Technical
operator guide.

01 / FIELD GUIDEFind the right screen

The native navigation contains Recents, Contacts, Channels, Discover and Trending. Open an existing contact or channel for its Talk, Users and History surfaces. Account, microphone, audio routing and native connection state still come from Zello; Lab controls add functions around that state.

Open Developer from the main three-dot menu to enter Zello Lab. Its four destinations are Live Log, Tools, Sessions & evidence, and Status & settings. Tools can be searched by name, group or description. Use Status & settings → Technical operator guide for the complete online instructions. Zello’s original diagnostics remain separately labelled.

Main menu and Options. Quick Start, its offline help page and welcome sound/vibration are removed. The technical operator guide is available from Options and Lab → Status & settings. The existing Theme shortcut still opens appearance controls.

Support. The red Vermilion heading sits above Build 159 · 7.12.1. This line follows the installed rolling build number; the original copyright remains. The website opens https://zellomods.cc/. Below it, Built By Dan credits the author, followed by testers B L A D E, SUDO, Mr. Grey, Sleepy, JerzyTrash and JayBee. Adjust permissions, Advanced settings and Third party info remain; Help, Report a problem and Privacy policy buttons are removed from this screen.

Third party info. Vermilion additions are colored red, including bundled Signalsmith voice-processing and Frida instrumentation notices, and acknowledgments for the development tools. The original third-party notices remain intact. These credits are informational; opening them does not activate instrumentation.

Tools do not require an app PIN or license. Offline availability means the controls and local analysis remain accessible; an action that needs Zello connectivity still needs a usable signed-in runtime. A stale reporting reply does not lock the tools.

Prepare a useful test

Record the app build, screen, signed-in test account, selected target, network type, Raw state and instrumentation state before reproducing a problem. Use accounts and channels you control or are authorized to test. Change one relevant variable at a time.

1. Establish the ordinary result before enabling an experimental action.
2. Start Raw if the investigation needs native/request evidence. Opening Lab alone does not start it.
3. Use Mark moment immediately before the action, then perform one deliberate action.
4. Preserve the exact response and the final visible/native state. Mark the end if the sequence is long.
5. Stop capture, wait for finalization, and save the relevant local exports before destructive cleanup.

Separate these claims in your notes: control pressed → request constructed → request sent → response observed → state applied. Evidence of an earlier step does not establish a later one. A role badge, queued message or “removed” label requires its own interpretation.

The current guide is grounded in retained source and accepted feature behavior. It is not a claim that every network, account and device combination was retested for this documentation update. State missing coverage explicitly rather than filling a gap with an assumption.

Discover: catalog, filters and saved state

Background behavior: Discover pauses its recurring list rebuild when the pane is off-screen, including after Home or switching to another tab. It resumes on the next visible refresh. Background imports and explicitly pending channel-open actions continue; hiding Discover does not cancel them. This does not change ZTool or audio timing.

Discover is a catalog view. It is not an exhaustive live census of Zello. A row can come from current catalog information, a previous observation or optional historical information; inclusion alone does not prove the channel is currently joinable.

Search channels narrows the loaded catalog. Filters exposes type, saved/joined visibility and history controls. Filters combine, so a restrictive type plus a search phrase can hide an otherwise present entry. Clear them before investigating a supposedly missing channel. Refresh retrieves catalog information; the status line explains loading, retained information or errors. Tap a compact status line when the full explanation is needed.

Check names, Add All, All on and All off remain separate actions, including after additions finish. Turning saved channels off preserves their names in the client. Opening information or applying a filter is not a connection command.

Check names without changing the client list

Use Discover → Check names when you have candidate spellings and want observations before deciding what to save. Paste one spelling per line. The current limit is 500 distinct candidates. This is an explicit network lookup, even though it does not change your saved list.

1. Sign in and confirm the native runtime is connected.
2. Open Check names, paste the candidates and start the check.
3. Review the running status. Lookups execute sequentially, with a short pause after each completed lookup.
4. Open RESULTS to review results; REFRESH updates that view.
5. Use STOP CHECKS when needed. It prevents subsequent lookups after the current one finishes. Changing accounts also stops later checks.

This path constructs a detached channel model and requests metadata. It does not add, subscribe, join, connect or recreate channels. Candidate input does not automatically publish those names into the public catalog. Keep interesting spellings and their result context for later review.

The list is a research aid, not a name-registration guarantee. A guessed name that was never found and a previously observed channel that later disappeared are different evidence cases.

Channel types, removed names and counts

Zelect+ is a Discovery type filter, not an application edition or an extra download. Current metadata interpretation gives Broadcast precedence, then Zelect+, then Zelect, otherwise Open. Password protection is separate from that type. Missing metadata remains unknown rather than being forced into Open.

For technical comparisons, the native flag observations used by this client are Broadcast 2, Zelect+ 8, Zelect 4, and password 1. Preserve the raw flags with their observation if investigating a conflicting label. Combined flags are resolved by the precedence above; labels are not independent promises about your account’s permissions.

The historical “channel removed” message still exists in the client. Its observation does not identify who removed the channel. An explicit native absence may also reflect a name that never existed. To prioritize recreation review, retain the exact spelling, whether it was previously found, the old and new observations, and the response context. Verify current availability separately before attempting creation. No automatic recreation is built into Check names.

Online users, subscriber totals, saved contacts and activity reporters are different counts. Never replace an unavailable online-user measurement with a subscriber total. A field displaying zero may reflect a real zero or an unestablished/stale observation; inspect its source and freshness before drawing a conclusion.

Add All: progress, failures and stopping

Add All is a subscription workflow, separate from name checking. Review the filtered visible set and count before confirming. Historical/unavailable entries are not ordinary bulk-add targets.

The current bulk path requires native metadata before inserting a new local entry. Missing, restricted or incomplete responses are skipped instead of creating a guessed placeholder. A local row and an accepted subscription are tracked as different outcomes. The workflow waits for native results; it no longer relies on a blind retry pass at the end.

Read the progress fields together: requested work, processed work, accepted native results, failures/skips and outstanding work. “Processed” does not mean every name was successfully subscribed. “Queued” describes pending work, not completion. A slow tail may be waiting on remaining native callbacks rather than actively adding names.

Stop adding · finish outstanding work stops queued names and lets outstanding work settle. Late receipts can still be retained after completion; this is not an automatic restart. If the run appears stuck, note the same counters twice, preserve the status and relevant trace, then stop deliberately instead of launching another bulk pass over uncertain state.

After completion, use All on / All off for connection state. Do not rerun Add All merely to turn saved channels on. For an individual problem row, inspect information and use its explicit action only after the preceding operation has finished.

Trending: activity and freshness

Trending ranks recently reported activity in a rolling five-minute window. The window changes as observations enter and expire. It is not a list of the channels with the largest subscriber totals, and it is not a guarantee that someone is speaking at the instant you open a row.

A channel can remain trending after its recent activity ended. Likewise, a displayed online count can be stale or unavailable while activity evidence still qualifies it for the window. Record these separately: the activity/window label, the online-user field, the time displayed, and whether a refresh succeeded.

