diff --git a/.env.example b/.env.example
index b07f628..969f9e4 100644
--- a/.env.example
+++ b/.env.example
@@ -25,6 +25,25 @@ R2_ENDPOINT=
 R2_ACCESS_KEY_ID=
 R2_SECRET_ACCESS_KEY=
 
+# Cloudflare Realtime TURN, for relaying printer camera video.
+#
+# Optional, and unset is a supported state rather than a broken one: with no
+# TURN the console can still play a camera for a viewer on the gateway's own
+# network, over host candidates. Remote viewers need this.
+#
+# Why a relay at all: a browser cannot reach a gateway directly. go2rtc sends
+# no CORS headers and checks its API password before CORS, so a browser's
+# unauthenticated preflight gets a 401 - and a gateway is behind a workshop
+# NAT besides. Only the SDP exchange is relayed by this backend; the media
+# goes browser-to-gateway through TURN, DTLS-SRTP encrypted, so neither this
+# process nor Cloudflare can read it.
+#
+# The browser is pinned to relay-only when these are set, so video never goes
+# peer-to-peer and behaves the same on every customer network. Credentials
+# are minted per request with a 1 hour TTL (src/camera/ice.ts).
+# CLOUDFLARE_TURN_KEY_ID=
+# CLOUDFLARE_TURN_API_TOKEN=
+
 # Supabase Auth. Access tokens are verified against this project's published
 # JWKS (RS256), so no signing secret is needed - or wanted - here.
 SUPABASE_URL=
diff --git a/scripts/e2e-edge.sh b/scripts/e2e-edge.sh
index 265185c..6a77f31 100755
--- a/scripts/e2e-edge.sh
+++ b/scripts/e2e-edge.sh
@@ -325,11 +325,37 @@ else
     || fail "GET /printers/$CAM_UUID/stream failed for a printer that has a camera"
   echo "$STREAM" | grep -q "\"cameraId\":\"$WITH_CAMERA\"" \
     || fail "wrong cameraId: $STREAM"
-  # The farm's stream base URL has to survive the hello and come back out of
-  # an in-memory connection, which is the part with no unit test behind it.
-  echo "$STREAM" | grep -q "\"streamUrl\":\"$STREAM_BASE_URL\"" \
-    || fail "streamUrl did not come back from the gateway's hello: $STREAM"
+  # Deliberately NOT a URL any more. A browser cannot play from a gateway's
+  # own address - go2rtc sends no CORS headers and 401s an unauthenticated
+  # preflight - so serving one offered a player that could never load. If
+  # this reappears, something has regressed to the pre-relay design.
+  echo "$STREAM" | grep -q '"streamUrl"' \
+    && fail "the stream endpoint is serving a gateway URL again: $STREAM"
+  # No Cloudflare credentials in this test, so TURN is off and iceServers is
+  # empty. Both are asserted, because an empty list with turnConfigured true
+  # would mean minting silently failed.
+  echo "$STREAM" | grep -q '"turnConfigured":false' \
+    || fail "expected TURN to be unconfigured in the test env: $STREAM"
+  echo "$STREAM" | grep -q '"iceServers":\[\]' \
+    || fail "expected no ICE servers when TURN is unconfigured: $STREAM"
   ok "GET .../stream: $STREAM"
+
+  # The signalling relay, end to end through the real gateway: an offer goes
+  # cloud -> uplink -> gateway -> its own go2rtc. go2rtc is not running in
+  # this test (see CONTINUUM_GO2RTC_BIN above), so the honest expectation is
+  # a 503 whose reason came back *from the gateway* rather than from a
+  # timeout - that is what proves the round trip happened at all.
+  OFFER_CODE="$(curl -s -o "$WORK/offer.json" -w '%{http_code}' -X POST \
+    -H "$AUTH_HEADER" -H 'Content-Type: application/json' \
+    -d '{"sdp":"v=0\r\no=- 0 0 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\n"}' \
+    "$BASE/printers/$CAM_UUID/webrtc")"
+  if [ "$OFFER_CODE" = "503" ] && grep -q 'go2rtc\|connection refused\|refused the offer' "$WORK/offer.json"; then
+    ok "the WebRTC offer reached the gateway and its go2rtc answered (as a refusal): $(head -c 160 "$WORK/offer.json")"
+  elif [ "$OFFER_CODE" = "503" ] && grep -q 'did not answer within' "$WORK/offer.json"; then
+    fail "the gateway never answered the offer - the relay did not round-trip: $(cat "$WORK/offer.json")"
+  else
+    fail "unexpected answer to a WebRTC offer (HTTP $OFFER_CODE): $(cat "$WORK/offer.json")"
+  fi
 fi
 
