/Adb/WirelessMdnsAndCoordinatorTests.cs
@@ -0,0 +1,265 @@
+using System.Buffers.Binary;
+using System.Net;
+using System.Text;
+using ClickZen.Core.Devices;
+using ClickZen.Core.Persistence;
+using ClickZen.Core.Wireless;
+using ClickZen.Device.Adb;
+using ClickZen.Device.Adb.Wireless;
+
+namespace ClickZen.Device.Tests.Adb;
+
+public sealed class WirelessMdnsAndCoordinatorTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), "cz-mdns-" + Guid.NewGuid().ToString("N"));
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_root))
+        {
+            Directory.Delete(_root, recursive: true);
+        }
+    }
+
+    private sealed class FakeMdnsDiscovery(Func<int, IReadOnlyList<MdnsAdbService>> responder) : IAdbMdnsDiscovery
+    {
+        private int _calls;
+
+        public Task<IReadOnlyList<MdnsAdbService>> DiscoverAsync(TimeSpan duration, CancellationToken ct = default)
+        {
+            ct.ThrowIfCancellationRequested();
+            var idx = Interlocked.Increment(ref _calls);
+            return Task.FromResult(responder(idx));
+        }
+    }
+
+    [Fact]
+    public void Builds_valid_mdns_query_and_parses_dns_sd_srv_and_a_records()
+    {
+        var query = MdnsPacket.BuildPtrQuery(unicastResponse: false);
+        Assert.Equal(0, BinaryPrimitives.ReadUInt16BigEndian(query.AsSpan(0, 2)));
+        Assert.Equal(3, BinaryPrimitives.ReadUInt16BigEndian(query.AsSpan(4, 2))); // 3 PTR questions
+
+        var resp = BuildSyntheticMdnsResponse(
+            instance: "clickzen-abc123",
+            service: "_adb-tls-pairing._tcp.local",
+            targetHost: "pixel8.local",
+            port: 39123,
+            ip: IPAddress.Parse("192.168.1.77"));
+
+        var parsed = MdnsPacket.ParseMessage(resp, IPAddress.Parse("192.168.1.1"));
+        var svc = Assert.Single(parsed);
+        Assert.Equal("clickzen-abc123", svc.InstanceName);
+        Assert.Equal(MdnsAdbServiceKind.TlsPairing, svc.Kind);
+        Assert.Equal("192.168.1.77", svc.Host);
+        Assert.Equal(39123, svc.Port);
+        Assert.Equal("192.168.1.77:39123", svc.Address);
+    }
+
+    [Fact]
+    public void Parses_adb_mdns_services_cli_output()
+    {
+        const string sample = """
+            List of discovered mdns services
+            adb-R5CT1234-v2k9a	_adb-tls-connect._tcp.	192.168.31.88:43109
+            clickzen-9988aabb	_adb-tls-pairing._tcp	192.168.31.88:37511
+            legacy-phone	_adb._tcp.	10.0.0.18:5555
+            """;
+
+        var list = MdnsPacket.ParseAdbMdnsServicesOutput(sample);
+        Assert.Equal(3, list.Count);
+        Assert.Contains(list, s => s.Kind == MdnsAdbServiceKind.TlsConnect && s.Address == "192.168.31.88:43109");
+        Assert.Contains(list, s => s.Kind == MdnsAdbServiceKind.TlsPairing && s.InstanceName == "clickzen-9988aabb" && s.Port == 37511);
+        Assert.Contains(list, s => s.Kind == MdnsAdbServiceKind.LegacyTcp && s.Address == "10.0.0.18:5555");
+    }
+
+    [Fact]
+    public async Task AutoConnector_heals_randomized_tls_port_via_mdns_and_updates_saved_store()
+    {
+        var store = new SavedDeviceStore(new AppPaths(_root));
+        store.AddOrUpdate(new SavedDevice { Name = "My Xiaomi", Host = "192.168.1.66", Port = 38111, AutoConnect = true });
+
+        var (client, fake) = FakeAdbClient.Create();
+        fake.Connect = (addr, _) => Task.FromResult(
+            addr == "192.168.1.66:44229"
+                ? $"connected to {addr}"
+                : $"cannot connect to {addr}: No connection could be made (10061)");
+        var adb = new AdbService(client, null, null, null);
+        var mdns = new FakeMdnsDiscovery(_ =>
+        [
+            new MdnsAdbService(MdnsAdbServiceKind.TlsConnect, "adb-xiaomi", "192.168.1.66", 44229),
+        ]);
+
+        var results = await new AutoConnector(adb, store, () => true, mdns, null).ConnectSavedAsync(TestContext.Current.CancellationToken);
+
+        var r = Assert.Single(results);
+        Assert.True(r.Success);
+        Assert.Equal("192.168.1.66:44229", r.Address);
+
+        // SavedDeviceStore must be updated to the new dynamic port so future connects succeed immediately.
