diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c1fc7ea
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,203 @@
+name: RootStream CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        build-type: [release, debug]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            pkg-config \
+            libdrm-dev \
+            libva-dev \
+            libsodium-dev \
+            libopus-dev \
+            libasound2-dev \
+            libsdl2-dev \
+            libgtk-3-dev \
+            libavahi-client-dev \
+            libqrencode-dev \
+            libpng-dev
+
+      - name: Build (${{ matrix.build-type }})
+        run: |
+          if [ "${{ matrix.build-type }}" = "debug" ]; then
+            make DEBUG=1
+          else
+            make
+          fi
+
+      - name: Verify binary
+        run: |
+          ./rootstream --help || true
+          file ./rootstream
+          ldd ./rootstream || true
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: rootstream-${{ matrix.build-type }}
+          path: rootstream
+
+  unit-tests:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            pkg-config \
+            libdrm-dev \
+            libva-dev \
+            libsodium-dev \
+            libopus-dev \
+            libasound2-dev \
+            libsdl2-dev \
+            libgtk-3-dev \
+            libavahi-client-dev \
+            libqrencode-dev \
+            libpng-dev
+
+      - name: Build tests
+        run: make test-build
+
+      - name: Run crypto tests
+        run: ./tests/unit/test_crypto
+
+      - name: Run encoding tests
+        run: ./tests/unit/test_encoding
+
+  integration-tests:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            pkg-config \
+            libdrm-dev \
+            libva-dev \
+            libsodium-dev \
+            libopus-dev \
+            libasound2-dev \
+            libsdl2-dev \
+            libgtk-3-dev \
+            libavahi-client-dev \
+            libqrencode-dev \
+            libpng-dev \
+            xvfb
+
+      - name: Build
+        run: make
+
+      - name: Run integration tests
+        run: |
+          # Some tests need a display
+          xvfb-run --auto-servernum ./tests/integration/test_stream.sh || \
+            ./tests/integration/test_stream.sh
+
+  code-quality:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            cppcheck \
+            clang-tools
+
+      - name: Run cppcheck
+        run: |
+          cppcheck --enable=warning,style,performance \
+                   --suppress=missingIncludeSystem \
+                   --error-exitcode=0 \
+                   src/ include/
+
+      - name: Check for common issues
+        run: |
+          # Check for TODO/FIXME counts (informational)
+          echo "=== TODOs and FIXMEs ==="
+          grep -rn "TODO\|FIXME" src/ include/ || echo "None found"
+
+          # Check for potential security issues
+          echo ""
+          echo "=== Potential security patterns ==="
+          grep -rn "strcpy\|sprintf\|gets" src/ || echo "None found (good!)"
+
+  memory-check:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            pkg-config \
+            libdrm-dev \
+            libva-dev \
+            libsodium-dev \
+            libopus-dev \
+            libasound2-dev \
+            libsdl2-dev \
+            libgtk-3-dev \
+            libavahi-client-dev \
+            libqrencode-dev \
+            libpng-dev \
+            valgrind
+
+      - name: Build with debug symbols
+        run: make DEBUG=1 test-build
+
+      - name: Run valgrind on unit tests
+        run: |
+          valgrind --leak-check=full \
+                   --show-leak-kinds=definite \
+                   --error-exitcode=0 \
+                   ./tests/unit/test_crypto 2>&1 | tee valgrind-crypto.log
+
+          valgrind --leak-check=full \
+                   --show-leak-kinds=definite \
+                   --error-exitcode=0 \
+                   ./tests/unit/test_encoding 2>&1 | tee valgrind-encoding.log
+
+      - name: Upload valgrind logs
+        uses: actions/upload-artifact@v4
+        with:
+          name: valgrind-logs
+          path: valgrind-*.log
diff --git a/Makefile b/Makefile
index 22fce61..9c1f8d2 100644
--- a/Makefile
+++ b/Makefile
@@ -193,11 +193,15 @@ ICONDIR := $(SHAREDIR)/icons/hicolor
 DESKTOPDIR := $(SHAREDIR)/applications
 SYSTEMDDIR := $(HOME)/.config/systemd/user
 
+# Test binaries
+TEST_CRYPTO := tests/unit/test_crypto
+TEST_ENCODING := tests/unit/test_encoding
+
 # ============================================================================
 # Build Rules
 # ============================================================================
 
-.PHONY: all clean install uninstall deps check help player
+.PHONY: all clean install uninstall deps check help player test test-build test-unit test-integration test-clean
 
 # Default target
 all: $(TARGET) $(PLAYER)
@@ -311,7 +315,7 @@ uninstall:
 # Cleaning
 # ============================================================================
 
-clean:
+clean: test-clean
 	@echo "🧹 Cleaning build artifacts..."
 	@rm -f $(OBJS) $(DEPS) $(TARGET) $(PLAYER)
 	@rm -f src/*.o src/*.d
@@ -373,6 +377,13 @@ help:
 	@echo "  format          Format source code"
 	@echo "  help            Show this help"
 	@echo ""
+	@echo "Testing:"
+	@echo "  test            Run all tests (unit + integration)"
+	@echo "  test-build      Build test binaries"
+	@echo "  test-unit       Run unit tests only"
+	@echo "  test-integration Run integration tests only"
+	@echo "  test-clean      Remove test artifacts"
+	@echo ""
 	@echo "Build options:"
 	@echo "  DEBUG=1         Build with debug symbols"
 	@echo "  PREFIX=/path    Install prefix (default: /usr/local)"
@@ -380,9 +391,62 @@ help:
 	@echo "Examples:"
 	@echo "  make                    # Build"
 	@echo "  make DEBUG=1            # Debug build"
+	@echo "  make test               # Run all tests"
 	@echo "  make install            # Install to /usr/local"
 	@echo "  sudo make PREFIX=/usr install   # Install to /usr"
 
+# ============================================================================
+# Testing
+# ============================================================================
+
+# Build all test binaries
+test-build: $(TEST_CRYPTO) $(TEST_ENCODING)
+
+# Build and run all tests
+test: test-unit test-integration
+
+# Run unit tests
+test-unit: test-build
+	@echo ""
+	@echo "╔════════════════════════════════════════════════╗"
+	@echo "║  Running Unit Tests                            ║"
+	@echo "╚════════════════════════════════════════════════╝"
+	@echo ""
+	@./$(TEST_CRYPTO)
+	@./$(TEST_ENCODING)
+	@echo ""
+	@echo "✓ All unit tests passed"
+
+# Run integration tests
+test-integration: $(TARGET)
+	@echo ""
+	@echo "╔════════════════════════════════════════════════╗"
+	@echo "║  Running Integration Tests                     ║"
+	@echo "╚════════════════════════════════════════════════╝"
+	@echo ""
+	@./tests/integration/test_stream.sh
+
+# Build crypto test
+$(TEST_CRYPTO): tests/unit/test_crypto.c src/crypto.c
+	@echo "🔨 Building crypto tests..."
+	@mkdir -p tests/unit
+	@$(CC) $(CFLAGS) $^ -o $@ $(LDFLAGS) $(LIBS)
+	@echo "✓ Built: $@"
+
+# Build encoding test (standalone, doesn't need hardware)
+$(TEST_ENCODING): tests/unit/test_encoding.c
+	@echo "🔨 Building encoding tests..."
+	@mkdir -p tests/unit
+	@$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
+	@echo "✓ Built: $@"
+
+# Clean test artifacts
+test-clean:
+	@echo "🧹 Cleaning test artifacts..."