 # A printer with no camera must 404, and say which half is missing. This is
diff --git a/src/camera/ice.ts b/src/camera/ice.ts
new file mode 100644
index 0000000..b090ce8
--- /dev/null
+++ b/src/camera/ice.ts
@@ -0,0 +1,106 @@
+/**
+ * ICE servers for a browser about to watch a printer camera.
+ *
+ * ## Why the browser needs these at all
+ *
+ * A viewer's browser cannot reach a gateway directly. The gateway is behind a
+ * workshop NAT, and go2rtc will not talk to a browser cross-origin anyway -
+ * measured against 1.9.14, it sends no CORS headers and checks its API
+ * password before CORS, so a browser's unauthenticated preflight gets a 401.
+ * The SDP exchange is therefore relayed through this backend, and the media
+ * itself goes over a TURN relay.
+ *
+ * ## Why only the browser gets credentials
+ *
+ * The browser is pinned to `iceTransportPolicy: "relay"`, so it gathers a
+ * relay candidate and go2rtc simply sends to it from its own candidate. Only
+ * one side of a WebRTC session has to hold a relay for media to traverse one.
+ *
+ * That asymmetry is load-bearing rather than tidy: go2rtc reads its config
+ * exactly once at startup, so TURN credentials on the gateway would have to
+ * be rotated by restarting go2rtc and dropping every viewer on a timer.
+ * Browser-side, rotation lands on a request that is already per-viewer.
+ *
+ * ## What this buys over proxying the video
+ *
+ * WebRTC media is DTLS-SRTP encrypted between the browser and the gateway, so
+ * the relay forwards packets it cannot decrypt. The alternative considered -
+ * tunnelling fMP4 up the gateway's uplink and streaming it from this process -
+ * would have put plaintext video through the API, and `<video>` cannot send
+ * an `Authorization` header, so it would have needed a credential in the URL.
+ * That is the pattern `/ws/telemetry` deliberately rejected.
+ *
+ * ## Unconfigured is a supported state
+ *
+ * No Cloudflare credentials means no TURN, and that is not a boot failure the
+ * way R2 is: a farm with no cameras, or one whose operator is on the same LAN
+ * as the gateway, works without it. The endpoint says so rather than
+ * pretending, because "no iceServers" and "TURN is broken" need different
+ * answers from whoever is looking.
+ */
+
+const KEY_ID = process.env.CLOUDFLARE_TURN_KEY_ID;
+const API_TOKEN = process.env.CLOUDFLARE_TURN_API_TOKEN;
+
+/**
+ * Short on purpose. These are handed to a browser, so the window in which a
+ * leaked one is useful is the window this sets. An hour outlasts setting up a
+ * session comfortably; a viewer watching longer than that has their relay
+ * drop and the player renegotiates, which costs a reconnect and gets fresh
+ * credentials - the right trade against a credential that stays good all day.
+ */
+const TTL_SECONDS = 3600;
+
+/** Whether TURN is configured at all. */
+export function turnConfigured(): boolean {
+  return Boolean(KEY_ID && API_TOKEN);
+}
+
+export type IceServer = {
+  urls: string | string[];
+  username?: string;
+  credential?: string;
+};
+
+/**
+ * Mints a short-lived set of ICE servers, or returns null when TURN is not
+ * configured.
+ *
+ * Throws only when TURN *is* configured and Cloudflare refused: that is a
+ * real fault and must not be reported as "no TURN here", which would send a
+ * viewer into a session that cannot carry media.
+ */
+export async function mintIceServers(): Promise<IceServer[] | null> {
+  if (!KEY_ID || !API_TOKEN) return null;
+
+  const response = await fetch(
+    `https://rtc.live.cloudflare.com/v1/turn/keys/${encodeURIComponent(KEY_ID)}/credentials/generate-ice-servers`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${API_TOKEN}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ ttl: TTL_SECONDS }),
+    },
+  );
+
+  // 201 on success, per Cloudflare's own docs, so this checks the class.
+  if (!response.ok) {
+    // The body carries the reason - a wrong key id, a revoked token - and a
+    // bare status would send whoever reads this at the network instead.
+    const detail = await response.text().catch(() => "");
+    throw new Error(
+      `Cloudflare TURN refused to mint credentials (HTTP ${response.status})` +
+        (detail.trim() ? `: ${detail.trim().slice(0, 300)}` : ""),
+    );
+  }
+
+  const body = (await response.json()) as { iceServers?: IceServer | IceServer[] };
+  if (!body.iceServers) {
+    throw new Error("Cloudflare TURN returned no iceServers");
+  }
+  // Cloudflare returns a single object; the browser's RTCPeerConnection wants
+  // a list. Normalised here so every caller does not have to know that.
+  return Array.isArray(body.iceServers) ? body.iceServers : [body.iceServers];
+}
diff --git a/src/routes/printers.ts b/src/routes/printers.ts
index b59cfd3..0c55a31 100644
--- a/src/routes/printers.ts
+++ b/src/routes/printers.ts
@@ -9,7 +9,8 @@ import { printerProjection } from "../db/projections";
 import { requireFarm, requirePrinter, requireUser, visiblePrinters } from "../auth";
 import { PaginationQuery, paginate } from "./pagination";
 import { resolveStream } from "../stream";
-import { getStreamBaseUrl, isGatewayOnline, sendPrinterCommand } from "./ws/edge";
+import { mintIceServers, turnConfigured } from "../camera/ice";
+import { isGatewayOnline, negotiateCameraStream, sendPrinterCommand } from "./ws/edge";
 