+        var updated = Assert.Single(store.GetAll());
+        Assert.Equal("My Xiaomi", updated.Name);
+        Assert.Equal(44229, updated.Port);
+    }
+
+    [Fact]
+    public async Task Qr_pair_coordinator_pairs_and_connects_automatically_when_phone_scans_qr()
+    {
+        var creds = AdbWirelessQrCredentials.Create("clickzen-testpair01", "876543");
+        string? pairedAddr = null;
+        string? pairedCode = null;
+
+        var (client, fake) = FakeAdbClient.Create();
+        fake.Pair = (addr, _, code, _) =>
+        {
+            pairedAddr = addr;
+            pairedCode = code;
+            return Task.FromResult($"Successfully paired to {addr} [guid=adb-pixel]");
+        };
+        fake.Connect = (addr, _) => Task.FromResult($"connected to {addr}");
+        var adb = new AdbService(client, null, null, null);
+
+        var mdns = new FakeMdnsDiscovery(call => call switch
+        {
+            1 => [], // Phone hasn't scanned QR yet
+            2 => [new MdnsAdbService(MdnsAdbServiceKind.TlsPairing, "clickzen-testpair01", "192.168.1.90", 37412)],
+            _ => [new MdnsAdbService(MdnsAdbServiceKind.TlsConnect, "adb-pixel-xyz", "192.168.1.90", 41888)],
+        });
+
+        var stages = new List<WirelessQrPairStage>();
+        var progress = new SynchronousProgress(p => stages.Add(p.Stage));
+        var coordinator = new WirelessQrPairCoordinator(adb, mdns);
+
+        var outcome = await coordinator.PairAndConnectAsync(creds, progress, TestContext.Current.CancellationToken);
+
+        Assert.Equal(WirelessQrPairStage.Connected, outcome.Stage);
+        Assert.Equal("192.168.1.90:37412", pairedAddr);
+        Assert.Equal("876543", pairedCode);
+        Assert.Equal("192.168.1.90:41888", outcome.ConnectAddress);
+        Assert.Contains(WirelessQrPairStage.Pairing, stages);
+        Assert.Contains(WirelessQrPairStage.Connecting, stages);
+        Assert.Contains(WirelessQrPairStage.Connected, stages);
+    }
+
+    [Fact]
+    public async Task EnableWirelessAsync_reads_wifi_ip_switches_tcpip_and_connects()
+    {
+        var (client, fake) = FakeAdbClient.Create();
+        fake.Devices.Add(new AdvancedSharpAdbClient.Models.DeviceData
+        {
+            Serial = "USB123456",
+            State = AdvancedSharpAdbClient.Models.DeviceState.Online,
+        });
+        fake.Shell = (_, cmd, _) => Task.FromResult<IEnumerable<string>>(
+            cmd.Contains("ip route", StringComparison.Ordinal)
+                ? ["192.168.50.0/24 dev wlan0 proto kernel scope link src 192.168.50.23"]
+                : []);
+        fake.Connect = (addr, _) => Task.FromResult($"connected to {addr}");
+
+        var tcpipSwitched = new List<(string Serial, int Port)>();
+        var adb = new AdbService(client, null, null, null);
+
+        var res = await adb.EnableWirelessAsync(
+            "USB123456",
+            5555,