+	@rm -f $(TEST_CRYPTO) $(TEST_ENCODING)
+	@rm -f tests/unit/*.o
+	@echo "✓ Test clean complete"
+
 # ============================================================================
 # Special targets
 # ============================================================================
diff --git a/tests/.gitignore b/tests/.gitignore
new file mode 100644
index 0000000..4c53647
--- /dev/null
+++ b/tests/.gitignore
@@ -0,0 +1,8 @@
+# Test binaries
+unit/test_crypto
+unit/test_encoding
+
+# Test artifacts
+*.o
+*.log
+*.tmp
diff --git a/tests/integration/test_stream.sh b/tests/integration/test_stream.sh
new file mode 100755
index 0000000..cad6304
--- /dev/null
+++ b/tests/integration/test_stream.sh
@@ -0,0 +1,319 @@
+#!/bin/bash
+#
+# test_stream.sh - Integration test for RootStream streaming
+#
+# Tests end-to-end streaming between host and client processes.
+# Requires: Virtual display (Xvfb) or real display
+#
+# Usage:
+#   ./tests/integration/test_stream.sh
+#
+# Exit codes:
+#   0 - All tests passed
+#   1 - Test failed
+#   2 - Setup failed (missing dependencies)
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Test configuration
+ROOTSTREAM="./rootstream"
+TEST_PORT=19876
+TEST_DURATION=5
+LOG_DIR="/tmp/rootstream-test-$$"
+HOST_LOG="$LOG_DIR/host.log"
+CLIENT_LOG="$LOG_DIR/client.log"
+
+# Cleanup function
+cleanup() {
+    echo -e "\n${YELLOW}Cleaning up...${NC}"
+
+    # Kill background processes
+    if [ -n "$HOST_PID" ] && kill -0 "$HOST_PID" 2>/dev/null; then
+        kill "$HOST_PID" 2>/dev/null || true
+        wait "$HOST_PID" 2>/dev/null || true
+    fi
+
+    if [ -n "$CLIENT_PID" ] && kill -0 "$CLIENT_PID" 2>/dev/null; then
+        kill "$CLIENT_PID" 2>/dev/null || true
+        wait "$CLIENT_PID" 2>/dev/null || true
+    fi
+
+    # Show logs on failure
+    if [ "$TEST_FAILED" = "1" ]; then
+        echo -e "\n${RED}=== Host Log ===${NC}"
+        cat "$HOST_LOG" 2>/dev/null || echo "(no log)"
+        echo -e "\n${RED}=== Client Log ===${NC}"
+        cat "$CLIENT_LOG" 2>/dev/null || echo "(no log)"
+    fi
+
+    # Remove temp files
+    rm -rf "$LOG_DIR"
+}
+
+trap cleanup EXIT
+
+# Check prerequisites
+check_prerequisites() {
+    echo "Checking prerequisites..."
+
+    if [ ! -x "$ROOTSTREAM" ]; then
+        echo -e "${RED}✗ RootStream binary not found at $ROOTSTREAM${NC}"
+        echo "  Run 'make' first to build the project"
+        exit 2
+    fi
+
+    echo -e "${GREEN}✓ RootStream binary found${NC}"
+
+    # Check for display (needed for capture)
+    if [ -z "$DISPLAY" ] && [ -z "$WAYLAND_DISPLAY" ]; then
+        echo -e "${YELLOW}⚠ No display detected, some tests may fail${NC}"
+    fi
+
+    # Create log directory
+    mkdir -p "$LOG_DIR"
+}
+
+# Test 1: Basic startup
+test_basic_startup() {
+    echo -e "\n${YELLOW}[TEST 1] Basic startup...${NC}"
+
+    # Test --help
+    if "$ROOTSTREAM" --help > /dev/null 2>&1; then
+        echo -e "${GREEN}  ✓ --help works${NC}"
+    else
+        echo -e "${RED}  ✗ --help failed${NC}"
+        return 1
+    fi
+
+    # Test --version (if supported)
+    if "$ROOTSTREAM" --version > /dev/null 2>&1; then
+        echo -e "${GREEN}  ✓ --version works${NC}"
+    fi
+
+    return 0
+}
+
+# Test 2: Key generation
+test_key_generation() {
+    echo -e "\n${YELLOW}[TEST 2] Key generation...${NC}"
+
+    # Generate keys to temp location
+    export XDG_CONFIG_HOME="$LOG_DIR/config"
+    mkdir -p "$XDG_CONFIG_HOME"
+
+    # Run briefly to trigger key generation
+    timeout 2 "$ROOTSTREAM" --qr 2>&1 | head -20 > "$LOG_DIR/keygen.log" || true
+
+    # Check if keys were created
+    if [ -f "$XDG_CONFIG_HOME/rootstream/keys/private.key" ]; then
+        echo -e "${GREEN}  ✓ Private key generated${NC}"
+    else
+        echo -e "${RED}  ✗ Private key not found${NC}"
+        return 1
+    fi
+
+    if [ -f "$XDG_CONFIG_HOME/rootstream/keys/public.key" ]; then
+        echo -e "${GREEN}  ✓ Public key generated${NC}"
+    else
+        echo -e "${RED}  ✗ Public key not found${NC}"
+        return 1
+    fi
+
+    return 0
+}
+
+# Test 3: QR code generation
+test_qr_generation() {
+    echo -e "\n${YELLOW}[TEST 3] QR code generation...${NC}"
+
+    export XDG_CONFIG_HOME="$LOG_DIR/config"
+
+    # Generate QR and capture output
+    output=$(timeout 3 "$ROOTSTREAM" --qr 2>&1 || true)
+
+    if echo "$output" | grep -q "RootStream Code:"; then
+        echo -e "${GREEN}  ✓ RootStream code generated${NC}"
+    else
+        echo -e "${RED}  ✗ RootStream code not found in output${NC}"
+        return 1
+    fi
+
+    # Check for @ in code (format: pubkey@hostname)
+    if echo "$output" | grep -q "@"; then
+        echo -e "${GREEN}  ✓ Code format valid (contains @)${NC}"
+    else
+        echo -e "${RED}  ✗ Code format invalid${NC}"
+        return 1
+    fi
+
+    return 0
+}
+
+# Test 4: Network binding
+test_network_binding() {
+    echo -e "\n${YELLOW}[TEST 4] Network binding...${NC}"
+
+    export XDG_CONFIG_HOME="$LOG_DIR/config"
+
+    # Start host briefly
+    timeout 3 "$ROOTSTREAM" host --port $TEST_PORT > "$HOST_LOG" 2>&1 &
+    HOST_PID=$!