When refreshing appears slow:

1. Read the complete status, including any retained/cached result or retry explanation.
2. Distinguish a spinner that keeps running from a request that completed but produced no new rows.
3. In Live Log, correlate the refresh attempt with transport outcome and the later display observation where those records are available.
4. Check reporting freshness in Status & settings without assuming it describes Zello’s channel service.
5. Preserve one timed reproduction. Repeated taps can obscure which response belongs to which attempt.

An empty result can be a valid empty activity window. A timeout is not a valid empty result. A displayed list is not proof that all older clients reported every channel. Recents grouping, import throughput and audio behavior are separate observations; do not fold them into a Trending diagnosis without evidence.

Voices, effects and local preview

The VOICE control is on the Talk surface. Tap it to toggle processing; hold it to open Outgoing voice. Selecting a tile stores the preset. If processing is already on, the choice changes the active mode; selecting while off does not itself turn processing on. Cancel leaves the selection unchanged.

Build 149 retains the classic opaque two-column chooser and adds Velvet Smooth, bringing the library to 33 voices. Original Velvet Low, Crystal High and all other existing presets keep their sound. A fixed Effects & preview button sits directly above Cancel in the first long-press menu. The workshop retains its solid dark panels, outlined controls, tuning, saved variations and local preview. Voice Marquee can include Velvet Smooth. ZTool keeps its position and acquisition/release timing.

The labels “Privacy” and “AI Synth” do not establish anonymity or a neural voice-conversion engine. These bundled effects process outgoing PCM before encoding; they do not transform every sound played by the phone. Pitch colors are effects, not realistic identity conversion or an imitation of a named person.

Voice workshop controls apply to the remembered voice. The voice selector also changes the active voice when VOICE is already enabled. The separate VOICE toggle remains the on/off control for live processing.

Changes to continuous controls are smoothed. Preset or sample-rate changes reset that stream's state; a new effect starts with empty effect buffers. Delay/reverb tails only exist while samples are being processed. They do not extend a live PTT transmission after release. High levels can activate the limiter; lower output if the result sounds compressed or rough.

What “100%” means. Voice strength selects the blend between the original signal and the tuned preset output. At 100%, you hear that output, which may already contain its own mixture of original and shifted sound. It does not maximize pitch, distortion, chorus speed or every other internal parameter. Output level changes gain, while Effect amount changes the separate extra effect. Use Tune voice for the new independent parameters below.

Pitch and timbre. Pitch is how high or low a voice sounds; formants are resonances that help give vowels their character. The original pitch colors move pitch and spectral structure together, then apply tone shaping. Velvet Smooth uses a separate formant-aware engine with a fixed fuller character. Its Pitch offset changes pitch while compensating the vocal resonances. Its EQ and dynamics remain independently adjustable. Studio Clean is a restrained level-control preset, not a background-noise remover.

Using Velvet Smooth. Hold VOICE, choose Velvet Smooth at the end of the voice list, and use the normal VOICE toggle. For a local comparison, open Effects & preview, record yourself and select Original/Processed. Velvet Low remains the original version; Crystal High is unchanged. Saved variations remember the selected voice, so existing Velvet/Crystal variations keep their original engine.

Preparation and timing. Opening the voice menu or workshop prepares the bundled engine in the background. The workshop displays its readiness. Until preparation finishes, Velvet Smooth uses original Velvet for the current audio session; the prepared sound begins on a later session. Unsupported devices or formats also retain that fallback. No download is required. The new sound buffers about 40 ms of voice audio; this is separate from processing time, codec/network delay or ZTool's control timing. It does not extend microphone ownership. A sudden end of transmission may omit the final buffered audio; do not treat preview tails as a promise of extra live transmission time.

Marquee and Velvet Smooth. Include the new voice in the Marquee pool to cycle through it. Existing saved pools retain their selections. Stop still restores the starting voice and settings. Short transitions between voices with different buffering can briefly sound layered; use a smaller pool or slower changes if that texture is distracting.

Voice Marquee: voices in motion

Open Effects & preview → Voice Marquee. Choose the voices to include, or use All voices. Set Time between voices (0.8–12 seconds; shorter is faster) and Variation amount (0–100%; higher moves tone and character settings further). Each selected voice is visited before the pool repeats, with small timing variations and short smooth transitions. At least one voice must remain selected. Voice changes, tone movement and extra-effect amount follow different rhythms.

Tap Start Marquee. It temporarily enables the shuffle even if VOICE was off, but does not acquire the microphone or start ZTool. Changes advance while outgoing audio is processed and pause between transmissions. Hold current sound pauses further automation; Resume changes continues it. Stop Marquee · Restore restores the starting voice and VOICE on/off state. Your saved tuning and named variations are not overwritten. Tapping VOICE off also ends Marquee. After an app restart, Marquee is off and the saved settings remain.

Stop Marquee before editing its pool/speed/variation or the ordinary voice settings. Done closes the page while leaving Marquee in its current state. To listen locally, return to the workshop, load Demo or record your own short clip, then choose Processed. This starts an independent preview shuffle with the same choices; it does not consume the live shuffle's position. The existing preview controls still require ZTool/repeat off and native Ready. Closing or backgrounding the workshop clears the preview clip; it does not silently disable the armed live Marquee.

Factory voices and the ten extra-effect algorithms are unchanged. Marquee changes their selection and settings temporarily. Output gain is not randomized. At 0% variation, the selected voices still cycle using their saved tuning and the starting extra effect. The feature adds no delay to ZTool acquisition/retry/release controls. Its DSP processing measurements are not network or end-to-end voice latency.

What the controls sound like

Tune voice: Tone and Dynamics

Choose a preset, then open Tune voice. The three page buttons keep related controls together. Drag a slider or use its minus/plus buttons for repeatable steps. Changes apply to that voice's remembered settings and to live processing when that voice is enabled. The separate VOICE toggle still controls whether live processing runs.

Pitch offset is a second pitch stage when nonzero and can add algorithmic delay. It does not preserve or independently control formants. Zero offsets retain the untouched presets' factory tone, but Studio Clean and Warm Broadcast have intentional nonzero factory EQ/dynamics settings. Use RESET THIS VOICE to restore the actual factory tuning; setting every slider to zero is not equivalent. This reset affects only the selected voice's tuning, leaving the global effect/output controls and saved variations alone.

Tune voice: Character

Drive is available for every voice. The remaining controls appear only where they have a defined role, so the accepted standalone extra effects retain their familiar behavior.

Telephone now uses steeper speech-band filtering with restrained earpiece resonance. Megaphone uses a stronger horn-like resonance and more drive. Cyber Chorus has three moving delay voices. Glitch repeats real millisecond-sized segments with softened boundaries. Studio Clean adds rumble filtering, compression and de-essing; Warm Broadcast adds speech dynamics, warmth and restrained saturation. These six factory sounds are the new listening targets. The character controls do not change the separate extra-effect bank.

