[client] Sweep connections on network loss via a shared netevents manager (#7254)

Losing the last network only flipped the availability state: the dead management, signal and relay sockets stayed silently connected until their own timeouts, so the client kept reporting Connected with no network at all.

Introduce client/netevents with a Manager that ties the availability state, the connection sweeper and the status recorder together, and move the netstate and netsweep packages under it (netsweep renamed to sweep). SetNetworkAvailable(false) now also sweeps the registered connections so their owners redial and the listener reaches the NoNetwork state.

The Android and iOS bindings own a Manager instance and inject it through the constructors; consumers hold the concrete *Manager whose nil zero value reports always-online and never sweeps, with interfaces kept only as parameter contracts. The relay guard settle wait moved into the Manager as WaitSettled, removing the netevents import from the relay package.

client/android/client.go

@@ -26,8 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -82,13 +81,10 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run and RunWithoutLogin inject it into each new
-	// ConnectClient, which distributes it to every reconnection loop.
-	netState *netstate.State
-
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
+	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run and RunWithoutLogin inject its state and
+	// sweeper into each new ConnectClient.
+	netMgr *netevents.Manager
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
@@ -153,16 +149,16 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
 	system.SetIFaceDiscover(iFaceDiscover)
+	recorder := peer.NewRecorder("")
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
 		tunAdapter:            tunAdapter,
 		iFaceDiscover:         iFaceDiscover,
-		recorder:              peer.NewRecorder(""),
+		recorder:              recorder,
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
+		netMgr:                netevents.NewManager(recorder),
 	}
 }
 
@@ -203,8 +199,9 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	}
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
+
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+		internal.WithNetEvents(c.netMgr))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -246,7 +243,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+		internal.WithNetEvents(c.netMgr))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
@@ -298,9 +295,12 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 // While unavailable, the internal reconnect loops suspend their attempts and
 // the connection listener reports NoNetwork instead of Connecting; when
 // availability returns, the loops resume immediately with a fresh backoff.
+// Losing the last network also sweeps the registered connections: nothing can
+// redial while offline, so the stale sockets would otherwise stay silently
+// "connected" until their own timeouts and the client would keep reporting
+// Connected with no network at all.
 func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
+	c.netMgr.SetNetworkAvailable(available)
 }
 
 // NotifyNetworkChange marks the management, signal and relay connections
@@ -308,8 +308,7 @@ func (c *Client) SetNetworkAvailable(available bool) {
 // whatever has not redialed on the new network by then. The engine and the
 // TUN device stay untouched.
 func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
+	c.netMgr.NotifyNetworkChange()
 }
 
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.

client/grpc/dialer_generic.go

@@ -16,9 +16,14 @@ import (
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents/sweep"
 )
 
+// Sweeper registers in-flight dials for the network change sweep.
+type Sweeper interface {
+	StartDial(ctx context.Context) *sweep.Dial
+}
+
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
 	return grpc.WithContextDialer(dialContext)
 }
@@ -26,7 +31,7 @@ func WithCustomDialer(_ bool, _ string) grpc.DialOption {
 // WithSweeper dials like WithCustomDialer but registers connections and
 // dials with the sweeper. Append it after WithCustomDialer: gRPC applies
 // dial options in order, so the later context dialer wins.
-func WithSweeper(sweeper *netsweep.Sweeper) grpc.DialOption {
+func WithSweeper(sweeper Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
 		dial := sweeper.StartDial(ctx)
 		defer dial.Release()

client/grpc/dialer_js.go

@@ -1,12 +1,19 @@
 package grpc
 
 import (
+	"context"
+
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents/sweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
+// Sweeper registers in-flight dials for the network change sweep.
+type Sweeper interface {
+	StartDial(ctx context.Context) *sweep.Dial
+}
+
 // WithCustomDialer returns a gRPC dial option that uses WebSocket transport for WASM/JS environments.
 // The component parameter specifies the WebSocket proxy component path (e.g., "/management", "/signal").
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
@@ -14,6 +21,6 @@ func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 }
 
 // WithSweeper is a no-op on WASM/JS: there is no network change signal.
-func WithSweeper(_ *netsweep.Sweeper) grpc.DialOption {
+func WithSweeper(_ Sweeper) grpc.DialOption {
 	return grpc.EmptyDialOption{}
 }

client/grpc/retry.go

@@ -6,16 +6,19 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
-
-	"github.com/netbirdio/netbird/client/netstate"
 )
 