+
+    sleep 1
+
+    # Check if process started
+    if kill -0 "$HOST_PID" 2>/dev/null; then
+        echo -e "${GREEN}  ✓ Host process started${NC}"
+    else
+        echo -e "${RED}  ✗ Host process failed to start${NC}"
+        cat "$HOST_LOG"
+        return 1
+    fi
+
+    # Check for port binding message in log
+    if grep -q "Network initialized" "$HOST_LOG" 2>/dev/null || \
+       grep -q "0.0.0.0:$TEST_PORT" "$HOST_LOG" 2>/dev/null; then
+        echo -e "${GREEN}  ✓ Port $TEST_PORT bound successfully${NC}"
+    else
+        echo -e "${YELLOW}  ⚠ Could not verify port binding${NC}"
+    fi
+
+    # Check port with netstat/ss if available
+    if command -v ss >/dev/null 2>&1; then
+        if ss -uln | grep -q ":$TEST_PORT"; then
+            echo -e "${GREEN}  ✓ UDP port verified with ss${NC}"
+        fi
+    fi
+
+    # Cleanup
+    kill "$HOST_PID" 2>/dev/null || true
+    wait "$HOST_PID" 2>/dev/null || true
+    HOST_PID=""
+
+    return 0
+}
+
+# Test 5: Config file handling
+test_config_handling() {
+    echo -e "\n${YELLOW}[TEST 5] Config file handling...${NC}"
+
+    export XDG_CONFIG_HOME="$LOG_DIR/config"
+
+    # Run once to create default config
+    timeout 2 "$ROOTSTREAM" --qr > /dev/null 2>&1 || true
+
+    # Check if config was created
+    config_file="$XDG_CONFIG_HOME/rootstream/config.ini"
+    if [ -f "$config_file" ]; then
+        echo -e "${GREEN}  ✓ Config file created${NC}"
+    else
+        echo -e "${YELLOW}  ⚠ Config file not found (may be optional)${NC}"
+        return 0
+    fi
+
+    # Check config has expected sections
+    if grep -q "\[video\]" "$config_file" 2>/dev/null || \
+       grep -q "bitrate" "$config_file" 2>/dev/null; then
+        echo -e "${GREEN}  ✓ Config contains expected settings${NC}"
+    fi
+
+    return 0
+}
+
+# Test 6: Loopback streaming (if display available)
+test_loopback_streaming() {
+    echo -e "\n${YELLOW}[TEST 6] Loopback streaming...${NC}"
+
+    # Skip if no display
+    if [ -z "$DISPLAY" ] && [ -z "$WAYLAND_DISPLAY" ]; then
+        echo -e "${YELLOW}  ⚠ Skipped (no display)${NC}"
+        return 0
+    fi
+
+    export XDG_CONFIG_HOME="$LOG_DIR/config"
+
+    # Start host
+    "$ROOTSTREAM" host --port $TEST_PORT > "$HOST_LOG" 2>&1 &
+    HOST_PID=$!
+
+    sleep 2
+
+    if ! kill -0 "$HOST_PID" 2>/dev/null; then
+        echo -e "${RED}  ✗ Host failed to start${NC}"
+        return 1
+    fi
+    echo -e "${GREEN}  ✓ Host started${NC}"
+
+    # Get RootStream code from host log
+    code=$(grep -o '[A-Za-z0-9+/=]*@[^ ]*' "$HOST_LOG" 2>/dev/null | head -1)
+
+    if [ -z "$code" ]; then
+        echo -e "${YELLOW}  ⚠ Could not extract RootStream code, using localhost${NC}"
+        # Try connecting with just localhost
+        code="test@127.0.0.1"
+    fi
+
+    # Note: Full client test requires SDL display, skip in headless
+    echo -e "${GREEN}  ✓ Loopback test setup complete${NC}"
+
+    # Cleanup
+    kill "$HOST_PID" 2>/dev/null || true
+    wait "$HOST_PID" 2>/dev/null || true
+    HOST_PID=""
+
+    return 0
+}
+
+# Main test runner
+main() {
+    echo ""
+    echo "╔════════════════════════════════════════════════╗"
+    echo "║  RootStream Integration Tests                  ║"
+    echo "╚════════════════════════════════════════════════╝"
+    echo ""
+
+    TEST_FAILED=0
+    TESTS_PASSED=0
+    TESTS_RUN=0
+
+    check_prerequisites
+
+    # Run tests
+    for test_func in \
+        test_basic_startup \
+        test_key_generation \
+        test_qr_generation \
+        test_network_binding \
+        test_config_handling \
+        test_loopback_streaming
+    do
+        TESTS_RUN=$((TESTS_RUN + 1))
+        if $test_func; then
+            TESTS_PASSED=$((TESTS_PASSED + 1))
+        else
+            TEST_FAILED=1
+        fi
+    done
+
+    # Summary
+    echo ""
+    echo "════════════════════════════════════════════════"
+    if [ "$TEST_FAILED" = "0" ]; then
+        echo -e "  ${GREEN}Results: $TESTS_PASSED/$TESTS_RUN passed${NC}"
+    else
+        TESTS_FAILED=$((TESTS_RUN - TESTS_PASSED))
+        echo -e "  ${RED}Results: $TESTS_PASSED/$TESTS_RUN passed ($TESTS_FAILED failed)${NC}"
+    fi
+    echo "════════════════════════════════════════════════"
+    echo ""
+
+    exit $TEST_FAILED
+}
+
+main "$@"
diff --git a/tests/unit/test_crypto.c b/tests/unit/test_crypto.c
new file mode 100644
index 0000000..82a9bfb
--- /dev/null
+++ b/tests/unit/test_crypto.c
@@ -0,0 +1,302 @@
+/*
+ * test_crypto.c - Unit tests for cryptographic functions
+ *
+ * Tests:
+ * - Key generation
+ * - Session creation
+ * - Encryption/decryption roundtrip
+ * - Fingerprint formatting
+ * - Peer verification
+ */
+
+#include "../../include/rootstream.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+/* Test counters */
+static int tests_run = 0;
+static int tests_passed = 0;
+static int tests_failed = 0;
+
+#define TEST(name) \
+    static void test_##name(void); \
+    static void run_test_##name(void) { \
+        printf("  [TEST] %s... ", #name); \
+        fflush(stdout); \
+        tests_run++; \
+        test_##name(); \
+        tests_passed++; \
+        printf("✓\n"); \
+    } \
+    static void test_##name(void)
+
+#define ASSERT(cond) do { \
+    if (!(cond)) { \
+        printf("✗\n"); \
+        fprintf(stderr, "    FAILED: %s (line %d)\n", #cond, __LINE__); \
+        tests_failed++; \
+        tests_passed--; \
+        return; \
+    } \
+} while(0)
+
+#define ASSERT_EQ(a, b) ASSERT((a) == (b))
+#define ASSERT_NE(a, b) ASSERT((a) != (b))
+#define ASSERT_STR_EQ(a, b) ASSERT(strcmp((a), (b)) == 0)
+
+/* ============================================================================
+ * Tests
+ * ============================================================================ */
+
+TEST(crypto_init) {
+    int result = crypto_init();
+    ASSERT_EQ(result, 0);
+}
+
+TEST(keypair_generation) {
+    keypair_t kp;
+    memset(&kp, 0, sizeof(kp));
+
+    int result = crypto_generate_keypair(&kp, "test-host");
+    ASSERT_EQ(result, 0);
+
+    /* Check keys are non-zero */
+    int zero_count = 0;
+    for (int i = 0; i < CRYPTO_PUBLIC_KEY_BYTES; i++) {
+        if (kp.public_key[i] == 0) zero_count++;
+    }
+    ASSERT(zero_count < CRYPTO_PUBLIC_KEY_BYTES);  /* Not all zeros */
+
+    /* Check identity is set */
+    ASSERT(strlen(kp.identity) > 0);
+
+    /* Check RootStream code is generated */
+    ASSERT(strlen(kp.rootstream_code) > 0);
+    ASSERT(strchr(kp.rootstream_code, '@') != NULL);  /* Contains @ separator */
+}
+
+TEST(keypair_uniqueness) {
+    keypair_t kp1, kp2;
+
+    crypto_generate_keypair(&kp1, "host1");
+    crypto_generate_keypair(&kp2, "host2");
+
+    /* Keys should be different */
+    ASSERT(memcmp(kp1.public_key, kp2.public_key, CRYPTO_PUBLIC_KEY_BYTES) != 0);
+    ASSERT(memcmp(kp1.secret_key, kp2.secret_key, CRYPTO_SECRET_KEY_BYTES) != 0);
+}
+
+TEST(session_creation) {
+    keypair_t alice, bob;
+
+    crypto_generate_keypair(&alice, "alice");
+    crypto_generate_keypair(&bob, "bob");
+
+    /* Create sessions from both sides */
+    crypto_session_t alice_session, bob_session;
+
+    int result1 = crypto_create_session(&alice_session, alice.secret_key, bob.public_key);
+    int result2 = crypto_create_session(&bob_session, bob.secret_key, alice.public_key);
+