Save, load and compare variations

1. Choose a voice and adjust its tuning, extra effect, Voice strength, Output level and Effect amount.
2. Open Saved variations, enter a unique name of 1–32 characters, and tap SAVE CURRENT. Up to 20 variations fit; an existing name is not silently overwritten.
3. Tap a saved row to load its voice and settings. VOICE stays on or off as it was. The current audition clip remains available for another Processed comparison.
4. Delete removes that saved copy and closes the list; it does not reset the currently active sound. Factory presets are never deleted by this list.
5. Use Match preview loudness to compare character without simply favoring the louder result. The processed clip is adjusted toward the original's RMS level, with a maximum boost of 2× and headroom for the entire effect tail. Matching can therefore stop short of equal loudness when peak headroom is limiting. The completion message shows the applied gain.

Matching affects only the local processed audition. Disable it when judging the live Output level or Makeup gain. The live encoder path is not normalized by this preview option. Variations are local settings; this feature does not upload or export the recorded clip.

Local A/B preview procedure

1. Stop ZTool/repeat and wait for the native Talk state to be Ready. Preview refuses to begin while the observed PTT workflow is active or its readiness cannot be established.
2. Open Effects & preview and select the voice and extra effect. Settings are remembered for live use, but opening the workshop never enables VOICE or transmits.
3. Tap Demo to load three seconds of synthetic voiced sound without using the microphone. This demonstrates effects; it is not a speech-naturalness test. Alternatively, tap Record yourself to capture up to eight seconds locally. Microphone permission must already be granted; check the Android app permission if recording is unavailable.
4. Tap Stop to finish recording early. A nonempty recorded clip remains available. Read the status message; an unavailable microphone or read failure is distinct from a silent or empty clip.
5. Tap Original, then Processed, to hear the same clip through Android media playback. Preview uses its own processor state and does not change live audio history. The processed audition includes one extra second of silence so you can hear effect decay; this is separate from live PTT duration.
6. Playback and recording disable the other workshop controls until they finish; Stop and Close remain available. Changes in observed PTT activity interrupt the preview. Closing or backgrounding stops it and clears the in-memory clip. Clear clip discards it explicitly. There is no preview audio upload or clip export.
7. After a processed preview, read total DSP time, the p95 processing bound, maximum block time, overrun count, limited-sample count and preview-match gain. The live summary also includes p50/p95/p99 bounds. Percentiles use 0.25 ms buckets and are upper bounds, not exact timings of individual ranked blocks. These measure processing work, not microphone-to-speaker or network latency. The live summary is cumulative for the current app process, not a count of delivered messages. Processing counters exclude local playback, preview normalization and configuration work.

For listening comparisons, keep microphone distance, phrase and playback level consistent. Check initial consonants, sustained vowels, quiet endings and loud phrases. Compare output distortion separately from whether you like the effect. Host synthetic checks cover sample rates from 8 to 96 kHz and arbitrary frame boundaries; real speech and handset playback still require listening. The local preview records mono 16 kHz audio, so it is not an acoustic match for every live codec or device route.

Understanding time measurements. Processing time is the time spent calculating an audio block. Algorithmic delay comes from audio history or lookahead needed by an effect. Mouth-to-ear delay also includes microphone buffers, encoding, network delivery, receiver buffers and playback. A block processed in 10 ms does not establish 10 ms total latency. A zero processing-overrun count does not prove that every hardware or network buffer delivered without interruption. This workshop provides record-then-play comparison; it is not continuous live headphone monitoring.

No downloadable voice packs, remote voice engine or added package is used. Voice/effect controls and DSP are bundled in the app. Broader performance and speech-quality tuning can continue without redesigning the classic chooser.

Talk and ZTool state behavior

The main Talk control follows the native press/release lifecycle. Its shape is a visual preference; the control still has a real touch target and native Ready, Receiving and Sending state. Animation alone is not delivery confirmation.

ZTool is channel-only and uses the existing auxiliary control. Its acquisition behavior allows at most one native candidate at a time. It may arm while Ready or Receiving. Another attempt is eligible after the preceding candidate clears or is rejected; it is not a periodic request flood. Once Sending is observed, acquisition stops. The retained repeat interval is 10 seconds measured from observed Sending.

Talk, Users and History retain same-channel continuity. Build151 also lets an armed ZTool session continue when Home, another app or the lock screen covers Talk. Stock toggle keeps its native background behavior. Leaving the conversation, closing its Activity, losing microphone permission or receiving a phone call are different from covering its window and can end the session. Native floor loss, server limits and network failures still apply.

Keep music or video playing while transmitting

Start Spotify or another media app, then use stock PTT or ZTool normally. Lab no longer requests audio focus that pauses or ducks the other player during its ordinary PTT/playback path. Your music continues through button presses, releases and ZTool’s repeating transmissions; Lab never pauses, restarts or seeks the external player. This behavior is enabled automatically and has no new mode to arm.

The external audio plays on your phone/headset. It is not digitally inserted into the outgoing message. Sound from your speaker can still be picked up acoustically by your microphone. AUDIO’s prepared-file mixing remains a separate feature with its own transmission-following position.

While PTT is active, the Active PTT notification distinguishes Transmitting, Connecting and Waiting for the microphone. Tap Stop to stop the current transmission/ZTool and disarm AUDIO; it does not stop Spotify. Tap the notification body to return to Lab. Allow Lab notifications to keep this shortcut visible.

Start the session while Lab is open, then press Home or switch apps. ZTool’s existing one-at-a-time acquisition and ten-second repeat rules remain. A phone call interrupts the session; start it again yourself afterward. Keeping the floor during calls is not included. Bluetooth communication-mode changes, another app’s own playback rules, system microphone priority, process termination and server/network events can still interrupt audio. Report the route and exact transition if a dip or drop remains.

When investigating, capture both the control state and the native response sequence. Stop from the existing control before changing the test setup. Do not infer a general speed improvement from a short idle CPU sample.

Sandbox Multicast: record once, send after release

Open Tools → Sandbox Multicast for the explanation and use the existing Sandbox Talk control on Channels. Its eligible set comes from current connected, untrusted channel state; the displayed target count is the operator’s first preflight. A trust flag alone is not permission to send to an unrelated channel.

This is record once, fan out after release. It is not multiple simultaneous live microphone transmissions while the button is held. Hold to record the utterance; release submits the completed recording to eligible targets. The app checks target state again before sending.

Prerequisites include microphone permission, an eligible connected target set, no conflicting active transmission and a usable encoder. If the control reports no eligible channels, resolve the native saved/connection state instead of assuming the tool has been disabled remotely.

Before repeating a failed attempt, confirm whether any target already accepted it. Otherwise a retry can duplicate audio for a target that succeeded while another failed.

History audio, invitations and media helpers

History audio export. Tap a completed message to play it. To open its actions, hold the History row for at least 0.9 seconds, then release; the menu appears after your finger lifts. Shorter holds do not open the action menu. Taps and scrubbing retain their normal playback behavior; movement cancels the pending menu. Tap Save audio as a separate action. For several messages, enter the existing audio selection mode, select rows or Select all audio, then use Save selected audio. The selection path retains checkboxes and combines available completed audio into an exported Ogg Opus file. Read the saved/skipped counts; an unavailable or incomplete message is not silently equivalent to a successful export. The chosen rows define the export, not every remote message ever sent to that channel.