+// ChangeWatcher exposes OS network availability transitions.
+type ChangeWatcher interface {
+	Changed() <-chan struct{}
+}
+
 // Retry mirrors backoff.Retry, but the sleep between attempts also wakes on
 // OS network availability transitions: an operation cut down by a network
 // change retries the moment the network settles instead of sleeping through
-// the recovery. A nil netState never fires, leaving plain backoff.Retry
+// the recovery. A nil watcher never fires, leaving plain backoff.Retry
 // behavior.
-func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, netState *netstate.State) error {
+func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, watcher ChangeWatcher) error {
 	bo.Reset()
 	for {
 		err := operation()
@@ -36,10 +39,14 @@ func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff,
 			return err
 		}
 
+		var changed <-chan struct{}
+		if watcher != nil {
+			changed = watcher.Changed()
+		}
 		timer := time.NewTimer(next)
 		select {
 		case <-timer.C:
-		case <-netState.Changed():
+		case <-changed:
 			timer.Stop()
 		case <-ctx.Done():
 			timer.Stop()

client/grpc/retry_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
 )
 
 func TestRetryWakesOnNetworkChange(t *testing.T) {

client/internal/connect.go

@@ -38,8 +38,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -73,28 +72,17 @@ type ConnectClient struct {
 
 	persistSyncResponse bool
 
-	// netState gates every reconnection loop on OS-reported network
-	// availability. Nil (the default) disables gating; mobile platforms
-	// inject it via WithNetworkState.
-	netState *netstate.State
-
-	// sweeper cuts the management, signal and relay connections on network
-	// change; nil disables it.
-	sweeper *netsweep.Sweeper
+	// netMgr gates every reconnection loop on OS-reported network
+	// availability and sweeps connections on network change.
+	netMgr *netevents.Manager
 }
 
 // ConnectClientOption configures optional ConnectClient behavior.
 type ConnectClientOption func(*ConnectClient)
 
-// WithNetworkState injects the OS network availability state that gates every
-// reconnection loop; without it gating is disabled.
-func WithNetworkState(netState *netstate.State) ConnectClientOption {
-	return func(c *ConnectClient) { c.netState = netState }
-}
-
-// WithSweeper injects the network change sweeper.
-func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
-	return func(c *ConnectClient) { c.sweeper = sweeper }
+// WithNetEvents injects the OS network event handling.
+func WithNetEvents(events *netevents.Manager) ConnectClientOption {
+	return func(c *ConnectClient) { c.netMgr = events }
 }
 
 func NewConnectClient(
@@ -305,7 +293,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}
 
 		// suspend connection attempts while the OS reports no usable network
-		if waited, err := c.netState.Wait(c.ctx); err != nil {
+		if waited, err := c.netMgr.Wait(c.ctx); err != nil {
 			return nil
 		} else if waited {
 			backOff.Reset()
@@ -323,7 +311,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
 		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
-			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
+			mgm.WithNetEvents(c.netMgr))
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -398,7 +386,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netMgr)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -435,7 +423,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}
 
 		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
-			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
+			relayClient.WithNetEvents(c.netMgr))
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -463,7 +451,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			NetState:       c.netState,
+			NetMgr:         c.netMgr,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -723,7 +711,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netMgr *netevents.Manager) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -732,7 +720,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 	}
 
 	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
-		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
+		signal.WithNetEvents(netMgr))
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)

client/internal/engine.go

@@ -59,7 +59,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -182,9 +182,9 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
-	// NetState gates the reconnection loops on OS-reported network
+	// NetMgr gates the reconnection loops on OS-reported network
 	// availability; nil disables gating.
-	NetState *netstate.State
+	NetMgr *netevents.Manager
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -208,9 +208,9 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency
 
-	// netState gates the peer reconnection guards on OS-reported network
+	// netMgr gates the peer reconnection guards on OS-reported network
 	// availability; nil disables gating.
-	netState *netstate.State
+	netMgr *netevents.Manager
 
