diff --git a/Cargo.lock b/Cargo.lock
index cafae4f3..ac4b1b28 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4623,6 +4623,7 @@ dependencies = [
  "tracing",
  "tracing-error",
  "tracing-subscriber",
+ "tracing-wasm",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm-bindgen-test",
diff --git a/veilid-core/Cargo.toml b/veilid-core/Cargo.toml
index 48b285ac..9a5c4396 100644
--- a/veilid-core/Cargo.toml
+++ b/veilid-core/Cargo.toml
@@ -98,6 +98,8 @@ ws_stream_wasm = "^0"
 async_executors = { version = "^0", default-features = false, features = [ "bindgen" ]}
 async-lock = "^2"
 send_wrapper = "^0"
+wasm-logger = "^0"
+tracing-wasm = "^0"
 
 # Configuration for WASM32 'web-sys' crate
 [target.'cfg(target_arch = "wasm32")'.dependencies.web-sys]
diff --git a/veilid-core/src/api_tracing_layer.rs b/veilid-core/src/api_tracing_layer.rs
index daf42b9e..7579f477 100644
--- a/veilid-core/src/api_tracing_layer.rs
+++ b/veilid-core/src/api_tracing_layer.rs
@@ -78,7 +78,7 @@ impl ApiTracingLayer {
     pub fn change_api_log_level(max_level: Option<VeilidLogLevel>) {
         if let Some(api_logger) = API_LOGGER.get() {
             if let Some(inner) = &mut *api_logger.inner.lock() {
-                *inner = Self::new_inner(max_level, inner.update_callback.clone());
+                inner.max_level = max_level;
             }
         }
     }
diff --git a/veilid-core/src/intf/native/system.rs b/veilid-core/src/intf/native/system.rs
index b7d42ca3..60baa83e 100644
--- a/veilid-core/src/intf/native/system.rs
+++ b/veilid-core/src/intf/native/system.rs
@@ -46,6 +46,12 @@ pub async fn sleep(millis: u32) {
     }
 }
 
+pub fn system_boxed<'a, Out>(
+    future: impl Future<Output = Out> + Send + 'a,
+) -> SystemPinBoxFutureLifetime<'a, Out> {
+    Box::pin(future)
+}
+
 pub fn spawn<Out>(future: impl Future<Output = Out> + Send + 'static) -> JoinHandle<Out>
 where
     Out: Send + 'static,
diff --git a/veilid-core/src/intf/wasm/system.rs b/veilid-core/src/intf/wasm/system.rs
index 62b09c53..5c3eba05 100644
--- a/veilid-core/src/intf/wasm/system.rs
+++ b/veilid-core/src/intf/wasm/system.rs
@@ -99,6 +99,12 @@ pub async fn sleep(millis: u32) {
     }
 }
 
+pub fn system_boxed<'a, Out>(
+    future: impl Future<Output = Out> + 'a,
+) -> SystemPinBoxFutureLifetime<'a, Out> {
+    Box::pin(future)
+}
+
 pub fn spawn<Out>(future: impl Future<Output = Out> + 'static) -> JoinHandle<Out>
 where
     Out: Send + 'static,
@@ -203,10 +209,10 @@ pub async fn get_outbound_relay_peer() -> Option<crate::veilid_api::PeerInfo> {
 // }
 
 
-pub async fn txt_lookup<S: AsRef<str>>(host: S) -> Result<Vec<String>, String> {
+pub async fn txt_lookup<S: AsRef<str>>(_host: S) -> Result<Vec<String>, String> {
     Err("wasm does not support txt lookup".to_owned())   
 }
 
-pub async fn ptr_lookup(ip_addr: IpAddr) -> Result<String, String> {
+pub async fn ptr_lookup(_ip_addr: IpAddr) -> Result<String, String> {
     Err("wasm does not support ptr lookup".to_owned())   
 }
diff --git a/veilid-core/src/network_manager/native/mod.rs b/veilid-core/src/network_manager/native/mod.rs
index 5994b36a..8c1e5894 100644
--- a/veilid-core/src/network_manager/native/mod.rs
+++ b/veilid-core/src/network_manager/native/mod.rs
@@ -4,8 +4,8 @@ mod network_udp;
 mod protocol;
 mod start_protocols;
 