AUDIO companion: mix a recording with your microphone

Where you hear it. The selected recording is mixed into the outgoing transmission. Other listeners hear it live; the transmitting phone stays silent during the send. Replay the completed outgoing message in History to hear the result on that phone, or use Echo to receive it back. Silent local output during transmission is expected; it does not mean the recording failed. There is no live local monitor.

On Talk, tap AUDIO beside VOICE, below or outside the microphone circle. The panel has a solid background; Arm, Pause and Stop stay visible below its scrolling settings. Use it for the currently selected contact or channel. ZTool remains channel-only. The AUDIO button does not press PTT, join a channel or change ZTool’s acquisition/repeat rules.

1. Export completed history audio, or put an MP3, PCM WAV, Ogg Opus or Ogg Vorbis recording on the device. The usual export folder is Downloads / ZelloLab / History.
2. Tap Import recording and select the file in Android’s picker. Lab copies it into the local Soundboard library and prepares it in the background. Return to AUDIO and wait for READY, the filename and duration. The complete clip is decoded before arming; longer files take longer to prepare.
3. Set Microphone level and Recording level. Defaults are 100% mic and 65% recording. Both range from 0–125%. Voice effects process your live microphone before the saved recording is mixed in; the saved recording itself is not processed a second time.
4. Set Resume rewind from 0–3 seconds; the default is 1 second. It repeats that much of the recording after an actual transmission interruption. It is separate from ZTool timing.
5. Tap Arm next transmission, check the displayed target, then Done. Use stock PTT or ZTool normally. If you arm during an existing transmission, the recording waits for the next one.
6. The cursor advances when the native encoder accepts mixed audio during Sending. Waiting or connecting never consumes the recording. Release/loss pauses it. The next Sending resumes with the selected rewind.
7. At DONE, ordinary live microphone audio continues through the existing PTT lifecycle. The clip never holds the microphone longer to finish. Tap Arm to replay from the start; seeking after completion leaves autoplay disarmed until you arm it.

Reading the state. PREPARE means loading/decoding. READY means selected but disarmed. WAIT means armed without recent accepted mixed encoding. PLAY means recent mixed encoding; PAUSED means the clip is deliberately paused. BUFFER means the prepared window is missing the requested samples. DONE means the clip reached its end. These are local playback states, not acknowledgements that a remote recipient heard the sound.

Levels and timing. The two level settings and rewind are remembered. The saved library, favorites, trims and metadata survive restart. The current prepared selection, draft queue and armed state do not survive an app process restart; select, prepare and arm again. Lower either level if speech and recording sound crowded; the mixer limits peaks but cannot make an already distorted source clean. The panel reports accepted frames, samples mixed, buffer misses, rejected frames and mixer processing time. Separate microphone, recording and mixed-output meters show the most recent mixed frame in dBFS before native encoding: values near −90 indicate silence; values nearer 0 are louder. The microphone meter reflects voice effects and its mix level. If recording is silent while the cursor advances, try another part of the file. Meters do not prove remote playback. These measurements cover local mixing, not decoding time, voice DSP, codec/network delay or acoustic latency. A frame already handed to native encoding cannot be recalled by Pause or Stop.

Preparation and formats. AUDIO supports MP3 (including variable bitrate), Ogg Vorbis, Ogg Opus and standard PCM WAV through Android’s platform extractors and decoders. An .ogg extension alone does not identify its codec. Additional high-depth WAV variants depend on the device; a protected, damaged or unsupported file produces a preparation error. No downloadable codec pack is required. Audio is downmixed to mono, trimmed and resampled before arming. Source preparation is limited to 256 MiB decoded; the prepared mono24 kHz queue has the same limit (about93 minutes). Long individual source files can reach the source limit before the final queue limit. Originals stay unchanged. During transmission the existing mixer reads prepared windows without file I/O or waiting; microphone capture keeps its existing buffering.

Soundboard pads and favorites. Open Soundboard & recordings from AUDIO. Six original built-in tones are included: Soft chime, Double chirp, Radio start, Radio end, Low alert and Bright sparkle. They are generated locally and require no sound download. Import your own compatible recordings for other sounds. The local library holds up to128 clips and512 MiB of imported originals. Removing a pad deletes its library copy and settings, preserving the original file selected from Android’s picker. Built-ins are created once; removing one does not silently restore it on the next visit.

Tap a pad to prepare it, then return to AUDIO, check READY and the target, and explicitly Arm next transmission. A pad never presses PTT. Favorites only filters saved starred pads. Hold a pad to edit its name, favorite status, trim, level and metadata. Trim values use seconds: for example, start 12.5 and end 18 selects5.5 seconds. A blank end means the end of the recording. Settings apply on the next preparation. Pad level ranges0–125% and is applied before the overall Recording level; 50% pad and65% recording gives32.5% of the source’s amplitude before mixing/limiting. Lower levels if the original is loud or distorted.

Build a queue. Turn on Add pads to queue, then tap pads in playback order. Repeated taps repeat that sound; the draft holds up to16 entries. Review the numbered draft and tap Prepare queue. Different formats/rates, trims and pad levels are rendered into one prepared timeline before arming. Return to AUDIO and use the same Arm/Pause/Stop/seek controls. The cursor and rewind span the whole queue, so a rewind at a clip boundary can replay the preceding clip’s tail. The queue plays sequentially during available transmission; it does not request a new key-up for each clip. Waiting pauses it, and its end leaves live microphone audio running under normal PTT. Clear queue changes only the draft; it does not stop or erase the currently prepared sequence. Use Stop autoplay + ZTool in AUDIO to stop it.

Original recording details. Hold a library pad to view or edit the speaker, original channel/conversation and tags. The details also show source, decoded duration once prepared, provenance and original time when known; original time displays in Central time with daylight saving. AUDIO shows the current playback target separately from the original conversation. New single-message and combined History exports preserve locally known metadata against the exact exported audio bytes. When that same file is imported on this installation, speaker/channel details are restored. Combined exports preserve per-message offsets and AUDIO follows the original speaker as the prepared timeline advances. Up to4000 message entries are retained per export; any uncovered tail is shown as unknown. These local details do not travel automatically with an audio file to another installation.

Older exports and arbitrary imported files remain Unknown unless they have matching saved provenance or you label them. Filenames are not used to guess identity. Manual speaker/channel edits are labeled User labeled and replace automatic speaker selection for that pad; the original export evidence remains separate. Tags and metadata editing do not change the sound file. Preparation, local cursor movement and saved metadata are not confirmation that another listener received the transmission.

An armed clip or queue continues following native transmission when Home or another app covers the retained Talk screen. Actual conversation/view teardown still stops autoplay. The sender remains silent locally; listen through a receiving device, Echo or completed History. Local clip audition, online sound catalogs and multicast clip injection are not included. The voice workshop’s short local preview remains a separate tool.