+    ASSERT_EQ(result1, 0);
+    ASSERT_EQ(result2, 0);
+
+    /* Both sessions should derive the same shared key */
+    ASSERT(memcmp(alice_session.shared_key, bob_session.shared_key,
+                  CRYPTO_SHARED_KEY_BYTES) == 0);
+
+    /* Sessions should be marked as authenticated */
+    ASSERT(alice_session.authenticated);
+    ASSERT(bob_session.authenticated);
+}
+
+TEST(encrypt_decrypt_roundtrip) {
+    keypair_t alice, bob;
+    crypto_generate_keypair(&alice, "alice");
+    crypto_generate_keypair(&bob, "bob");
+
+    crypto_session_t alice_session, bob_session;
+    crypto_create_session(&alice_session, alice.secret_key, bob.public_key);
+    crypto_create_session(&bob_session, bob.secret_key, alice.public_key);
+
+    /* Test message */
+    const char *plaintext = "Hello, secure world!";
+    size_t plain_len = strlen(plaintext) + 1;
+
+    /* Encrypt */
+    uint8_t ciphertext[256];
+    size_t cipher_len = 0;
+    uint64_t nonce = 12345;
+
+    int enc_result = crypto_encrypt_packet(&alice_session, plaintext, plain_len,
+                                           ciphertext, &cipher_len, nonce);
+    ASSERT_EQ(enc_result, 0);
+    ASSERT(cipher_len > plain_len);  /* Ciphertext includes MAC */
+
+    /* Decrypt */
+    uint8_t decrypted[256];
+    size_t decrypted_len = 0;
+
+    int dec_result = crypto_decrypt_packet(&bob_session, ciphertext, cipher_len,
+                                           decrypted, &decrypted_len, nonce);
+    ASSERT_EQ(dec_result, 0);
+    ASSERT_EQ(decrypted_len, plain_len);
+    ASSERT_STR_EQ((char*)decrypted, plaintext);
+}
+
+TEST(decrypt_wrong_nonce_fails) {
+    keypair_t alice, bob;
+    crypto_generate_keypair(&alice, "alice");
+    crypto_generate_keypair(&bob, "bob");
+
+    crypto_session_t alice_session, bob_session;
+    crypto_create_session(&alice_session, alice.secret_key, bob.public_key);
+    crypto_create_session(&bob_session, bob.secret_key, alice.public_key);
+
+    const char *plaintext = "Secret message";
+    size_t plain_len = strlen(plaintext) + 1;
+
+    uint8_t ciphertext[256];
+    size_t cipher_len = 0;
+
+    crypto_encrypt_packet(&alice_session, plaintext, plain_len,
+                         ciphertext, &cipher_len, 100);
+
+    /* Try to decrypt with wrong nonce */
+    uint8_t decrypted[256];
+    size_t decrypted_len = 0;
+
+    int result = crypto_decrypt_packet(&bob_session, ciphertext, cipher_len,
+                                       decrypted, &decrypted_len, 999);  /* Wrong nonce */
+    ASSERT_NE(result, 0);  /* Should fail */
+}
+
+TEST(decrypt_tampered_fails) {
+    keypair_t alice, bob;
+    crypto_generate_keypair(&alice, "alice");
+    crypto_generate_keypair(&bob, "bob");
+
+    crypto_session_t alice_session, bob_session;
+    crypto_create_session(&alice_session, alice.secret_key, bob.public_key);
+    crypto_create_session(&bob_session, bob.secret_key, alice.public_key);
+
+    const char *plaintext = "Tamper test";
+    size_t plain_len = strlen(plaintext) + 1;
+
+    uint8_t ciphertext[256];
+    size_t cipher_len = 0;
+    uint64_t nonce = 42;
+
+    crypto_encrypt_packet(&alice_session, plaintext, plain_len,
+                         ciphertext, &cipher_len, nonce);
+
+    /* Tamper with ciphertext */
+    ciphertext[5] ^= 0xFF;
+
+    /* Decryption should fail due to MAC mismatch */
+    uint8_t decrypted[256];
+    size_t decrypted_len = 0;
+
+    int result = crypto_decrypt_packet(&bob_session, ciphertext, cipher_len,
+                                       decrypted, &decrypted_len, nonce);
+    ASSERT_NE(result, 0);  /* Should fail */
+}
+
+TEST(fingerprint_format) {
+    keypair_t kp;
+    crypto_generate_keypair(&kp, "test");
+
+    char fingerprint[64];
+    int result = crypto_format_fingerprint(kp.public_key, CRYPTO_PUBLIC_KEY_BYTES,
+                                           fingerprint, sizeof(fingerprint));
+    ASSERT_EQ(result, 0);
+    ASSERT(strlen(fingerprint) > 0);
+    ASSERT(strlen(fingerprint) < 32);  /* Reasonable length */
+}
+
+TEST(peer_verification) {
+    keypair_t kp;
+    crypto_generate_keypair(&kp, "test");
+
+    /* Valid key should pass */
+    int result = crypto_verify_peer(kp.public_key, CRYPTO_PUBLIC_KEY_BYTES);
+    ASSERT_EQ(result, 0);
+
+    /* Zero key should fail */
+    uint8_t zero_key[CRYPTO_PUBLIC_KEY_BYTES] = {0};
+    result = crypto_verify_peer(zero_key, CRYPTO_PUBLIC_KEY_BYTES);
+    ASSERT_NE(result, 0);
+}
+
+TEST(large_message_encryption) {
+    keypair_t alice, bob;
+    crypto_generate_keypair(&alice, "alice");
+    crypto_generate_keypair(&bob, "bob");
+
+    crypto_session_t alice_session, bob_session;
+    crypto_create_session(&alice_session, alice.secret_key, bob.public_key);
+    crypto_create_session(&bob_session, bob.secret_key, alice.public_key);
+
+    /* Large message (simulating video frame header) */
+    uint8_t large_msg[4096];
+    for (int i = 0; i < 4096; i++) {
+        large_msg[i] = (uint8_t)(i & 0xFF);
+    }
+
+    uint8_t ciphertext[5000];
+    size_t cipher_len = 0;
+
+    int enc_result = crypto_encrypt_packet(&alice_session, large_msg, 4096,
+                                           ciphertext, &cipher_len, 1);
+    ASSERT_EQ(enc_result, 0);
+
+    uint8_t decrypted[5000];
+    size_t decrypted_len = 0;
+
+    int dec_result = crypto_decrypt_packet(&bob_session, ciphertext, cipher_len,
+                                           decrypted, &decrypted_len, 1);
+    ASSERT_EQ(dec_result, 0);
+    ASSERT_EQ(decrypted_len, 4096);
+    ASSERT(memcmp(decrypted, large_msg, 4096) == 0);
+}
+
+/* ============================================================================
+ * Main
+ * ============================================================================ */
+
+int main(void) {
+    printf("\n");
+    printf("╔════════════════════════════════════════════════╗\n");
+    printf("║  RootStream Crypto Unit Tests                  ║\n");
+    printf("╚════════════════════════════════════════════════╝\n");
+    printf("\n");
+
+    /* Initialize crypto first */
+    run_test_crypto_init();
+
+    /* Run tests */
+    run_test_keypair_generation();
+    run_test_keypair_uniqueness();
+    run_test_session_creation();
+    run_test_encrypt_decrypt_roundtrip();
+    run_test_decrypt_wrong_nonce_fails();
+    run_test_decrypt_tampered_fails();
+    run_test_fingerprint_format();
+    run_test_peer_verification();
+    run_test_large_message_encryption();
+
+    /* Summary */
+    printf("\n");
+    printf("════════════════════════════════════════════════\n");
+    printf("  Results: %d/%d passed", tests_passed, tests_run);
+    if (tests_failed > 0) {
+        printf(" (%d failed)", tests_failed);
+    }
+    printf("\n");
+    printf("════════════════════════════════════════════════\n");
+    printf("\n");
+
+    return tests_failed > 0 ? 1 : 0;
+}
diff --git a/tests/unit/test_encoding.c b/tests/unit/test_encoding.c
new file mode 100644
index 0000000..d2b4bb3
--- /dev/null
+++ b/tests/unit/test_encoding.c
@@ -0,0 +1,396 @@
+/*
+ * test_encoding.c - Unit tests for video encoding functions
+ *
+ * Tests:
+ * - Colorspace conversion (RGBA to NV12)
+ * - NAL unit parsing
+ * - Keyframe detection
+ * - Encoder parameter validation
+ *
+ * Note: Full encoder tests require hardware (VA-API/NVENC)
+ * These tests focus on pure software functions.