+use super::*;
 use crate::intf::*;
-use crate::network_manager::*;
 use crate::routing_table::*;
 use connection_manager::*;
 use network_tcp::*;
diff --git a/veilid-core/src/network_manager/network_connection.rs b/veilid-core/src/network_manager/network_connection.rs
index 6da7c35e..ea02ea40 100644
--- a/veilid-core/src/network_manager/network_connection.rs
+++ b/veilid-core/src/network_manager/network_connection.rs
@@ -224,72 +224,68 @@ impl NetworkConnection {
                 })
             };
             let timer = MutableFuture::new(new_timer());
-            unord.push(timer.clone().boxed());
+
+            unord.push(system_boxed(timer.clone()));
 
             loop {
                 // Add another message sender future if necessary
                 if need_sender {
                     need_sender = false;
-                    unord.push(
-                        receiver
-                            .recv_async()
-                            .then(|res| async {
-                                match res {
-                                    Ok(message) => {
-                                        // send the packet
-                                        if let Err(e) = Self::send_internal(
-                                            &protocol_connection,
-                                            stats.clone(),
-                                            message,
-                                        )
-                                        .await
-                                        {
-                                            // Sending the packet along can fail, if so, this connection is dead
-                                            log_net!(debug e);
-                                            RecvLoopAction::Finish
-                                        } else {
-                                            RecvLoopAction::Send
-                                        }
-                                    }
-                                    Err(e) => {
-                                        // All senders gone, shouldn't happen since we store one alongside the join handle
-                                        log_net!(warn e);
-                                        RecvLoopAction::Finish
-                                    }
+                    let sender_fut = receiver.recv_async().then(|res| async {
+                        match res {
+                            Ok(message) => {
+                                // send the packet
+                                if let Err(e) = Self::send_internal(
+                                    &protocol_connection,
+                                    stats.clone(),
+                                    message,
+                                )
+                                .await
+                                {
+                                    // Sending the packet along can fail, if so, this connection is dead
+                                    log_net!(debug e);
+                                    RecvLoopAction::Finish
+                                } else {
+                                    RecvLoopAction::Send
                                 }
-                            })
-                            .boxed(),
-                    );
+                            }
+                            Err(e) => {
+                                // All senders gone, shouldn't happen since we store one alongside the join handle
+                                log_net!(warn e);
+                                RecvLoopAction::Finish
+                            }
+                        }
+                    });
+                    unord.push(system_boxed(sender_fut));
                 }
 
                 // Add another message receiver future if necessary
                 if need_receiver {
-                    need_sender = false;
-                    unord.push(
-                        Self::recv_internal(&protocol_connection, stats.clone())
-                            .then(|res| async {
-                                match res {
-                                    Ok(message) => {
-                                        // Pass received messages up to the network manager for processing
-                                        if let Err(e) = network_manager
-                                            .on_recv_envelope(message.as_slice(), descriptor)
-                                            .await
-                                        {
-                                            log_net!(error e);
-                                            RecvLoopAction::Finish
-                                        } else {
-                                            RecvLoopAction::Recv
-                                        }
-                                    }
-                                    Err(e) => {
-                                        // Connection unable to receive, closed
-                                        log_net!(warn e);
+                    need_receiver = false;
+                    let receiver_fut = Self::recv_internal(&protocol_connection, stats.clone())
+                        .then(|res| async {
+                            match res {
+                                Ok(message) => {
+                                    // Pass received messages up to the network manager for processing
+                                    if let Err(e) = network_manager
+                                        .on_recv_envelope(message.as_slice(), descriptor)
+                                        .await
+                                    {
+                                        log_net!(error e);
                                         RecvLoopAction::Finish
+                                    } else {
+                                        RecvLoopAction::Recv
                                     }
                                 }
-                            })
-                            .boxed(),
-                    );
+                                Err(e) => {
+                                    // Connection unable to receive, closed
+                                    log_net!(warn e);
+                                    RecvLoopAction::Finish
+                                }
+                            }
+                        });
+
+                    unord.push(system_boxed(receiver_fut));
                 }
 
                 // Process futures
diff --git a/veilid-core/src/network_manager/wasm/mod.rs b/veilid-core/src/network_manager/wasm/mod.rs
index fb5d08ac..61f94d1f 100644
--- a/veilid-core/src/network_manager/wasm/mod.rs
+++ b/veilid-core/src/network_manager/wasm/mod.rs
@@ -1,10 +1,8 @@
 mod protocol;
 
-use crate::connection_manager::*;
-use crate::network_manager::*;
+use super::*;
 use crate::routing_table::*;
-use crate::intf::*;
-use crate::*;
+use connection_manager::*;
 use protocol::ws::WebsocketProtocolHandler;
 pub use protocol::*;
 