Invite All. Review the selected channel and eligible contact set before its confirmation. Invitation requests are real account/channel actions. Excluded contacts and native permission failures remain distinct from accepted invitations. Preserve the summary instead of assuming a button press added every recipient.

Fake Gallery. The existing camera-source substitution is a one-shot controlled workflow. Choose your local image, arm the helper, then use the intended camera entry on the selected surface. It changes the supplied image source; it does not guarantee the receiver treats every gallery, camera and profile path identically. Compare the resulting preview and the recipient’s saved result. Clearing or consuming the one-shot state requires a fresh arm for another trial.

Picture burst / PIC control. The retained picture helper can perform repeated sends. Review the visible operation and target before activating it. Its count is a local requested amount, not a receipt count. If the sequence is interrupted or partially accepted, inspect the existing result/history before retrying. Do not use repeated media or invitations as a connectivity diagnostic.

These controls act on native messaging/media paths. A successful local preview, picker return or queued media object does not establish recipient delivery.

Tool activity and performance. In Zello Lab → Status & settings → Tool activity & performance, view this process’s observed tool opens, starts, completed/failed actions, cancellations and timing. Opening a screen is separate from running its action. Audio preparation, voice audition/recording and History export have measured spans; other tools can show opens or individual observations without a full execution timer. Queue time is measured only when work is explicitly queued and started; blank timing does not mean zero. The local p50/p95 values cover the latest128 measured completions for each action in this process. Closing or restarting Lab resets this local summary. This screen never starts capture or transmits audio.

Appearance, chat and native settings

Open Appearance from the app’s theme controls or Lab → Status & settings. Black, White and System behavior coexist with Lab accent and media preferences. Changes are local to the app; meaningful PTT/error/success colors retain their roles.

Reopen Talk if it was already visible when an import completed. An image decoding/import error differs from a successful import that has not yet been applied to that visible page. The frozen voice chooser retains its own legacy layout and panel styling.

Vermilion Chat is separate from a native Zello channel conversation. Sign-in is required to send; read-only or unavailable state is shown. Load earlier retrieves preceding visible messages, and long-press provides the supported message actions. The visible-online user list has been retired. Chat messages, Load earlier and supported message actions remain available. Installed builds may still show an empty Online control until their next update. This retirement does not change device reporting. Legacy license import wording in retained chat paths does not make a license necessary to open current Lab tools.

Animation efficiency. The animated ZTool button reuses verified control IDs instead of searching for them before every frame. Its animation cadence and button actions stay the same. Animated Talk visuals avoid redundant redraw requests while keeping the selected animation and opacity. This reduces unnecessary drawing work; animated backgrounds still use power while visible. Choose a still image or use Restore quiet dark defaults in Appearance if you prefer lower visual overhead. ZTool timing and audio behavior are unchanged.

Screen protection

Choose Protect now from the main three-dot menu to dim the current screen immediately. Slow, overlapping bands move over the app. Tap once or press Back to return: the dismissal tap is consumed and cannot press a control underneath.

Open Theme → Screen protection (also available from Appearance) to configure it. Save applies your choices; Protect now in this panel saves and activates them; Cancel discards unsaved edits.

While protected. Incoming audio, held/toggled transmissions, ZTool repeats, voice effects and loaded AUDIO continue through their ordinary paths. Incoming audio and automatic repeats do not count as user input. Hardware PTT keys retain their normal function and dismiss the protector. Automatic activation waits while a text editor has focus or an app dialog/menu is open.

Appearance and background behavior. Theme choices stay saved. Covered imported animations and the animated ZTool artwork pause, then resume when uncovered. The protector runs only while this app is in the foreground with its window focused. Leaving the app, switching the display off, or opening another foreground window removes it; returning starts a fresh idle interval. It adds no keep-awake setting. Existing app and Android display-timeout behavior still applies. System gestures and calls remain available; system bars return on dismissal.

What it helps with. Dimming lowers static bright exposure and the bands vary the image. This may help reduce burn-in risk; it cannot repair permanent burn-in or guarantee prevention. It is not a display-panel refresh cycle. There is no separate Black mode. Long-term battery savings and every Android/OEM input combination are not established by a short functional check.

Native microphone, playback, notification and advanced settings remain available through their ordinary screens. Lab appearance does not override operating-system microphone permission or prove an audio route is active.

Lab tool catalog

Use Tools → Find a tool. Searching filters the catalog locally; it does not run the matched tool.

Status & settings → Zello native diagnostics opens the original diagnostic controls. Those are separate from Lab instrumentation. A native diagnostic toggle and a Lab Raw session are not interchangeable.

Opening an inspector is not equivalent to using its active button. Read the action label: local scan, resolve, snapshot, availability check, refresh, launch and send have different consequences.

Live Log: capture and view lifecycle

Open Live Log, select the relevant stream and read the status. Start capture opens a confirmation for Raw capture. It observes available native diagnostics, process logs and selected IPC boundaries on this device. Available client hooks determine coverage; it does not expose Zello’s server internals or capture every possible protocol byte.

Capture continues when you leave the screen. There is no scheduled session duration or ordinary record-count cutoff. Bounded display windows and transient queues are still used. A critical writer/resource failure can stop capture; read the final reason and source health rather than assuming an intentional stop.

Tap the compact stream status and search scope lines for their full values. Do not force-stop merely because the list appears quiet. If a deliberate process boundary is part of a test, wait for a confirmed durable checkpoint and preserve the preceding session.

The stream selector uses these exact labels:

These streams have different identifiers and retention behavior. Switching streams does not merge their sequences or retrospectively start capture.

Search, patterns, paging and saved presets

The default search is a case-insensitive literal search of the loaded events. The scope line states the number of matches and loaded rows. An empty loaded page is not proof that an entire saved session has no matches.

Filters combines severity, observed source, inferred direction, category text, target-label text, time boundaries and bookmarked-only selection. Target labels are filters and annotations; they do not restrict capture to one account or room. Direction inferred from captured text is a useful hint, not independent transport proof.

For a stored Raw session, enter a nonempty literal phrase and choose Actions → Search entire opened session (literal). This scans the opened session beyond the current page and turns pattern mode off. A live-tail search and whole-session search are different scopes. Paging still presents bounded results.

The bounded pattern language is not full regular expressions. Groups, alternatives, backreferences and counted repetitions are unavailable. Input is limited to 256 characters and patterns to 96 terms; pattern matching considers at most 65,536 characters of a record. Use literal whole-session search and exact detail for very large values. An invalid pattern reports an error; it does not silently become a different query.

Explore trace / search presets supplies starting filters for errors, warnings, requests, results/callbacks, authentication/session text, native diagnostics, IPC and process Logcat. Save, load and delete named search presets from that menu. A preset saves filter settings, not an immutable copy of the matching evidence.

Exact records, sources and timestamps

Tap a row for its full record detail. The list preview may compact whitespace, abbreviate fields or truncate long values. A visually shortened row is not itself evidence that the retained record was shortened. Use the exact-value reader and its next/previous chunks for large content; the displayed character range tells you which portion is open.