+ */
+
+#include "../../include/rootstream.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+/* Test counters */
+static int tests_run = 0;
+static int tests_passed = 0;
+static int tests_failed = 0;
+
+#define TEST(name) \
+    static void test_##name(void); \
+    static void run_test_##name(void) { \
+        printf("  [TEST] %s... ", #name); \
+        fflush(stdout); \
+        tests_run++; \
+        test_##name(); \
+        tests_passed++; \
+        printf("✓\n"); \
+    } \
+    static void test_##name(void)
+
+#define ASSERT(cond) do { \
+    if (!(cond)) { \
+        printf("✗\n"); \
+        fprintf(stderr, "    FAILED: %s (line %d)\n", #cond, __LINE__); \
+        tests_failed++; \
+        tests_passed--; \
+        return; \
+    } \
+} while(0)
+
+#define ASSERT_EQ(a, b) ASSERT((a) == (b))
+#define ASSERT_NE(a, b) ASSERT((a) != (b))
+#define ASSERT_RANGE(val, min, max) ASSERT((val) >= (min) && (val) <= (max))
+
+/* ============================================================================
+ * Helper: NAL unit detection (copy of encoder logic for testing)
+ * ============================================================================ */
+
+static bool detect_h264_keyframe(const uint8_t *data, size_t size) {
+    if (!data || size < 5) return false;
+
+    for (size_t i = 0; i < size - 4; i++) {
+        bool sc3 = (data[i] == 0x00 && data[i+1] == 0x00 && data[i+2] == 0x01);
+        bool sc4 = (i + 4 < size && data[i] == 0x00 && data[i+1] == 0x00 &&
+                   data[i+2] == 0x00 && data[i+3] == 0x01);
+
+        if (sc3 || sc4) {
+            size_t idx = sc4 ? i + 4 : i + 3;
+            if (idx < size && (data[idx] & 0x1F) == 5) {
+                return true;
+            }
+            i += sc4 ? 3 : 2;
+        }
+    }
+    return false;
+}
+
+static bool detect_h265_keyframe(const uint8_t *data, size_t size) {
+    if (!data || size < 5) return false;
+
+    for (size_t i = 0; i < size - 4; i++) {
+        bool sc3 = (data[i] == 0x00 && data[i+1] == 0x00 && data[i+2] == 0x01);
+        bool sc4 = (i + 4 < size && data[i] == 0x00 && data[i+1] == 0x00 &&
+                   data[i+2] == 0x00 && data[i+3] == 0x01);
+
+        if (sc3 || sc4) {
+            size_t idx = sc4 ? i + 4 : i + 3;
+            if (idx < size) {
+                uint8_t nal_type = (data[idx] >> 1) & 0x3F;
+                if (nal_type == 19 || nal_type == 20 || nal_type == 21) {
+                    return true;
+                }
+            }
+            i += sc4 ? 3 : 2;
+        }
+    }
+    return false;
+}
+
+/* ============================================================================
+ * Tests: NAL Unit Parsing
+ * ============================================================================ */
+
+TEST(h264_idr_detection) {
+    /* H.264 IDR frame: start code + NAL type 5 */
+    uint8_t idr_frame[] = {
+        0x00, 0x00, 0x00, 0x01,  /* 4-byte start code */
+        0x65,                     /* NAL type 5 (IDR) with nal_ref_idc=3 */
+        0x88, 0x84, 0x00, 0x00   /* Some slice data */
+    };
+
+    ASSERT(detect_h264_keyframe(idr_frame, sizeof(idr_frame)));
+}
+
+TEST(h264_non_idr_detection) {
+    /* H.264 P-frame: start code + NAL type 1 */
+    uint8_t p_frame[] = {
+        0x00, 0x00, 0x00, 0x01,  /* 4-byte start code */
+        0x41,                     /* NAL type 1 (non-IDR) */
+        0x9A, 0x24, 0x6C, 0x00   /* Some slice data */
+    };
+
+    ASSERT(!detect_h264_keyframe(p_frame, sizeof(p_frame)));
+}
+
+TEST(h264_sps_pps_idr_sequence) {
+    /* Typical IDR with SPS/PPS: SPS + PPS + IDR */
+    uint8_t sequence[] = {
+        /* SPS (NAL type 7) */
+        0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E,
+        /* PPS (NAL type 8) */
+        0x00, 0x00, 0x00, 0x01, 0x68, 0xCE, 0x38, 0x80,
+        /* IDR (NAL type 5) */
+        0x00, 0x00, 0x00, 0x01, 0x65, 0x88, 0x84, 0x00
+    };
+
+    ASSERT(detect_h264_keyframe(sequence, sizeof(sequence)));
+}
+
+TEST(h264_3byte_start_code) {
+    /* 3-byte start code variant */
+    uint8_t idr_3byte[] = {
+        0x00, 0x00, 0x01,        /* 3-byte start code */
+        0x65,                     /* NAL type 5 (IDR) */
+        0x88, 0x84, 0x00
+    };
+
+    ASSERT(detect_h264_keyframe(idr_3byte, sizeof(idr_3byte)));
+}
+
+TEST(h265_idr_detection) {
+    /* H.265 IDR_W_RADL: NAL type 19 */
+    uint8_t idr_frame[] = {
+        0x00, 0x00, 0x00, 0x01,  /* Start code */
+        0x26, 0x01,              /* NAL header: type=19 (IDR_W_RADL) */
+        0x00, 0x00, 0x00, 0x00   /* Slice data */
+    };
+
+    ASSERT(detect_h265_keyframe(idr_frame, sizeof(idr_frame)));
+}
+
+TEST(h265_idr_n_lp_detection) {
+    /* H.265 IDR_N_LP: NAL type 20 */
+    uint8_t idr_frame[] = {
+        0x00, 0x00, 0x00, 0x01,
+        0x28, 0x01,              /* NAL type 20 */
+        0x00, 0x00, 0x00, 0x00
+    };
+
+    ASSERT(detect_h265_keyframe(idr_frame, sizeof(idr_frame)));
+}
+
+TEST(h265_cra_detection) {
+    /* H.265 CRA_NUT: NAL type 21 */
+    uint8_t cra_frame[] = {
+        0x00, 0x00, 0x00, 0x01,
+        0x2A, 0x01,              /* NAL type 21 (CRA) */
+        0x00, 0x00, 0x00, 0x00
+    };
+
+    ASSERT(detect_h265_keyframe(cra_frame, sizeof(cra_frame)));
+}
+
+TEST(h265_non_idr_detection) {
+    /* H.265 TRAIL_R: NAL type 1 (not keyframe) */
+    uint8_t p_frame[] = {
+        0x00, 0x00, 0x00, 0x01,
+        0x02, 0x01,              /* NAL type 1 */
+        0x00, 0x00, 0x00, 0x00
+    };
+
+    ASSERT(!detect_h265_keyframe(p_frame, sizeof(p_frame)));
+}
+
+TEST(empty_buffer_no_crash) {
+    ASSERT(!detect_h264_keyframe(NULL, 0));
+    ASSERT(!detect_h265_keyframe(NULL, 0));
+
+    uint8_t small[] = {0x00, 0x00};
+    ASSERT(!detect_h264_keyframe(small, sizeof(small)));
+    ASSERT(!detect_h265_keyframe(small, sizeof(small)));
+}
+
+/* ============================================================================
+ * Tests: Frame Buffer
+ * ============================================================================ */
+
+TEST(frame_buffer_init) {
+    frame_buffer_t frame = {0};
+
+    ASSERT_EQ(frame.data, NULL);
+    ASSERT_EQ(frame.size, 0);
+    ASSERT_EQ(frame.is_keyframe, false);
+}
+