@@ -102,11 +100,11 @@ impl Network {
         // Try to send to the exact existing connection if one exists
         if let Some(conn) = self.connection_manager().get_connection(descriptor).await {
             // connection exists, send over it
-            conn.send(data).await.map_err(logthru_net!())?;
+            conn.send_async(data).await.map_err(logthru_net!())?;
 
             // Network accounting
             self.network_manager()
-                .stats_packet_sent(descriptor.remote.to_socket_addr().ip(), data_len as u64);
+                .stats_packet_sent(descriptor.remote().to_socket_addr().ip(), data_len as u64);
 
             // Data was consumed
             Ok(None)
@@ -136,7 +134,7 @@ impl Network {
             .get_or_create_connection(None, dial_info.clone())
             .await?;
 
-        let res = conn.send(data).await.map_err(logthru_net!(error));
+        let res = conn.send_async(data).await.map_err(logthru_net!(error));
         if res.is_ok() {
             // Network accounting
             self.network_manager()
diff --git a/veilid-core/src/network_manager/wasm/protocol/mod.rs b/veilid-core/src/network_manager/wasm/protocol/mod.rs
index 717c3d34..3b7d5884 100644
--- a/veilid-core/src/network_manager/wasm/protocol/mod.rs
+++ b/veilid-core/src/network_manager/wasm/protocol/mod.rs
@@ -1,9 +1,8 @@
 pub mod wrtc;
 pub mod ws;
 
-use crate::network_connection::*;
+use super::*;
 use crate::xx::*;
-use crate::*;
 
 #[derive(Debug)]
 pub enum ProtocolNetworkConnection {
@@ -16,7 +15,7 @@ impl ProtocolNetworkConnection {
     pub async fn connect(
         local_address: Option<SocketAddr>,
         dial_info: DialInfo,
-    ) -> Result<NetworkConnection, String> {
+    ) -> Result<ProtocolNetworkConnection, String> {
         match dial_info.protocol_type() {
             ProtocolType::UDP => {
                 panic!("UDP dial info is not support on WASM targets");
@@ -46,6 +45,14 @@ impl ProtocolNetworkConnection {
             }
         }
     }
+
+    pub fn descriptor(&self) -> ConnectionDescriptor {
+        match self {
+            Self::Dummy(d) => d.descriptor(),
+            Self::Ws(w) => w.descriptor(),
+        }
+    }
+
     pub async fn close(&self) -> Result<(), String> {
         match self {
             Self::Dummy(d) => d.close(),
diff --git a/veilid-core/src/network_manager/wasm/protocol/ws.rs b/veilid-core/src/network_manager/wasm/protocol/ws.rs
index 4c3d35b8..f2952570 100644
--- a/veilid-core/src/network_manager/wasm/protocol/ws.rs
+++ b/veilid-core/src/network_manager/wasm/protocol/ws.rs
@@ -1,8 +1,4 @@
-use crate::intf::*;
-use crate::network_connection::*;
-use crate::network_manager::MAX_MESSAGE_SIZE;
-use crate::*;
-use alloc::fmt;
+use super::*;
 use ws_stream_wasm::*;
 use futures_util::{StreamExt, SinkExt};
 
@@ -104,10 +100,9 @@ impl WebsocketProtocolHandler {
 
         // Make our connection descriptor
 
-        Ok(ProtocolNetworkConnection::Ws(WebsocketNetworkConnection::new(ConnectionDescriptor {
-            local: None,
-            remote: dial_info.to_peer_address(),
-        }, wsmeta, wsio)))
+        Ok(ProtocolNetworkConnection::Ws(WebsocketNetworkConnection::new(ConnectionDescriptor::new_no_local(
+            dial_info.to_peer_address(),
+        ), wsmeta, wsio)))
     }
 
     pub async fn send_unbound_message(dial_info: DialInfo, data: Vec<u8>) -> Result<(), String> {
diff --git a/veilid-core/src/tests/common/mod.rs b/veilid-core/src/tests/common/mod.rs
index f0fbc066..eaae93db 100644
--- a/veilid-core/src/tests/common/mod.rs
+++ b/veilid-core/src/tests/common/mod.rs
@@ -3,3 +3,8 @@ pub mod test_protected_store;
 pub mod test_table_store;
 pub mod test_veilid_config;
 pub mod test_veilid_core;
+
+use super::*;
+
+pub use dht::tests::*;
+pub use network_manager::tests::*;
diff --git a/veilid-core/src/tests/mod.rs b/veilid-core/src/tests/mod.rs
index 0b6b6216..a4bdf876 100644
--- a/veilid-core/src/tests/mod.rs
+++ b/veilid-core/src/tests/mod.rs
@@ -1,3 +1,5 @@
 pub mod common;
 #[cfg(not(target_arch = "wasm32"))]
 mod native;
+
+use super::*;
diff --git a/veilid-core/src/veilid_api/mod.rs b/veilid-core/src/veilid_api/mod.rs
index ad9a0ffe..5250ba74 100644
--- a/veilid-core/src/veilid_api/mod.rs
+++ b/veilid-core/src/veilid_api/mod.rs
@@ -1133,13 +1133,24 @@ impl DialInfo {
             }
         };
 