+            (serial, port, _) =>
+            {
+                tcpipSwitched.Add((serial, port));
+                return Task.CompletedTask;
+            },
+            TestContext.Current.CancellationToken);
+
+        Assert.True(res.Success);
+        Assert.Equal("192.168.50.23:5555", res.Address);
+        Assert.Equal([("USB123456", 5555)], tcpipSwitched);
+        Assert.Contains("192.168.50.23:5555", fake.ConnectLog);
+    }
+
+    private sealed class SynchronousProgress(Action<WirelessQrPairProgress> handler) : IProgress<WirelessQrPairProgress>
+    {
+        public void Report(WirelessQrPairProgress value) => handler(value);
+    }
+
+    private static byte[] BuildSyntheticMdnsResponse(string instance, string service, string targetHost, ushort port, IPAddress ip)
+    {
+        using var ms = new MemoryStream();
+        var u16 = new byte[2];
+        var u32 = new byte[4];
+        void WriteU16(ushort v) { BinaryPrimitives.WriteUInt16BigEndian(u16, v); ms.Write(u16); }
+        void WriteU32(uint v) { BinaryPrimitives.WriteUInt32BigEndian(u32, v); ms.Write(u32); }
+        void WriteName(string fqdn)
+        {
+            foreach (var label in fqdn.Split('.', StringSplitOptions.RemoveEmptyEntries))
+            {
+                var bytes = Encoding.UTF8.GetBytes(label);
+                ms.WriteByte((byte)bytes.Length);
+                ms.Write(bytes);
+            }
+            ms.WriteByte(0);
+        }
+
+        // Header: ID=0, Flags=0x8400 (response), QD=0, AN=2, NS=0, AR=1
+        WriteU16(0);
+        WriteU16(0x8400);
+        WriteU16(0);
+        WriteU16(2);
+        WriteU16(0);
+        WriteU16(1);
+
+        var fullInstance = $"{instance}.{service}";
+
+        // Answer 1: PTR service -> fullInstance
+        WriteName(service);
+        WriteU16(12); // PTR
+        WriteU16(1);
+        WriteU32(120);
+        using (var rdata = new MemoryStream())
+        {
+            foreach (var label in fullInstance.Split('.'))
+            {
+                var b = Encoding.UTF8.GetBytes(label);
+                rdata.WriteByte((byte)b.Length);
+                rdata.Write(b);
+            }
+            rdata.WriteByte(0);
+            var rb = rdata.ToArray();
+            WriteU16((ushort)rb.Length);
+            ms.Write(rb);
+        }
+
+        // Answer 2: SRV fullInstance -> targetHost:port
+        WriteName(fullInstance);
+        WriteU16(33); // SRV
+        WriteU16(0x8001);
+        WriteU32(120);
+        using (var rdata = new MemoryStream())
+        {
+            Span<byte> hdr = stackalloc byte[6];
+            BinaryPrimitives.WriteUInt16BigEndian(hdr[..2], 0);
+            BinaryPrimitives.WriteUInt16BigEndian(hdr[2..4], 0);
+            BinaryPrimitives.WriteUInt16BigEndian(hdr[4..6], port);
+            rdata.Write(hdr);
+            foreach (var label in targetHost.Split('.'))