+TEST(frame_buffer_allocation) {
+    frame_buffer_t frame = {0};
+
+    /* Simulate 1920x1080 RGBA frame */
+    size_t size = 1920 * 1080 * 4;
+    frame.data = malloc(size);
+    frame.size = size;
+    frame.width = 1920;
+    frame.height = 1080;
+    frame.pitch = 1920 * 4;
+    frame.format = 0x34325241;  /* DRM_FORMAT_RGBA8888 */
+
+    ASSERT(frame.data != NULL);
+    ASSERT_EQ(frame.size, size);
+    ASSERT_EQ(frame.width, 1920);
+    ASSERT_EQ(frame.height, 1080);
+
+    free(frame.data);
+}
+
+/* ============================================================================
+ * Tests: Encoder Context
+ * ============================================================================ */
+
+TEST(encoder_ctx_defaults) {
+    encoder_ctx_t enc = {0};
+
+    ASSERT_EQ(enc.type, ENCODER_VAAPI);  /* 0 = VAAPI */
+    ASSERT_EQ(enc.codec, CODEC_H264);    /* 0 = H264 */
+    ASSERT_EQ(enc.bitrate, 0);
+    ASSERT_EQ(enc.force_keyframe, false);
+}
+
+TEST(encoder_bitrate_validation) {
+    /* Valid bitrates for streaming */
+    uint32_t valid_bitrates[] = {
+        1000000,    /* 1 Mbps - minimum for decent quality */
+        5000000,    /* 5 Mbps - good for 720p */
+        10000000,   /* 10 Mbps - good for 1080p */
+        20000000,   /* 20 Mbps - high quality 1080p */
+        50000000,   /* 50 Mbps - 4K streaming */
+    };
+
+    for (size_t i = 0; i < sizeof(valid_bitrates) / sizeof(valid_bitrates[0]); i++) {
+        ASSERT_RANGE(valid_bitrates[i], 500000, 100000000);
+    }
+}
+
+TEST(encoder_framerate_validation) {
+    /* Valid framerates */
+    uint32_t valid_fps[] = {24, 30, 60, 120, 144, 240};
+
+    for (size_t i = 0; i < sizeof(valid_fps) / sizeof(valid_fps[0]); i++) {
+        ASSERT_RANGE(valid_fps[i], 1, 240);
+    }
+}
+
+/* ============================================================================
+ * Tests: Colorspace Math
+ * ============================================================================ */
+
+TEST(yuv_coefficients_bt709) {
+    /* BT.709 coefficients for Y calculation:
+     * Y = 0.2126*R + 0.7152*G + 0.0722*B
+     * Scaled: Y = (66*R + 129*G + 25*B + 128) >> 8 + 16
+     */
+
+    /* Test with pure white (255, 255, 255) */
+    uint8_t r = 255, g = 255, b = 255;
+    int y_val = (66*r + 129*g + 25*b + 128) >> 8;
+    y_val += 16;
+
+    /* Y should be close to 235 (white in video range) */
+    ASSERT_RANGE(y_val, 230, 240);
+
+    /* Test with pure black (0, 0, 0) */
+    r = g = b = 0;
+    y_val = (66*r + 129*g + 25*b + 128) >> 8;
+    y_val += 16;
+
+    /* Y should be 16 (black in video range) */
+    ASSERT_EQ(y_val, 16);
+}
+
+TEST(uv_coefficients_bt709) {
+    /* BT.709 U/V coefficients:
+     * U = -0.1146*R - 0.3854*G + 0.5*B
+     * V =  0.5*R - 0.4542*G - 0.0458*B
+     */
+
+    /* Pure red (255, 0, 0) - should have high V, low U */
+    uint8_t r = 255, g = 0, b = 0;
+    int u_val = (-38*r - 74*g + 112*b + 128) >> 8;
+    int v_val = (112*r - 94*g - 18*b + 128) >> 8;
+    u_val += 128;
+    v_val += 128;
+
+    ASSERT(v_val > 128);  /* Red has positive V */
+    ASSERT(u_val < 128);  /* Red has negative U */
+
+    /* Pure blue (0, 0, 255) - should have high U */
+    r = 0; g = 0; b = 255;
+    u_val = (-38*r - 74*g + 112*b + 128) >> 8;
+    u_val += 128;
+
+    ASSERT(u_val > 128);  /* Blue has positive U */
+}
+
+/* ============================================================================
+ * Tests: Control Commands
+ * ============================================================================ */
+
+TEST(control_packet_size) {
+    control_packet_t pkt;
+    /* Packed struct should be exactly 5 bytes */
+    ASSERT_EQ(sizeof(pkt), 5);
+}
+
+TEST(control_cmd_values) {
+    ASSERT_EQ(CTRL_PAUSE, 0x01);
+    ASSERT_EQ(CTRL_RESUME, 0x02);
+    ASSERT_EQ(CTRL_SET_BITRATE, 0x03);
+    ASSERT_EQ(CTRL_SET_FPS, 0x04);
+    ASSERT_EQ(CTRL_REQUEST_KEYFRAME, 0x05);
+    ASSERT_EQ(CTRL_SET_QUALITY, 0x06);
+    ASSERT_EQ(CTRL_DISCONNECT, 0x07);
+}
+
+/* ============================================================================
+ * Main
+ * ============================================================================ */
+
+int main(void) {
+    printf("\n");
+    printf("╔════════════════════════════════════════════════╗\n");
+    printf("║  RootStream Encoding Unit Tests                ║\n");
+    printf("╚════════════════════════════════════════════════╝\n");
+    printf("\n");
+
+    /* NAL parsing tests */
+    printf("NAL Unit Parsing:\n");
+    run_test_h264_idr_detection();
+    run_test_h264_non_idr_detection();
+    run_test_h264_sps_pps_idr_sequence();
+    run_test_h264_3byte_start_code();
+    run_test_h265_idr_detection();
+    run_test_h265_idr_n_lp_detection();
+    run_test_h265_cra_detection();
+    run_test_h265_non_idr_detection();
+    run_test_empty_buffer_no_crash();
+
+    /* Frame buffer tests */
+    printf("\nFrame Buffer:\n");
+    run_test_frame_buffer_init();
+    run_test_frame_buffer_allocation();
+
+    /* Encoder context tests */
+    printf("\nEncoder Context:\n");
+    run_test_encoder_ctx_defaults();
+    run_test_encoder_bitrate_validation();
+    run_test_encoder_framerate_validation();
+
+    /* Colorspace tests */
+    printf("\nColorspace Conversion:\n");
+    run_test_yuv_coefficients_bt709();
+    run_test_uv_coefficients_bt709();
+
+    /* Control command tests */
+    printf("\nControl Commands:\n");
+    run_test_control_packet_size();
+    run_test_control_cmd_values();
+
+    /* Summary */
+    printf("\n");
+    printf("════════════════════════════════════════════════\n");
+    printf("  Results: %d/%d passed", tests_passed, tests_run);
+    if (tests_failed > 0) {
+        printf(" (%d failed)", tests_failed);
+    }
+    printf("\n");
+    printf("════════════════════════════════════════════════\n");
+    printf("\n");
+
+    return tests_failed > 0 ? 1 : 0;
+}
diff --git a/tools/latency-analyzer.py b/tools/latency-analyzer.py
new file mode 100755
index 0000000..8aa4a80
--- /dev/null
+++ b/tools/latency-analyzer.py
@@ -0,0 +1,413 @@
+#!/usr/bin/env python3
+"""
+latency-analyzer.py - RootStream Latency Analysis Tool
+
+Parses latency log files and generates performance reports.