-        let socket_addrs = match split_url.host {
-            SplitUrlHost::Hostname(_) => split_url
-                .host_port(port)
-                .to_socket_addrs()
-                .map_err(|_| parse_error!("couldn't resolve hostname in url", url))?
-                .collect(),
-            SplitUrlHost::IpAddr(a) => vec![SocketAddr::new(a, port)],
+        let socket_addrs = {
+            // Resolve if possible, WASM doesn't support resolution and doesn't need it to connect to the dialinfo
+            // This will not be used on signed dialinfo, only for bootstrapping, so we don't need to worry about
+            // the '0.0.0.0' address being propagated across the routing table
+            cfg_if::cfg_if! {
+                if #[cfg(target_arch = "wasm32")] {
+                    vec![SocketAddr::new(IpAddr::V4(Ipv4Addr::new(0,0,0,0)), port)]
+                } else {
+                    match split_url.host {
+                        SplitUrlHost::Hostname(_) => split_url
+                            .host_port(port)
+                            .to_socket_addrs()
+                            .map_err(|_| parse_error!("couldn't resolve hostname in url", url))?
+                            .collect(),
+                        SplitUrlHost::IpAddr(a) => vec![SocketAddr::new(a, port)],
+                    }
+                }
+            }
         };
 
         let mut out = Vec::new();
diff --git a/veilid-core/src/xx/tools.rs b/veilid-core/src/xx/tools.rs
index 232f4c30..dbaca60e 100644
--- a/veilid-core/src/xx/tools.rs
+++ b/veilid-core/src/xx/tools.rs
@@ -229,7 +229,7 @@ cfg_if::cfg_if! {
             Ok(())
         }
     } else {
-        pub fn ensure_file_private_owner<P:AsRef<Path>>(path: P) -> Result<(),String>
+        pub fn ensure_file_private_owner<P:AsRef<Path>>(_path: P) -> Result<(),String>
         {
             Ok(())
         }
diff --git a/veilid-core/tests/node.rs b/veilid-core/tests/node.rs
index 3bc717af..547456c3 100644
--- a/veilid-core/tests/node.rs
+++ b/veilid-core/tests/node.rs
@@ -3,7 +3,6 @@
 
 use veilid_core::tests::common::*;
 use veilid_core::xx::*;
-use veilid_core::*;
 use wasm_bindgen_test::*;
 
 wasm_bindgen_test_configure!();
@@ -16,7 +15,7 @@ static SETUP_ONCE: Once = Once::new();
 pub fn setup() -> () {
     SETUP_ONCE.call_once(|| {
         console_error_panic_hook::set_once();
-        wasm_logger::init(wasm_logger::Config::new(Level::Trace));
+        wasm_logger::init(wasm_logger::Config::new(log::Level::Trace));
     });
 }
 
diff --git a/veilid-core/tests/web.rs b/veilid-core/tests/web.rs
index d5abfe3b..bc93ae4c 100644
--- a/veilid-core/tests/web.rs
+++ b/veilid-core/tests/web.rs
@@ -3,7 +3,6 @@
 
 use veilid_core::tests::common::*;
 use veilid_core::xx::*;
-use veilid_core::*;
 use wasm_bindgen_test::*;
 
 wasm_bindgen_test_configure!(run_in_browser);
@@ -16,7 +15,11 @@ static SETUP_ONCE: Once = Once::new();
 pub fn setup() -> () {
     SETUP_ONCE.call_once(|| {
         console_error_panic_hook::set_once();
-        wasm_logger::init(wasm_logger::Config::new(Level::Trace));
+        let mut builder = tracing_wasm::WASMLayerConfigBuilder::new();
+        builder.set_report_logs_in_timings(false);
+        builder.set_max_level(Level::TRACE);
+        builder.set_console_config(tracing_wasm::ConsoleConfig::ReportWithConsoleColor);
+        tracing_wasm::set_as_global_default_with_config(builder.build());
     });
 }
 