Keep the record’s stream, session identity, sequence or stored offset, category, source, direction and timestamp with a finding. Source values such as APP, LAB, NATIVE, PROCESS, IPC, SYNTHETIC and SYSTEM identify how the observation entered the view. Do not describe a synthetic canary as a server response or a PROCESS log line as a dedicated native hook.

Current Raw and journal paths retain full captured values. Some old journal records were produced by earlier reduced-detail implementations; the current viewer cannot reconstruct data that was never retained. Compare original lengths, stored lengths, truncation flags and integrity information when available.

Displayed times use America/Chicago, changing between CST and CDT. Filter input uses yyyy-MM-dd HH:mm; blank boundaries are unbounded. During the repeated fall-back hour, typed Central time selects standard time. Use the event’s offset or original timestamp in exact details to distinguish the two occurrences. Do not treat a clock change as reordered monotonic sequence numbers.

For cross-stream correlation, use an explicit moment marker and a bounded time interval. Each stream has its own identifier; equal-looking sequence values do not create a shared transaction automatically.

Sessions, bookmarks, exports and deletion

Open Sessions & evidence or Actions → Raw sessions. Select a retained session for metadata and paging. The chooser shows the latest 100 sessions; “not in this list” and “does not exist” are not equivalent claims. A stored-session view is separate from Live Raw display.

Bookmarks preserve a reference to a useful record. They do not copy every associated file or keep deleted evidence alive. Raw bookmarks use the selected session context; journal/operational references can become unavailable if their underlying records have aged out or were cleared. Remove a bookmark reference without confusing that action with deletion of the event.

Starting an export queues work. Wait for completion before looking for the destination file. Save copy… does not restart the capture. If no file destination picker is available, the local source export remains at the path shown in the app. A hash verifies the copied bytes against the selected source; it does not prove the source captured every desired event.

Interrupted sessions may have valid retained records and an incomplete tail. Inspect their partial/recovery reason and preserve the original session before cleanup. Do not call an interrupted session complete merely because it opens.

Clear local journal clears that journal through its writer. Raw sessions, operational history, account state and channel data are separate. Delete this session… targets the selected Raw session. These are not Android Clear storage. Review the final confirmation and save the evidence you need first. Raw evidence is not automatically uploaded as ordinary operational reporting.

Checkpoints, canaries and capture health

Mark this moment across local streams requests a marker in the operational history, journal and active Raw session. Raw must already be armed for a Raw marker. Each stream has its own ID. Use the marker to align observations, not as proof that a remote action occurred.

Named journal checkpoint supplies labels such as Ban checkpoint, Authorization boundary, Controlled test preflight and ADB alignment marker. A queued checkpoint is not necessarily durable yet. The older durability display’s durable: prefix is the positive checkpoint indicator; inspect the full status before a deliberate force-stop boundary.

For a local exactness check:

1. Start Raw explicitly.
2. Choose Generate local integrity canary. Keep the generated value in private evidence.
3. Wait for writer durability, then create a full journal export and the Raw-session export.
4. Run Verify full-fidelity integrity and inspect each reported lane/result.
5. If the writer or export is still pending, wait for its completion before interpreting a missing exported canary.

The canary sends no Zello request. The current test checks full-fidelity local evidence; the historical “raw value must be absent from the sanitized journal” rule is not the current Lab design. Journal exactness self-test checks field encoding; it does not validate all native hooks or Frida.

Capture/source health distinguishes capture active/stopping, producer availability, accepted/written work, pending queues, drops, source gaps and writer failures. A connected IPC reader is not proof that an IPC event happened. A zero event count may mean no matching action, no available hook, a filter, or an unavailable source. Read those fields before declaring a clean result.

Network & connections

Open Tools → Network & connections. This module measures the app’s connection context; it does not start a packet-capture service or issue arbitrary network probes when you view its dashboard.

To measure a single action, note the initial counters, restart the measurement window, perform the controlled action and read the final counters. UID traffic includes other app activity during the interval. It does not establish which channel, request or tool consumed every byte.

An endpoint snapshot can report no endpoint frame if the runtime is unavailable or no mapped post-parse state can be published. It is a local snapshot, not an active TLS handshake. A missing observation does not establish that no connection exists. An exact endpoint in Raw is evidence of captured client state, not ownership of the remote service or a complete server topology.

For failures, retain the action, native connection state, network type and observed error. Compare DNS, TLS, connection, timeout and response-processing failures where the actual trace distinguishes them; do not flatten all of them into “offline.”

Message Link Inspector and Route Explorer

Message Link Inspector performs local parser/resolver analysis. Paste controlled message text or load the reserved-domain sample, then choose Analyze without opening. The report includes UTF-16/code-point counts, escaped text, native candidate ranges, normalized/launch forms, URI components and visible resolver handlers. It sends no message and launches no URI.

Ranges labelled UTF-16 refer to Java string units, not necessarily visible characters. A supplementary character consumes two units. Compare the raw escaped candidate, normalized form and parser range when investigating how a message became a clickable link. Resolver results cover package-visible handlers; an unavailable parser or resolver is reported as a failure, not a clean empty scan.

Route Explorer is a separate tool with a template explorer and expert URI composer. Load a template or compose a controlled URI, then Analyze + resolve exact URI. Read the parser branch, predicted parameters and in-package handler before any launch.

The retained route analysis includes contact/channel invitations, shared-channel keys, custom-scheme and HTTPS forms, Work ASO and authentication callbacks. A recognized route is only an analysis result. Some historical dynamic-link integrations are disabled or may not resolve. A Work-related route does not grant a free account access to paid Work services.

Launch once inside Zello Lab… is active: it can invoke a real handler, connection, invitation or sign-in path. Start Raw, replace every OWNED_* placeholder and review the final confirmation. The tool requires an exported in-package handler; it does not prove the downstream request will succeed. Preserve the analyzed URI privately, launch observation, relevant Raw tail and resulting screen. Returning a handler name is not a successful authentication result.

Username & Unicode

Open Tools → Username & Unicode. The candidate field is transient input. Analyze locally inspects its representation; Check stock availability once makes one ordinary stock availability request and requires a signed-in, connected runtime. The tool allows only one such request in flight. Clear transient input and report clears that working view.

Use local analysis to compare visible spelling with code points, UTF-16 length, normalization and control-character observations. Two strings that look the same can differ in representation; two differently encoded strings can be normalized to the same form by a downstream system. Record which representation was actually tested.

A local finding does not establish stock username acceptance. An availability response does not create or reserve the account, and a later registration can still fail. Preserve “not checked,” “checking,” an actual response, and connection failure as separate states.

When Raw is active, this inspector can emit a structural analysis event. It does not imply that every candidate value is copied into that structural event. The on-screen report and other explicitly captured boundaries may contain values; review the evidence you actually retained.

Client-held values and local persistence

Open Tools → Privacy & storage → Client-held values. Start Raw before a snapshot so exact values have a defined evidence destination. Snapshot current account — local only reads the current native model. Scan saved contacts — local only populates the local direct-contact list; select one before Snapshot selected contact — local only.

Read each field’s source, presence, access/context and value together. A value already cached in the client is not proof that it was newly disclosed by the server. The same displayed value can originate from local account preferences, loaded contact state or an observed response.