+
+Usage:
+    python3 tools/latency-analyzer.py [OPTIONS] <logfile>
+
+Options:
+    --json          Output as JSON
+    --csv           Export raw data as CSV
+    --plot          Generate latency plot (requires matplotlib)
+    --threshold MS  Warn if p99 exceeds threshold (default: 50ms)
+
+Log Format (from RootStream latency logging):
+    LATENCY: capture=XXXus encode=XXXus send=XXXus total=XXXus
+
+Example:
+    rootstream host --latency > latency.log
+    python3 tools/latency-analyzer.py latency.log
+"""
+
+import sys
+import re
+import argparse
+import json
+from dataclasses import dataclass
+from typing import List, Optional
+from statistics import mean, median, stdev
+
+
+@dataclass
+class LatencySample:
+    """Single latency measurement"""
+    capture_us: int
+    encode_us: int
+    send_us: int
+    total_us: int
+
+    @property
+    def capture_ms(self) -> float:
+        return self.capture_us / 1000.0
+
+    @property
+    def encode_ms(self) -> float:
+        return self.encode_us / 1000.0
+
+    @property
+    def send_ms(self) -> float:
+        return self.send_us / 1000.0
+
+    @property
+    def total_ms(self) -> float:
+        return self.total_us / 1000.0
+
+
+class LatencyAnalyzer:
+    """Analyzes RootStream latency logs"""
+
+    # Regex to parse latency lines
+    LATENCY_PATTERN = re.compile(
+        r'LATENCY:\s*'
+        r'capture=(\d+)us\s+'
+        r'encode=(\d+)us\s+'
+        r'send=(\d+)us\s+'
+        r'total=(\d+)us'
+    )
+
+    def __init__(self):
+        self.samples: List[LatencySample] = []
+
+    def parse_file(self, filename: str) -> int:
+        """Parse latency log file. Returns number of samples parsed."""
+        count = 0
+        with open(filename, 'r') as f:
+            for line in f:
+                match = self.LATENCY_PATTERN.search(line)
+                if match:
+                    sample = LatencySample(
+                        capture_us=int(match.group(1)),
+                        encode_us=int(match.group(2)),
+                        send_us=int(match.group(3)),
+                        total_us=int(match.group(4))
+                    )
+                    self.samples.append(sample)
+                    count += 1
+        return count
+
+    def parse_stdin(self) -> int:
+        """Parse latency data from stdin. Returns number of samples parsed."""
+        count = 0
+        for line in sys.stdin:
+            match = self.LATENCY_PATTERN.search(line)
+            if match:
+                sample = LatencySample(
+                    capture_us=int(match.group(1)),
+                    encode_us=int(match.group(2)),
+                    send_us=int(match.group(3)),
+                    total_us=int(match.group(4))
+                )
+                self.samples.append(sample)
+                count += 1
+        return count
+
+    def percentile(self, values: List[float], p: float) -> float:
+        """Calculate percentile of sorted values"""
+        if not values:
+            return 0.0
+        sorted_values = sorted(values)
+        k = (len(sorted_values) - 1) * (p / 100.0)
+        f = int(k)
+        c = f + 1
+        if c >= len(sorted_values):
+            return sorted_values[-1]
+        return sorted_values[f] + (k - f) * (sorted_values[c] - sorted_values[f])
+
+    def analyze(self) -> dict:
+        """Generate analysis report"""
+        if not self.samples:
+            return {"error": "No samples to analyze"}
+
+        # Extract individual stage timings
+        capture_ms = [s.capture_ms for s in self.samples]
+        encode_ms = [s.encode_ms for s in self.samples]
+        send_ms = [s.send_ms for s in self.samples]
+        total_ms = [s.total_ms for s in self.samples]
+
+        def stage_stats(values: List[float], name: str) -> dict:
+            return {
+                "name": name,
+                "count": len(values),
+                "min_ms": round(min(values), 2),
+                "max_ms": round(max(values), 2),
+                "mean_ms": round(mean(values), 2),
+                "median_ms": round(median(values), 2),
+                "stdev_ms": round(stdev(values), 2) if len(values) > 1 else 0,
+                "p50_ms": round(self.percentile(values, 50), 2),
+                "p95_ms": round(self.percentile(values, 95), 2),
+                "p99_ms": round(self.percentile(values, 99), 2),
+            }
+
+        report = {
+            "sample_count": len(self.samples),
+            "stages": {
+                "capture": stage_stats(capture_ms, "Capture"),
+                "encode": stage_stats(encode_ms, "Encode"),
+                "send": stage_stats(send_ms, "Send"),
+                "total": stage_stats(total_ms, "Total"),
+            },
+            "frame_drops": self.detect_frame_drops(),
+            "recommendations": self.generate_recommendations(),
+        }
+
+        return report
+
+    def detect_frame_drops(self) -> dict:
+        """Detect potential frame drops based on latency spikes"""
+        if len(self.samples) < 2:
+            return {"detected": 0, "threshold_ms": 0}
+
+        # Frame is considered dropped if total latency > 2x median
+        total_ms = [s.total_ms for s in self.samples]
+        med = median(total_ms)
+        threshold = med * 2
+
+        drops = sum(1 for t in total_ms if t > threshold)
+        drop_indices = [i for i, t in enumerate(total_ms) if t > threshold]
+
+        return {
+            "detected": drops,
+            "threshold_ms": round(threshold, 2),
+            "drop_rate_percent": round(100.0 * drops / len(self.samples), 2),
+            "drop_indices": drop_indices[:10],  # First 10 only
+        }
+
+    def generate_recommendations(self) -> List[str]:
+        """Generate performance recommendations"""
+        recommendations = []
+
+        if not self.samples:
+            return ["No data to analyze"]
+
+        total_ms = [s.total_ms for s in self.samples]
+        encode_ms = [s.encode_ms for s in self.samples]
+        capture_ms = [s.capture_ms for s in self.samples]
+
+        p99_total = self.percentile(total_ms, 99)
+        mean_encode = mean(encode_ms)
+        mean_capture = mean(capture_ms)
+
+        # Check total latency
+        if p99_total > 50:
+            recommendations.append(
+                f"p99 latency ({p99_total:.1f}ms) exceeds 50ms target. "
+                "Consider reducing resolution or bitrate."
+            )
+        elif p99_total > 33:
+            recommendations.append(
+                f"p99 latency ({p99_total:.1f}ms) exceeds 33ms (30fps frame time). "
+                "May cause stuttering at high framerates."
+            )
+        else:
+            recommendations.append(
+                f"Latency is good (p99: {p99_total:.1f}ms). "
+                "Suitable for responsive gameplay."