+            {
+                var b = Encoding.UTF8.GetBytes(label);
+                rdata.WriteByte((byte)b.Length);
+                rdata.Write(b);
+            }
+            rdata.WriteByte(0);
+            var rb = rdata.ToArray();
+            WriteU16((ushort)rb.Length);
+            ms.Write(rb);
+        }
+
+        // Additional 1: A targetHost -> ip
+        WriteName(targetHost);
+        WriteU16(1); // A
+        WriteU16(0x8001);
+        WriteU32(120);
+        var ipBytes = ip.GetAddressBytes();
+        WriteU16((ushort)ipBytes.Length);
+        ms.Write(ipBytes);
+
+        return ms.ToArray();
+    }
+}
diff --git a/tests/ClickZen.Device.Tests/Input/PersistentRootInjectorTests.cs b/tests/ClickZen.Device.Tests/Input/PersistentRootInjectorTests.cs
new file mode 100644
index 0000000..77172a4
--- /dev/null
+++ b/tests/ClickZen.Device.Tests/Input/PersistentRootInjectorTests.cs
@@ -0,0 +1,170 @@
+using System.Text;
+using ClickZen.Core;
+using ClickZen.Core.Geometry;
+using ClickZen.Core.Input;
+using ClickZen.Device.Input;
+
+namespace ClickZen.Device.Tests.Input;
+
+public sealed class PersistentRootInjectorTests
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private static InputDeviceInfo SampleTouchscreen() =>
+        GeteventDeviceParser.PickTouchscreen(
+            GeteventDeviceParser.Parse(
+                File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "Samples", "getevent", "synthetic_phone_getevent_p.txt"))))!;
+
+    private sealed class FakeRootShellStream : Stream
+    {
+        private readonly Queue<byte> _rx = new();
+        private readonly StringBuilder _txLog = new();
+        private readonly bool _isRoot;
+
+        public FakeRootShellStream(bool isRoot = true) => _isRoot = isRoot;
+
+        public string WrittenCommands => _txLog.ToString();
+
+        public bool FailWrites { get; set; }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => true;
+        public override long Length => throw new NotSupportedException();
+        public override long Position { get => throw new NotSupportedException(); set => throw new NotSupportedException(); }
+
+        public override void Flush() { }
+
+        public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var n = 0;
+            while (n < buffer.Length && _rx.Count > 0)
+            {
+                buffer.Span[n++] = _rx.Dequeue();
+            }
+
+            return ValueTask.FromResult(n);
+        }
+
+        public override void Write(byte[] buffer, int offset, int count) =>
+            OnWrite(Encoding.UTF8.GetString(buffer, offset, count));
+
+        public override ValueTask WriteAsync(ReadOnlyMemory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            if (FailWrites)
+            {
+                throw new IOException("broken adb root socket");
+            }
+
+            OnWrite(Encoding.UTF8.GetString(buffer.Span));
+            return ValueTask.CompletedTask;
+        }
+
+        private void OnWrite(string text)
+        {
+            _txLog.Append(text);
+            if (text.Contains("__CZ_ROOT_OK__", StringComparison.Ordinal))
+            {
+                var reply = _isRoot ? "__CZ_ROOT_OK__0\n" : "__CZ_ROOT_OK__2000\n";
+                foreach (var b in Encoding.UTF8.GetBytes(reply))
+                {
+                    _rx.Enqueue(b);
+                }
+            }
+        }
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+    }
+
+    [Fact]
+    public async Task Reuses_single_persistent_root_shell_across_multiple_gestures_with_fd_redirection()
+    {
+        var openCalls = 0;
+        var stream = new FakeRootShellStream(isRoot: true);
+        var fallbackCalls = 0;
+        var touch = SampleTouchscreen();
+
+        var fallback = new RootSendeventInjector(
+            (_, _) =>
+            {
+                fallbackCalls++;
+                return Task.FromResult("");
+            },
+            touch,
+            () => new SizeI(1080, 2400),
+            () => DisplayRotation.Rotation0,
+            rawEvents: true);
+
+        await using var injector = new PersistentRootInjector(
+            openRootStream: _ =>
+            {
+                openCalls++;
+                return Task.FromResult<Stream>(stream);
+            },
+            fallback: fallback,
+            touch: touch,
+            rawEvents: true,
+            displayId: () => 0,
+            clock: new FakeClock());
+
+        await injector.TapAsync(new PointI(540, 1200), 50, Ct);
+        await injector.TapAsync(new PointI(200, 400), 50, Ct);
+        await injector.StrokeAsync([new TimedPoint(100, 200, 0), new TimedPoint(100, 600, 32)], Ct);
+        await injector.KeyAsync(4, Ct);
+
+        // Only ONE persistent su socket was opened across all four operations, and fallback was never needed!