Correlate latest private-info frame looks for the relevant captured frame in the current Raw window. It does not send a new private-info request. “No frame” means no matching retained frame was found in that scope; it does not prove the service never sent one. Keep the observed subject and source with any field-level conclusion.

For Local persistence:

1. Start Raw and sign into the owned account whose state you are examining.
2. Choose Capture signed-in self baseline — local only.
3. Read files/bytes, matched references, skips, exclusions and Raw-publication failures.
4. After the separately intended state transition, use Compare hash-only baseline — local only.
5. Inspect Show hash-only baseline status and preserve the exact comparison evidence.

The retained baseline is hash-oriented; matches are explained in Raw. A hash match alone does not identify every writer or prove server persistence. A skipped or excluded location is an unexamined scope, not an absence finding. Capturing/comparing a baseline does not itself sign out or reset the app.

App surfaces, IPC and controlled-target labels

App surfaces & IPC → Scan now inventories installed package components, exported status, permissions, authorities and declared action resolution. Search can match component, authority, permission, action, URI or handler. Filters distinguish exported/unprotected, permission-gated, activities/aliases, action probes and the implementation-aware priority queue.

The scan resolves declared actions without invoking the component. “Exported” is not synonymous with exploitable. A permission-gated surface may have further runtime checks; an unprotected resolver match may still reject the actual operation. The inventory is a triage map, not proof of a successful cross-app read or write. Start Raw before scanning when you need its exact IPC observation rows.

Selected first-party IPC hooks are separate from this inventory. If Android denies the optional in-app IPC reader, the app reports degraded coverage; dedicated ADB Logcat may still be observable. The external provider research harness is not a general “invoke every component” button in the shipped UI.

Controlled-target labels annotate evidence. From Live Log Actions, use the target controls or Scan native target catalog. The target browser can scan locally saved channels, select one, refresh current subscribers and add selected users as local labels. A local scan is distinct from a subscriber refresh, which requests native current state.

Freshness monitoring stops when its screen is paused or the selected channel changes. Re-run refresh after returning. If no new valid snapshot is confirmed, the unchanged cache may remain visible. Labels do not restrict global capture to those targets and do not authorize actions against the labelled account.

Permissions & roles: fresh preflight and one request

This tool operates on the current signed-in account and a selected saved, authorized test channel. The default route follows the native operation without an added owner claim. The advanced on_behalf owner-claim option changes the experiment; keep it off for the ordinary control and document explicitly when testing that variant.

Follow the numbered controls in order:

1. Scan local saved channels.
2. Select highlighted channel.
3. Refresh + prove fresh current subscribers; wait for a new valid snapshot.
4. Verify current tuple + load targets. Review actor, channel, observed owner/role, route and freshness.
5. Select highlighted target from the eligible current list.
6. Review + confirm one request only when that exact owned test is intended.
7. Read final role + exact correlation counts after the result.

The final confirmation describes an add_moderator request. The tuple is read again immediately before dispatch. Another request requires a fresh scan/preflight/selection/confirmation. Pausing the screen, changing channels or changing the route invalidates freshness; returning from Live Log can therefore require step 3 again. Raw evidence is recommended but does not replace the request confirmation.

Inspect request construction, wire-body build, send/read failures, response, completion and applied-state observations separately. Relevant event families include authz_request, authz_wire_build, authz_response, authz_read_failure, authz_send_failure and authz_applied. A dispatched request is not an accepted role change.

If the original Raw session is no longer active or its transient window is incomplete, zero in-memory correlation counts are not an absence proof. Open the preserved session. Keep the preflight tuple, exact rejection/acceptance response and final role observation together. Previously consumed one-shot experiments do not authorize a retry.

Identity inspection, selective reset and full erase

Open Tools → Identity & reset. Current identity state is inspection. Passive identity snapshot records existing state into an explicitly started Raw session. A client label such as “banned” is an observation; it does not identify whether enforcement is local, account-related, device-related or remote.

Selective reset… opens a review. Its confirmed action signs out, clears local Zello account/channel state and restarts the app while preserving designated Lab identity/configuration and runner continuity. Current channel-fact evidence has its own preservation handling. Selective reset is not a promise that every Lab file, permission or external export survives; save required evidence first.

The current Identity & reset menu exposes the selective workflow, not a separate full-wipe button. Do not follow an older manual’s full-wipe directions as though they describe the current menu. Do not treat clearing a local marker as proof that a server restriction has changed. A fresh identity display does not establish a successful new account or a repeatable bypass. Compare the subsequent owned-account result with a documented control.

Reset/relaunch may terminate the current process deliberately. An unexpected startup exception is a different failure. Preserve the last phase and current screen before repeating a reset. Normal application updates should use the established same-signer replacement path, not uninstall/reinstall to “clean up” an unrelated UI issue.

Automated Test Runner

Open Tools → Automated Test Runner. This is an active workflow for operator-owned test accounts, not a passive recorder. Even with audio counts set to zero, the account, channel and reset stages still run after confirmation.

The confirmation describes account creation, the selected channel, audio/contact actions and a selective reset before the first account and after every iteration. A useful initial continuity test uses one owned account, zero native presses, zero ZTool seconds and Add Contacts off. It still creates/uses account state and resets; start it only when that complete sequence is intended.

The runner uses native validation/callbacks and pauses on unexpected state. Local startup readiness can briefly be loading; that is not an app PIN requirement. The current runner plan survives the designated selective-reset path, but Android full data clearing is a different operation.

For a stalled run, retain the phase, iteration index, native account/channel state and relevant error. Confirm whether account creation or another action already succeeded before resuming. Repeatedly pressing Start can destroy the clarity of the original test. Do not interpret “no actions” as a universal dry-run mode.

Advanced instrumentation: manual and early mode

Open Tools → Advanced instrumentation. The embedded Frida component is dormant until explicitly activated. Native Lab functions do not generally require Frida, and starting Frida does not automatically start Raw.

Manual mode listens on device loopback at 127.0.0.1:27042 and resumes the app. A host controller connects through ADB forwarding and a reviewed script. The loaded component remains until process death; closing its screen is not an unload. For a dormant-versus-active comparison, record the condition and use a fresh process for the dormant control. Frida’s Gadget reference explains the listener and on_load modes; the CLI reference explains its interactive tooling.

Development-bundle attachment check

These host commands require the project’s development bundle, not just the APK. The retained host environment is pinned to the bundled Frida17.17.0 line. From the development checkout, prepare its isolated environment using the included requirements file:

python3 -m venv .tools/frida-17.17.0
.tools/frida-17.17.0/bin/python -m pip install -r instrumentation/frida/requirements.txt

After tapping Start embedded Frida now, run the included native attachment self-test against the exact selected device:

instrumentation/frida/probe.sh "DEVICE_SERIAL"

Replace DEVICE_SERIAL with your private selected-device identifier. The wrapper creates a temporary host forward, applies a 20-second deadline and removes its own forward on exit. A successful probe reports agent_ready, native_interceptor_selftest and probe_complete with ok: true. It hooks a native process-ID call for its own self-test; it does not exercise Zello account, PTT or network paths. A Raw bridge canary is not a substitute for these attachment results.