+            )
+
+        # Check encode time
+        if mean_encode > 10:
+            recommendations.append(
+                f"Encode time is high ({mean_encode:.1f}ms avg). "
+                "Try enabling low-latency preset or reducing quality."
+            )
+
+        # Check capture time
+        if mean_capture > 5:
+            recommendations.append(
+                f"Capture time is high ({mean_capture:.1f}ms avg). "
+                "Ensure DRM/KMS capture is working (not software fallback)."
+            )
+
+        # Check for high variance
+        if len(total_ms) > 10:
+            cv = stdev(total_ms) / mean(total_ms)  # Coefficient of variation
+            if cv > 0.5:
+                recommendations.append(
+                    f"High latency variance (CV: {cv:.2f}). "
+                    "May indicate system load or thermal throttling."
+                )
+
+        return recommendations
+
+    def to_csv(self) -> str:
+        """Export samples as CSV"""
+        lines = ["capture_us,encode_us,send_us,total_us"]
+        for s in self.samples:
+            lines.append(f"{s.capture_us},{s.encode_us},{s.send_us},{s.total_us}")
+        return "\n".join(lines)
+
+    def print_report(self, report: dict, threshold_ms: float = 50.0):
+        """Print formatted report to stdout"""
+        print()
+        print("╔════════════════════════════════════════════════╗")
+        print("║  RootStream Latency Analysis                   ║")
+        print("╚════════════════════════════════════════════════╝")
+        print()
+
+        print(f"Samples analyzed: {report['sample_count']}")
+        print()
+
+        # Stage breakdown table
+        print("┌─────────────┬─────────┬─────────┬─────────┬─────────┬─────────┐")
+        print("│ Stage       │ Mean    │ Median  │ p95     │ p99     │ Max     │")
+        print("├─────────────┼─────────┼─────────┼─────────┼─────────┼─────────┤")
+
+        for stage_name in ["capture", "encode", "send", "total"]:
+            stage = report["stages"][stage_name]
+            print(f"│ {stage['name']:<11} │ {stage['mean_ms']:>5.1f}ms │ "
+                  f"{stage['median_ms']:>5.1f}ms │ {stage['p95_ms']:>5.1f}ms │ "
+                  f"{stage['p99_ms']:>5.1f}ms │ {stage['max_ms']:>5.1f}ms │")
+
+        print("└─────────────┴─────────┴─────────┴─────────┴─────────┴─────────┘")
+        print()
+
+        # Frame drops
+        drops = report["frame_drops"]
+        if drops["detected"] > 0:
+            print(f"⚠ Frame drops detected: {drops['detected']} "
+                  f"({drops['drop_rate_percent']:.1f}%)")
+        else:
+            print("✓ No frame drops detected")
+        print()
+
+        # Recommendations
+        print("Recommendations:")
+        for rec in report["recommendations"]:
+            print(f"  • {rec}")
+        print()
+
+        # Threshold check
+        p99 = report["stages"]["total"]["p99_ms"]
+        if p99 > threshold_ms:
+            print(f"⚠ WARNING: p99 latency ({p99:.1f}ms) exceeds "
+                  f"threshold ({threshold_ms:.1f}ms)")
+            return 1
+        else:
+            print(f"✓ p99 latency ({p99:.1f}ms) within threshold ({threshold_ms:.1f}ms)")
+            return 0
+
+
+def plot_latency(analyzer: LatencyAnalyzer, output_file: Optional[str] = None):
+    """Generate latency plot (requires matplotlib)"""
+    try:
+        import matplotlib.pyplot as plt
+    except ImportError:
+        print("ERROR: matplotlib required for plotting. Install with:")
+        print("  pip install matplotlib")
+        return
+
+    samples = analyzer.samples
+    if not samples:
+        print("ERROR: No samples to plot")
+        return
+
+    # Prepare data
+    x = range(len(samples))
+    capture = [s.capture_ms for s in samples]
+    encode = [s.encode_ms for s in samples]
+    send = [s.send_ms for s in samples]
+    total = [s.total_ms for s in samples]
+
+    # Create stacked area chart
+    fig, (ax1, ax2) = plt.subplots(2, 1, figsize=(12, 8))
+
+    # Top: Stacked breakdown
+    ax1.stackplot(x, capture, encode, send,
+                  labels=['Capture', 'Encode', 'Send'],
+                  colors=['#2ecc71', '#3498db', '#e74c3c'],
+                  alpha=0.8)
+    ax1.set_ylabel('Latency (ms)')
+    ax1.set_title('RootStream Latency Breakdown')
+    ax1.legend(loc='upper right')
+    ax1.grid(True, alpha=0.3)
+
+    # Bottom: Total latency with percentile lines
+    ax2.plot(x, total, color='#9b59b6', linewidth=0.5, alpha=0.7)
+    ax2.axhline(y=analyzer.percentile(total, 50), color='green',
+                linestyle='--', label='p50')
+    ax2.axhline(y=analyzer.percentile(total, 95), color='orange',
+                linestyle='--', label='p95')
+    ax2.axhline(y=analyzer.percentile(total, 99), color='red',
+                linestyle='--', label='p99')
+    ax2.set_xlabel('Frame')
+    ax2.set_ylabel('Total Latency (ms)')
+    ax2.set_title('Total Latency with Percentiles')
+    ax2.legend(loc='upper right')
+    ax2.grid(True, alpha=0.3)
+
+    plt.tight_layout()
+
+    if output_file:
+        plt.savefig(output_file, dpi=150)
+        print(f"Plot saved to: {output_file}")
+    else:
+        plt.show()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description='Analyze RootStream latency logs',
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  %(prog)s latency.log                  # Basic analysis
+  %(prog)s --json latency.log           # JSON output
+  %(prog)s --plot latency.log           # Generate plot
+  %(prog)s --threshold 30 latency.log   # Fail if p99 > 30ms
+  cat latency.log | %(prog)s -           # Read from stdin
+"""
+    )
+
+    parser.add_argument('logfile', help='Latency log file (or - for stdin)')
+    parser.add_argument('--json', action='store_true', help='Output as JSON')
+    parser.add_argument('--csv', action='store_true', help='Export raw data as CSV')
+    parser.add_argument('--plot', nargs='?', const=True, default=False,
+                        help='Generate plot (optionally specify output file)')
+    parser.add_argument('--threshold', type=float, default=50.0,
+                        help='p99 threshold in ms (default: 50)')
+
+    args = parser.parse_args()
+
+    analyzer = LatencyAnalyzer()
+
+    # Parse input
+    if args.logfile == '-':
+        count = analyzer.parse_stdin()
+    else:
+        try:
+            count = analyzer.parse_file(args.logfile)
+        except FileNotFoundError:
+            print(f"ERROR: File not found: {args.logfile}", file=sys.stderr)
+            return 1
+        except Exception as e:
+            print(f"ERROR: {e}", file=sys.stderr)
+            return 1
+
+    if count == 0:
+        print("ERROR: No latency samples found in input", file=sys.stderr)
+        print("Expected format: LATENCY: capture=XXXus encode=XXXus send=XXXus total=XXXus",
+              file=sys.stderr)
+        return 1
+
+    # Output modes
+    if args.csv:
+        print(analyzer.to_csv())
+        return 0
+
+    report = analyzer.analyze()
+
+    if args.json:
+        print(json.dumps(report, indent=2))
+        return 0
+
+    if args.plot:
+        output_file = args.plot if isinstance(args.plot, str) else None
+        plot_latency(analyzer, output_file)
+
+    return analyzer.print_report(report, args.threshold)
+
+
+if __name__ == '__main__':
+    sys.exit(main() or 0)