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
@@ -345,7 +345,7 @@ func NewEngine(
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
-		netState:           services.NetState,
+		netMgr:             services.NetMgr,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -1902,8 +1902,8 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
-		ICEConfig:    e.createICEConfig(),
-		NetworkState: e.netState,
+		ICEConfig: e.createICEConfig(),
+		NetMgr:    e.netMgr,
 	}
 
 	serviceDependencies := peer.ServiceDependencies{

client/internal/peer/conn.go

@@ -26,7 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -95,9 +95,9 @@ type ConnConfig struct {
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 
-	// NetworkState gates the reconnection guard on OS-reported network
+	// NetMgr gates the reconnection guard on OS-reported network
 	// availability; nil disables gating.
-	NetworkState *netstate.State
+	NetMgr *netevents.Manager
 }
 
 type Conn struct {
@@ -259,7 +259,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}
 
-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetworkState)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetMgr)
 
 	conn.wg.Add(1)
 	go func() {

client/internal/peer/guard/guard.go

@@ -6,8 +6,6 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // ConnStatus represents the connection state as seen by the guard.
@@ -24,6 +22,12 @@ const (
 
 type connStatusFunc func() ConnStatus
 
+// NetworkWatcher is the availability view the guard gates reconnects on.
+type NetworkWatcher interface {
+	IsOnline() bool
+	Changed() <-chan struct{}
+}
+
 // Guard is responsible for the reconnection logic.
 // It will trigger to send an offer to the peer then has connection issues.
 // Watch these events:
@@ -37,22 +41,22 @@ type Guard struct {
 	isConnectedOnAllWay connStatusFunc
 	timeout             time.Duration
 	srWatcher           *SRWatcher
-	// netState gates reconnect attempts on OS-reported network availability;
+	// netWatcher gates reconnect attempts on OS-reported network availability;
 	// nil disables gating.
-	netState                *netstate.State
+	netWatcher              NetworkWatcher
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
-// NewGuard creates a reconnection guard for a peer connection. A nil netState
+// NewGuard creates a reconnection guard for a peer connection. A nil netWatcher
 // disables network availability gating.
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netWatcher NetworkWatcher) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
-		netState:                netState,
+		netWatcher:              netWatcher,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -104,14 +108,17 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
-	netChanged := g.netState.Changed()
+	var netChanged <-chan struct{}
+	if g.netWatcher != nil {
+		netChanged = g.netWatcher.Changed()
+	}
 
 	for {
 		select {
 		case <-tickerChannel:
 			// skip attempts while the OS reports no usable network; the
 			// netChanged case below resumes the loop once it returns
-			if !g.netState.IsOnline() {
+			if g.netWatcher != nil && !g.netWatcher.IsOnline() {
 				continue
 			}
 			switch g.isConnectedOnAllWay() {
@@ -152,8 +159,8 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 
 		case <-netChanged:
 			// Re-arm for the next transition before acting on this one.
-			netChanged = g.netState.Changed()
-			if !g.netState.IsOnline() {
+			netChanged = g.netWatcher.Changed()
+			if !g.netWatcher.IsOnline() {
 				continue
 			}
 			// Ticks skipped while offline drove the backoff towards its

client/internal/peer/guard/guard_netstate_test.go

@@ -9,7 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
 )
 
 // newTestGuardWithNetState builds a guard with a realistic MaxInterval: the

client/ios/NetBirdSDK/client.go

@@ -22,8 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -84,12 +83,10 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run injects it into each new ConnectClient, which
-	// distributes it to every reconnection loop.
-	netState *netstate.State
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
+	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run injects its state and sweeper into each new
+	// ConnectClient.
+	netMgr *netevents.Manager
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -100,6 +97,7 @@ type Client struct {
 
 // NewClient instantiate a new Client
 func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osVersion string, osName string, networkChangeListener NetworkChangeListener, dnsManager DnsManager) *Client {
+	recorder := peer.NewRecorder("")
 	return &Client{
 		cfgFile:               cfgFile,
 		stateFile:             stateFile,
@@ -108,12 +106,11 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		deviceName:            deviceName,
 		osName:                osName,
 		osVersion:             osVersion,
-		recorder:              peer.NewRecorder(""),
+		recorder:              recorder,
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
+		netMgr:                netevents.NewManager(recorder),
 	}
 }
 
@@ -190,7 +187,7 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	cfg.WgIface = interfaceName
 