For the bundled Java connection-state observer, first build its pinned agent:

cd instrumentation/frida/java-agent
npm install --no-audit --no-fund
npm run build

Then, from the development checkout root, use instrumentation/frida/watch_connectivity.sh "DEVICE_SERIAL" 30. Frida17 custom agents require an explicit Java bridge; the project bundle includes that dependency. The observer records the mapped connection-state setter without forcing a connection transition. Its teardown ends and relaunches the instrumented app process to restore dormant state; run it only when that interruption is intended, after preserving capture evidence. Do not unload live Java replacements as a substitute for the controller’s cleanup. A quiet observation window with no transition is a valid result.

Early-startup observer

Early mode is a one-shot startup experiment, not an always-on setting. Build the startup bundle with npm run build:startup in the same Java-agent directory. Prepare the host controller before arming the app’s next cold launch. From the checkout root, instrumentation/frida/startup_identity.sh "DEVICE_SERIAL" 12 performs the selected-device forwarding, cold launch and bounded observation. This wrapper deliberately force-stops/relaunches the app and restores a dormant process afterward; it does not clear app data. It requires the exact device argument and accepts an observation duration from 5 to120seconds.

The app consumes the arm, restores the disabled default and releases its startup gate after a fixed maximum of eight seconds. That gate duration is separate from the host’s post-attach observation duration. A successful attachment must be distinguished from timeout release. The observable window begins after application base-context attachment; it is not a claim of instrumentation before process startup.

Use Refresh status, a real host attachment result and a known observed boundary to confirm instrumentation. The Raw bridge canary alone proves none of those. Identify script name/version, attachment condition, hook availability and any dropped observations in private evidence. A hook that is unavailable on one runtime should be reported unavailable rather than replaced by a guessed result.

Device reporting and app health

Open Lab → Status & settings. This screen separates local capture health from ordinary device reporting. It includes microphone/notification permission state, check-in attempts and verified replies, queued/dropped uploads, retry timing and local storage-failure counters.

Refresh device status requests a check-in and leaves tools available. App permissions opens Android’s app settings. Zello instrumentation coverage shows instrumented and observed client boundaries; a listed hook and an observed frame are different states.

A device can be online in Zello while its separate reporting reply is stale. Conversely, a recent reporting receipt does not prove a channel connection is healthy. Compare exact times and the two workflows before attributing a problem to one service.

Per-tool usage/performance expansion is approved future work; do not assume every tool already exposes complete duration or percentile metrics. Raw sessions remain local evidence and are not automatically attached to these operational uploads.

Optional ADB evidence workflow

ADB is optional for normal app operation. It is useful for private validation when the phone is explicitly connected for development. If more than one device is attached, choose the intended device explicitly; never assume the default target is the test phone.

# Confirm the Lab package is present; this does not launch or clear it.
adb shell pm path com.zellolab

# Inspect current foreground activity / package state without modifying it.
adb shell dumpsys activity activities
adb shell dumpsys package com.zellolab

# Read the dedicated IPC Raw tag after an explicit in-app capture start.
adb logcat -v threadtime ZL_IPC_RAW:V '*:S'

Save resulting logs privately. A tag-filtered trace has a limited scope. For startup-crash investigation, capture ordinary all-process Logcat as well: an apparently healthy background process can survive after the foreground activity fails. Record the actual resumed activity and visible screen, not only a PID.

A standard authorized development update uses the existing signed Lab artifact:

adb install --no-incremental -r /path/to/ZelloLab-signed.apk
adb shell pm path com.zellolab

After an update, verify the installed base against the intended artifact and check foreground startup. Do not use incremental installation for this Lab package. Do not substitute pm clear, uninstall or identity changes for update verification. Stock Zello uses a separate package and must not be overwritten by the Lab artifact.

These commands do not start Raw, grant all source access, activate Frida or prove end-to-end message delivery. Device serials, paths returned by package queries and actual log contents are private evidence, not public bug-report examples.

Troubleshooting by observation

Worked investigations and report template

A missing or possibly removed channel

Start with one exact spelling and clear Discover filters. Record whether it appears in the current catalog, optional history and the saved client list. Use Check names once. Retain found/not-found/unknown, type flags and restrictions separately. If the native client shows “removed,” capture that exact message and any prior found observation. Conclude only what those observations establish; successful recreation is a later, separate result.

A slow refresh or inconsistent device status

Record the visible starting status and time. Mark a moment, refresh once, and wait for the outcome. Compare request start, transport completion/error, acknowledgment where applicable and the display update. Check the separate reporting status without equating it with channel-service availability. Preserve the interval and final screen so a slow network operation can be distinguished from a stuck UI.

A value found in the client

Capture the local model’s source and subject, then correlate an actual native response if one exists in the same retained session. Do not label a cache read a new server disclosure. Use local persistence baseline/compare only for the app-owned state it actually examines. Retain skipped/excluded locations and exact-value evidence privately.

A useful technical report

Build and screen:
Owned test scope / selected target:
Raw: off | active | stopped and finalized
Instrumentation: dormant | manual active | early one-shot
Expected result:
Exact reproduction steps:
Observed request / response / final state:
Start-to-finish duration and displayed time zone:
Session and relevant record references (private):
Export scope, byte count, hash and any partial/loss flags:
What was NOT observed or remains uncertain:

Keep the original full evidence privately. Review any copy you share for account data, identifiers, credentials, private channel names and unrelated records. Use the authorized disclosure channel for security findings. A reproduction should be clear enough that another authorized operator can distinguish the action, the observation and the conclusion.

Current limits and planned work

Build154 extends the AUDIO companion with MP3, PCM WAV, Ogg Vorbis and Opus, a local soundboard, prepared queues, trims, favorites and recording metadata. The retained AUDIO foundation provides playback mixed with live microphone audio, native transmission pause/resume, adjustable rewind, seeking, independent levels and explicit Stop. Build149’s Velvet Smooth remains a separate 40 ms formant-aware preset. All 32 earlier voices, including original Velvet Low and Crystal High, remain intact. The library now contains 33 voices and ten extra effects; tuning, saved variations, Marquee, local A/B preview and the fixed Effects & preview shortcut remain available. The workshop explains engine readiness and audio buffering. The classic voice UI and ZTool control timing remain preserved. Downloadable code/voice packs are absent, and the future lean7.16 edition is not this build.

Work-inspired folders/labels/pins, follow-up inbox and richer history search remain parked. Ella and paid Zello Work service features are not integrated into the free-side Lab by this guide. Build151 adds external-media coexistence across PTT presses/releases and background continuation for the retained Talk session. Call-time floor retention and digital capture of other apps remain future investigations; device/headset-specific behavior still needs its own verification.

Some older tool titles or retained messages use historical names. Prefer the current navigation and observed result. A hidden historical class, old manual passage or compatibility label is not proof of a currently supported workflow. The website changelog records shipped app/frontend behavior; internal backend/database changes remain private.