+        Assert.Equal(1, openCalls);
+        Assert.Equal(0, fallbackCalls);
+        Assert.Contains("exec 4>/dev/input/event", stream.WrittenCommands, StringComparison.Ordinal);
+        Assert.Contains(">&4", stream.WrittenCommands, StringComparison.Ordinal);
+        Assert.Contains("input keyevent 4", stream.WrittenCommands, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task Reopens_persistent_shell_when_socket_drops_and_falls_back_cleanly_if_not_uid0()
+    {
+        var attempt = 0;
+        var first = new FakeRootShellStream(isRoot: true);
+        var second = new FakeRootShellStream(isRoot: false); // Fails uid=0 check immediately
+        var fallbackCommands = new List<string>();
+        var touch = SampleTouchscreen();
+
+        var fallback = new RootSendeventInjector(
+            (cmd, _) =>
+            {
+                fallbackCommands.Add(cmd);
+                return Task.FromResult("");
+            },
+            touch,
+            () => new SizeI(1080, 2400),
+            () => DisplayRotation.Rotation0,
+            rawEvents: true);
+
+        await using var injector = new PersistentRootInjector(
+            openRootStream: _ =>
+            {
+                attempt++;
+                return Task.FromResult<Stream>(attempt == 1 ? first : second);
+            },
+            fallback: fallback,
+            touch: touch,
+            rawEvents: true,
+            clock: new FakeClock());
+
+        await injector.TapAsync(new PointI(100, 200), 40, Ct);
+        Assert.Empty(fallbackCommands);
+
+        // Simulate USB/Wi-Fi hiccup breaking the persistent socket; next tap falls back seamlessly and tries to reopen on subsequent tap.
+        first.FailWrites = true;
+        await injector.TapAsync(new PointI(300, 400), 40, Ct);
+        await injector.TapAsync(new PointI(350, 450), 40, Ct);
+
+        Assert.Equal(2, attempt);
+        Assert.Equal(2, fallbackCommands.Count);
+    }
+}
diff --git a/tests/ClickZen.Device.Tests/Scrcpy/ProtocolTests.cs b/tests/ClickZen.Device.Tests/Scrcpy/ProtocolTests.cs
index 597af9c..aacec4d 100644
--- a/tests/ClickZen.Device.Tests/Scrcpy/ProtocolTests.cs
+++ b/tests/ClickZen.Device.Tests/Scrcpy/ProtocolTests.cs
@@ -109,6 +109,23 @@ public void Set_display_power_and_rotate_match_upstream()
         Assert.Equal(new byte[] { 0x0b }, _buf[..ControlMessageWriter.WriteSimple(_buf, ControlMessageType.RotateDevice)]);
     }
 
+    [Fact]
+    public void Uhid_create_and_destroy_keyboard_match_scrcpy_v4_1_wire_format()
+    {
+        var n = ControlMessageWriter.WriteUhidCreateKeyboard(_buf, id: 1, name: "ClickZen");
+        // 1 (type=12) + 2 (id) + 2 (vid) + 2 (pid) + 1 (nameLen=8) + 8 (name) + 2 (descLen=63) + 63 (HID descriptor) = 81 bytes
+        Assert.Equal(81, n);
+        Assert.Equal((byte)ControlMessageType.UhidCreate, _buf[0]);
+        Assert.Equal(new byte[] { 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x08 }, _buf[1..8]);
+        Assert.Equal("ClickZen"u8.ToArray(), _buf[8..16]);
+        Assert.Equal(new byte[] { 0x00, 0x3f }, _buf[16..18]); // 63-byte HID report descriptor
+        Assert.Equal(0x05, _buf[18]); // Usage Page (Generic Desktop)
+        Assert.Equal(0xC0, _buf[80]); // End Collection
+
+        var destroyLen = ControlMessageWriter.WriteUhidDestroy(_buf, id: 1);
+        Assert.Equal(new byte[] { 0x0e, 0x00, 0x01 }, _buf[..destroyLen]);
+    }
+
     [Theory]
     [InlineData(0f, 0)]
     [InlineData(0.5f, 0x8000)]
diff --git a/tests/ClickZen.Device.Tests/Scrcpy/ScrcpyConnectionTests.cs b/tests/ClickZen.Device.Tests/Scrcpy/ScrcpyConnectionTests.cs