diff --git a/veilid-core/veilid-core-node/.gitignore b/veilid-core/veilid-core-node/.gitignore
deleted file mode 100644
index 1f22b9c2..00000000
--- a/veilid-core/veilid-core-node/.gitignore
+++ /dev/null
@@ -1,116 +0,0 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Microbundle cache
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variables file
-.env
-.env.test
-
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# yarn v2
-.yarn/cache
-.yarn/unplugged
-.yarn/build-state.yml
-.yarn/install-state.gz
-.pnp.*
diff --git a/veilid-core/veilid-core-node/index.js b/veilid-core/veilid-core-node/index.js
deleted file mode 100644
index ee691253..00000000
--- a/veilid-core/veilid-core-node/index.js
+++ /dev/null
@@ -1 +0,0 @@
-exports.keytar = require("keytar");
diff --git a/veilid-core/veilid-core-node/package.json b/veilid-core/veilid-core-node/package.json
deleted file mode 100644
index 89733059..00000000
--- a/veilid-core/veilid-core-node/package.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "name": "veilid-core-node",
-  "version": "1.0.0",
-  "description": "",
-  "main": "index.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "author": "",
-  "license": "ISC",
-  "dependencies": {
-    "keytar": "^6.0.1"
-  }
-}
diff --git a/veilid-server/src/settings.rs b/veilid-server/src/settings.rs
index d22a36b5..a4059dcc 100644
--- a/veilid-server/src/settings.rs
+++ b/veilid-server/src/settings.rs
@@ -96,8 +96,8 @@ core:
         enable_local_peer_scope: false
         restricted_nat_retries: 0
         tls:
-            certificate_path: '%CERTIFICATE_DIRECTORY%/server.crt'
-            private_key_path: '%PRIVATE_KEY_DIRECTORY%/server.key'
+            certificate_path: '%CERTIFICATE_PATH%'
+            private_key_path: '%PRIVATE_KEY_PATH%'
             connection_initial_timeout_ms: 2000
         application:
             https:
@@ -151,12 +151,16 @@ core:
         &Settings::get_default_protected_store_insecure_fallback_directory().to_string_lossy(),
     )
     .replace(
-        "%CERTIFICATE_DIRECTORY%",
-        &Settings::get_default_certificate_directory().to_string_lossy(),
+        "%CERTIFICATE_PATH%",
+        &Settings::get_default_certificate_directory()
+            .join("server.crt")
+            .to_string_lossy(),
     )
     .replace(
-        "%PRIVATE_KEY_DIRECTORY%",
-        &Settings::get_default_private_key_directory().to_string_lossy(),
+        "%PRIVATE_KEY_PATH%",
+        &Settings::get_default_private_key_directory()
+            .join("server.key")
+            .to_string_lossy(),
     );
     config::Config::builder()
         .add_source(config::File::from_str(
@@ -1439,7 +1443,7 @@ mod tests {
         //
         assert_eq!(
             s.core.network.bootstrap,
-            vec!["bootstrap.veilid.net".to_owned()]
+            vec!["bootstrap-dev.veilid.net".to_owned()]
         );
         assert_eq!(s.core.network.bootstrap_nodes, vec![]);
         //
@@ -1460,25 +1464,25 @@ mod tests {
         assert_eq!(s.core.network.dht.set_value_timeout_ms, None);
         assert_eq!(s.core.network.dht.set_value_count, 20u32);
         assert_eq!(s.core.network.dht.set_value_fanout, 5u32);
-        assert_eq!(s.core.network.dht.min_peer_count, 20u32);
+        assert_eq!(s.core.network.dht.min_peer_count, 1u32);
         assert_eq!(s.core.network.dht.min_peer_refresh_time_ms, 2_000u32);
         assert_eq!(
             s.core.network.dht.validate_dial_info_receipt_time_ms,
-            5_000u32
+            2_000u32
         );
         //
         assert_eq!(s.core.network.upnp, false);
         assert_eq!(s.core.network.natpmp, false);
         assert_eq!(s.core.network.enable_local_peer_scope, false);
-        assert_eq!(s.core.network.restricted_nat_retries, 3u32);
+        assert_eq!(s.core.network.restricted_nat_retries, 0u32);
         //
         assert_eq!(
             s.core.network.tls.certificate_path,
-            std::path::PathBuf::from("/etc/veilid-server/server.crt")
+            Settings::get_default_certificate_directory().join("server.crt")
         );
         assert_eq!(
             s.core.network.tls.private_key_path,
-            std::path::PathBuf::from("/etc/veilid-server/private/server.key")
+            Settings::get_default_private_key_directory().join("server.key")
         );
         assert_eq!(s.core.network.tls.connection_initial_timeout_ms, 2_000u32);
         //