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+		internal.WithNetEvents(c.netMgr))
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -203,10 +200,11 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 // (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
 // suspend their attempts and the connection listener reports NoNetwork
 // instead of Connecting; when availability returns, the loops resume
-// immediately with a fresh backoff.
+// immediately with a fresh backoff. Losing the last network also sweeps the
+// registered connections, so the client does not keep reporting Connected
+// over stale sockets with no network at all.
 func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
+	c.netMgr.SetNetworkAvailable(available)
 }
 
 // NotifyNetworkChange marks the management, signal and relay connections
@@ -214,8 +212,7 @@ func (c *Client) SetNetworkAvailable(available bool) {
 // whatever has not redialed on the new network by then. The engine and the
 // TUN device stay untouched.
 func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
+	c.netMgr.NotifyNetworkChange()
 }
 
 // Stop the internal client and free the resources

client/netevents/netevents.go

@@ -0,0 +1,173 @@
+// Package netevents owns the OS network event handling shared by the mobile
+// bindings: availability changes park or wake the reconnection loops and drive
+// the NoNetwork listener state, and both losing the last network and switching
+// networks sweep the stale connections so their owners redial immediately.
+package netevents
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netevents/sweep"
+)
+
+// Recorder receives the availability changes for listener state reporting.
+type Recorder interface {
+	SetNetworkAvailable(available bool)
+}
+
+// Manager ties the network availability state, the connection sweeper and the
+// status recorder together; it outlives engine restarts. A nil *Manager is
+// the valid no-events value for consumers: the read methods report
+// always-online and never sweep. Only the event sources hold a real Manager,
+// so the write methods do not tolerate a nil receiver.
+type Manager struct {
+	// mu serializes availability transitions: the IsOnline check and the
+	// state update must be atomic, or a racing offline flip can skip the sweep
+	// and leave netState and the recorder disagreeing.
+	mu       sync.Mutex
+	netState *netstate.State
+	sweeper  *sweep.Sweeper
+	recorder Recorder
+}
+
+// NewManager creates a Manager reporting into recorder, starting online.
+func NewManager(recorder Recorder) *Manager {
+	return &Manager{
+		netState: netstate.New(),
+		sweeper:  sweep.New(),
+		recorder: recorder,
+	}
+}
+
+// SetNetworkAvailable records OS-reported network availability. While
+// unavailable, the reconnection loops suspend their attempts and the
+// connection listener reports NoNetwork instead of Connecting; when
+// availability returns, the loops resume immediately with a fresh backoff.
+// Losing the last network also sweeps the registered connections: nothing can
+// redial while offline, so the stale sockets would otherwise stay silently
+// "connected" until their own timeouts and the client would keep reporting
+// Connected with no network at all.
+//
+// Panics on a nil receiver: only the mobile bindings that own a Manager
+// report availability.
+func (m *Manager) SetNetworkAvailable(available bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if !available && m.netState.IsOnline() {
+		m.sweeper.MarkNetworkChange()
+	}
+	m.netState.Set(available)
+	m.recorder.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange marks the management, signal and relay connections
+// stale after the OS switched networks and schedules a sweep that cuts
+// whatever has not redialed on the new network by then. The engine and the
+// TUN device stay untouched.
+//
+// Panics on a nil receiver: only the mobile bindings that own a Manager
+// report network changes.
+func (m *Manager) NotifyNetworkChange() {
+	m.sweeper.MarkNetworkChange()
+	log.Infof("network change: connections marked stale")
+}
+
+// IsOnline reports whether the OS reports at least one usable network.
+func (m *Manager) IsOnline() bool {
+	if m == nil {
+		return true
+	}
+	return m.netState.IsOnline()
+}
+
+// Changed returns a channel closed on the next availability transition.
+func (m *Manager) Changed() <-chan struct{} {
+	if m == nil {
+		return nil
+	}
+	return m.netState.Changed()
+}
+
+// Wait blocks while the network is offline; see netstate.State.Wait.
+func (m *Manager) Wait(ctx context.Context) (bool, error) {
+	if m == nil {
+		return false, nil
+	}
+	return m.netState.Wait(ctx)
+}
+
+// WaitSettled waits until an online verdict holds for a full settleWindow, or
+// while offline until the budget runs out. Returns false when ctx is
+// cancelled. The settle window exists because a disconnect often precedes the
+// OS offline flag by a few milliseconds, so a fresh online verdict cannot be
+// trusted immediately. A nil Manager has no events to watch: it degrades to a
+// fixed budget-long sleep.
+func (m *Manager) WaitSettled(ctx context.Context, budget, settleWindow time.Duration) bool {
+	if m == nil {
+		select {
+		case <-time.After(budget):
+			return true
+		case <-ctx.Done():
+			return false
+		}
+	}
+
+	budgetTimer := time.NewTimer(budget)
+	defer budgetTimer.Stop()
+
+	settle := time.NewTimer(settleWindow)
+	defer settle.Stop()
+
+	for {
+		// Channel first, flag second: a flip in between still fires the channel.
+		changedCh := m.netState.Changed()
+		if m.netState.IsOnline() {
+			select {
+			case <-settle.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		} else {
+			select {
+			case <-budgetTimer.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		}
+		if !settle.Stop() {
+			select {
+			case <-settle.C:
+			default:
+			}
+		}
+		settle.Reset(settleWindow)
+	}
+}
+
+// StartDial registers an in-flight dial with the sweeper; see sweep.Sweeper.StartDial.
+func (m *Manager) StartDial(ctx context.Context) *sweep.Dial {
+	if m == nil {
+		return (*sweep.Sweeper)(nil).StartDial(ctx)
+	}
+	return m.sweeper.StartDial(ctx)
+}
+
+// QuickRetryBackoff wraps bo for a quick retry after a network change; see
+// sweep.Sweeper.QuickRetryBackoff.
+func (m *Manager) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff) backoff.BackOff {
+	if m == nil {
+		return bo
+	}
+	return m.sweeper.QuickRetryBackoff(ctx, bo, m.netState)
+}