index 8e058c9..9dc4683 100644
--- a/tests/ClickZen.Device.Tests/Scrcpy/ScrcpyConnectionTests.cs
+++ b/tests/ClickZen.Device.Tests/Scrcpy/ScrcpyConnectionTests.cs
@@ -270,4 +270,41 @@ await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
 
         Assert.Equal((byte)MotionAction.Up, sent[^1][1]);
     }
+
+    [Fact]
+    public async Task Unicode_and_long_text_automatically_route_through_clipboard_paste_and_uhid_toggles()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var sent = new List<byte[]>();
+        var injector = new ScrcpyTouchInjector((write, _) =>
+        {
+            var buf = new byte[ControlMessageWriter.MaxMessageSize];
+            var n = write(buf);
+            sent.Add(buf[..n]);
+            return Task.CompletedTask;
+        }, () => new SizeI(1080, 2400), () => new SizeI(1080, 2400));
+
+        await injector.TextAsync("hello123", ct);
+        Assert.Equal((byte)ControlMessageType.InjectText, sent[0][0]);
+
+        await injector.TextAsync("你好，ClickZen 局域网投屏！", ct);
+        Assert.Equal((byte)ControlMessageType.SetClipboard, sent[1][0]);
+        Assert.Equal(1, sent[1][9]); // paste = true
+
+        await injector.TextAsync(new string('x', 350), ct);
+        Assert.Equal((byte)ControlMessageType.SetClipboard, sent[2][0]);
+
+        await injector.SetHardwareKeyboardAsync(true, ct);
+        Assert.Equal((byte)ControlMessageType.UhidCreate, sent[3][0]);
+
+        await injector.SetHardwareKeyboardAsync(false, ct);
+        Assert.Equal((byte)ControlMessageType.UhidDestroy, sent[4][0]);
+    }
+
+    [Theory]
+    [InlineData("java.lang.SecurityException: Injecting input events requires the caller (or the source of the instrumentation, if any) to have the INJECT_EVENTS permission.", true)]
+    [InlineData("Permission denial: writing to settings requires:android.permission.WRITE_SECURE_SETTINGS", false)]
+    [InlineData("[server] INFO: Device: [Xiaomi] 2304FPN6DC (Android 14)", false)]
+    public void Detects_rom_input_injection_security_exceptions(string line, bool expected) =>
+        Assert.Equal(expected, ScrcpyStartResult.IsInputPermissionError(line));
 }
diff --git a/tests/ClickZen.Mcp.Tests/FakeBackend.cs b/tests/ClickZen.Mcp.Tests/FakeBackend.cs
index 783dcef..ca7138b 100644
--- a/tests/ClickZen.Mcp.Tests/FakeBackend.cs
+++ b/tests/ClickZen.Mcp.Tests/FakeBackend.cs
@@ -76,6 +76,12 @@ public Task<McpEmulatorConnect> ConnectEmulatorAsync(string? emulator, bool make
     public Task<McpEmulatorBind> BindEmulatorWindowAsync(string? emulator, CancellationToken ct) =>
         Result($"bind-emulator {emulator}", new McpEmulatorBind("window:abc123", "screenshotMatch", "127.0.0.1:16384", 1920, 1080, "bound"));
 
+    public Task<IReadOnlyList<McpLanDevice>> DiscoverLanDevicesAsync(CancellationToken ct) =>
+        Result<IReadOnlyList<McpLanDevice>>("discover-lan", [new McpLanDevice("192.168.1.88:41235", "192.168.1.88", 41235, "tlsConnect", "adb-R5CT123-abc")]);
+
+    public Task<McpWirelessEnableResult> EnableWirelessAdbAsync(string? device, int port, bool remember, CancellationToken ct) =>
+        Result($"enable-wireless {device} {port} {remember}", new McpWirelessEnableResult(true, $"192.168.1.88:{port}", "connected", remember));
+
     public Task<McpDevice> ConnectAsync(string? device, CancellationToken ct) => Result($"connect {device}", Device(device ?? "emulator-5554"));
 
     public Task<McpDevice> SelectDeviceAsync(string device, CancellationToken ct) => Result($"select {device}", Device(device));
diff --git a/tests/ClickZen.Mcp.Tests/McpServerHostTests.cs b/tests/ClickZen.Mcp.Tests/McpServerHostTests.cs
index d38487f..ad359fa 100644
--- a/tests/ClickZen.Mcp.Tests/McpServerHostTests.cs
+++ b/tests/ClickZen.Mcp.Tests/McpServerHostTests.cs
@@ -479,4 +479,20 @@ public async Task Get_foreground_app_returns_package_activity_and_display_id()
         Assert.Contains("\"component\":\"com.demo.game/.MainActivity\"", text, StringComparison.Ordinal);
         Assert.Contains("foreground ", _backend.Calls);
     }
+
+    [Fact]
+    public async Task Discover_lan_devices_and_enable_wireless_adb_work_end_to_end()
+    {
+        await using var client = await ConnectAsync();
+
+        var lan = await CallAsync(client, "discover_lan_devices");
+        Assert.NotEqual(true, lan.IsError);
+        Assert.Contains("\"address\":\"192.168.1.88:41235\"", Text(lan), StringComparison.Ordinal);
+        Assert.Contains("\"kind\":\"tlsConnect\"", Text(lan), StringComparison.Ordinal);
+
+        var enabled = await CallAsync(client, "enable_wireless_adb", new() { ["device"] = "USB123", ["port"] = 5555, ["remember"] = true });
+        Assert.NotEqual(true, enabled.IsError);
+        Assert.Contains("\"address\":\"192.168.1.88:5555\"", Text(enabled), StringComparison.Ordinal);
+        Assert.Contains("enable-wireless USB123 5555 True", _backend.Calls);
+    }
 }
diff --git a/tests/ClickZen.Vision.Tests/QrCodeOpticalDecodeTests.cs b/tests/ClickZen.Vision.Tests/QrCodeOpticalDecodeTests.cs
new file mode 100644
index 0000000..c6f92f0
--- /dev/null
+++ b/tests/ClickZen.Vision.Tests/QrCodeOpticalDecodeTests.cs
@@ -0,0 +1,50 @@
+using ClickZen.Core.Automation;
+using ClickZen.Core.Wireless;
+using ClickZen.Vision;
+
+namespace ClickZen.Vision.Tests;
+
+/// <summary>
+/// Verifies that <see cref="QrCodeEncoder"/> BGRA rendering round-trips cleanly through <see cref="ImageCodec"/>
+/// PNG compression with crisp white quiet zones and exact module contrast.
+/// </summary>
+public sealed class QrCodeOpticalDecodeTests
+{
+    [Fact]
+    public void Rendered_adb_wireless_qr_bitmap_round_trips_through_png_with_exact_module_contrast()
+    {
+        var creds = AdbWirelessQrCredentials.CreateRandom();
+        var qr = QrCodeEncoder.Encode(creds.Payload);
+        const int modulePx = 6;
+        const int quietModules = 4;
+        var (w, h, bgra) = qr.ToBgraPixels(modulePx, quietModules);
+
+        var png = ImageCodec.ToPng(new Frame(w, h, bgra, 1));
+        var decodedFrame = ImageCodec.Decode(png);
+
+        Assert.Equal(w, decodedFrame.Width);
+        Assert.Equal(h, decodedFrame.Height);
+
+        // Quiet zone corner pixel (2, 2) must be pure opaque white (255, 255, 255, 255).
+        var qIdx = (2 * w + 2) * 4;
+        Assert.Equal((byte)255, decodedFrame.Bgra[qIdx]);
+        Assert.Equal((byte)255, decodedFrame.Bgra[qIdx + 1]);
+        Assert.Equal((byte)255, decodedFrame.Bgra[qIdx + 2]);
+        Assert.Equal((byte)255, decodedFrame.Bgra[qIdx + 3]);
+
+        // Every QR module center pixel after PNG encode/decode must match qr[r, c] with 100% contrast.
+        for (var r = 0; r < qr.Size; r++)
+        {
+            for (var c = 0; c < qr.Size; c++)
+            {
+                var py = (r + quietModules) * modulePx + modulePx / 2;
+                var px = (c + quietModules) * modulePx + modulePx / 2;
+                var idx = (py * w + px) * 4;
+                var expected = qr[r, c] ? (byte)0 : (byte)255;
+                Assert.Equal(expected, decodedFrame.Bgra[idx]);
+                Assert.Equal(expected, decodedFrame.Bgra[idx + 1]);
+                Assert.Equal(expected, decodedFrame.Bgra[idx + 2]);
+            }
+        }
+    }
+}