client/netevents/netevents_test.go

@@ -0,0 +1,34 @@
+package netevents
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type recorderStub struct{}
+
+func (recorderStub) SetNetworkAvailable(bool) {}
+
+func TestWaitSettledAfterOutage(t *testing.T) {
+	const budget = 1500 * time.Millisecond
+	const settleWindow = 200 * time.Millisecond
+	const outage = 2 * settleWindow
+
+	m := NewManager(recorderStub{})
+	m.SetNetworkAvailable(false)
+
+	start := time.Now()
+	go func() {
+		time.Sleep(outage)
+		m.SetNetworkAvailable(true)
+	}()
+
+	ok := m.WaitSettled(context.Background(), budget, settleWindow)
+	elapsed := time.Since(start)
+
+	assert.True(t, ok, "recovered network must let the caller proceed")
+	assert.GreaterOrEqual(t, elapsed, outage+settleWindow, "an online verdict must hold a full settle window before it is trusted")
+}

client/netevents/sweep/quick_retry.go

@@ -1,11 +1,11 @@
-package netsweep
+package sweep
 
 import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
 
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
 )
 
 const quickRetryDelay = 200 * time.Millisecond

client/netevents/sweep/quick_retry_test.go

@@ -1,4 +1,4 @@
-package netsweep
+package sweep
 
 import (
 	"context"

client/netevents/sweep/sweep.go

@@ -1,10 +1,10 @@
-// Package netsweep cuts network-bound activity when the OS switches networks:
+// Package sweep cuts network-bound activity when the OS switches networks:
 // a sweep closes the registered connections and aborts the in-flight dials, so
 // their owners redial immediately instead of waiting for the old sockets to
 // time out.
 //
 // A nil *Sweeper disables everything: all methods are nil-safe no-ops.
-package netsweep
+package sweep
 
 import (
 	"context"
@@ -16,7 +16,7 @@ import (
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netevents/netstate"
 )
 
 // DefaultSweepDelay absorbs network flapping while the OS settles on a
@@ -34,7 +34,7 @@ type Config struct {
 // ErrSwept reports that a dial finished after a network change swept its
 // registration. The connection is already closed; the caller must treat it
 // as a failed dial and redial on the new network.
-var ErrSwept = errors.New("netsweep: connection swept by network change")
+var ErrSwept = errors.New("sweep: connection swept by network change")
 
 // sweepID identifies one registration in a sweeper. Connections and dials
 // draw from the same counter, so an id is unique across both registries.

client/netevents/sweep/sweep_test.go

@@ -1,4 +1,4 @@
-package netsweep
+package sweep
 
 import (
 	"context"