 const IdParams = t.Object({ id: t.String({ format: "uuid" }) });
 
@@ -201,18 +202,31 @@ export const printerRoutes = new Elysia({ prefix: "/printers" })
     { params: IdParams, detail: { tags: ["printers"] } },
   )
   /**
-   * Where a browser can play this printer's camera.
+   * What a browser needs to start watching this printer's camera.
    *
-   * 404 rather than 200-with-nulls when either half is missing: a frontend
-   * handed `{ streamUrl: null }` has to remember to check, and one that
+   * Deliberately no URL. A browser cannot play from a gateway's own address:
+   * go2rtc sends no CORS headers and checks its API password before CORS, so
+   * an unauthenticated preflight gets a 401 - measured against 1.9.14 - and
+   * a gateway sits behind a workshop NAT besides. This used to return the
+   * gateway's LAN address, which could only ever have worked for an operator
+   * standing on the same network, and offered every other viewer a player
+   * that silently never loaded.
+   *
+   * So the caller gets a camera name to negotiate for and the ICE servers to
+   * negotiate with, then POSTs an offer to `/:id/webrtc`. Media travels
+   * browser-to-gateway over the TURN relay, DTLS-SRTP encrypted, so neither
+   * this process nor the relay can read it.
+   *
+   * 404 rather than 200-with-nulls when it cannot be watched: a frontend
+   * handed `{ cameraId: null }` has to remember to check, and one that
    * forgets renders a broken player. The two causes get different messages
-   * because they are different problems for whoever debugs it (a P1/A1 that
-   * can never stream, versus a gateway that is merely offline).
+   * because they are different problems (a P1/A1 that can never stream,
+   * versus a gateway that is merely unplugged).
    *
-   * LIMITATION, by design for the MVP: `streamUrl` is the gateway's LAN
-   * address and nothing relays it. A browser on the gateway's network can
-   * play it; one outside cannot, and this endpoint cannot tell which the
-   * caller is. A relay is the fix and does not exist yet.
+   * `iceServers` is empty when TURN is not configured. That is a supported
+   * state, not a failure: an operator on the gateway's own LAN connects on
+   * host candidates alone. It does mean remote viewers will not work until
+   * CLOUDFLARE_TURN_KEY_ID and CLOUDFLARE_TURN_API_TOKEN are set.
    */
   .get(
     "/:id/stream",
@@ -224,12 +238,85 @@ export const printerRoutes = new Elysia({ prefix: "/printers" })
       });
       if (!printer) throw new NotFoundError(`Printer ${params.id} not found`);
 
-      const result = resolveStream(printer.cameraStream, getStreamBaseUrl(printer.farmId));
+      // The gateway has to be connected, because it is what answers the
+      // offer - a camera name alone would start a negotiation with nobody.
+      const result = resolveStream(printer.cameraStream, isGatewayOnline(printer.farmId));
       if (!result.ok) throw new NotFoundError(result.message);
-      return result.stream;
+
+      // Minted per request and short-lived, so the window in which a leaked
+      // credential is useful is small. Never cached in the client beyond the
+      // session it opens.
+      const iceServers = await mintIceServers();
+      return { ...result.stream, iceServers: iceServers ?? [], turnConfigured: turnConfigured() };
     },
     {
       params: IdParams,
-      detail: { tags: ["printers"], summary: "Where to play this printer's camera (LAN address)" },
+      detail: {
+        tags: ["printers"],
+        summary: "What a browser needs to negotiate this printer's camera",
+      },
+    },
+  )
+  /**
+   * Relays a browser's WebRTC offer to the printer's gateway and returns
+   * go2rtc's answer.
+   *
+   * **This endpoint carries signalling, not video.** One small request and
+   * response; the media then flows browser-to-gateway directly over ICE. On
+   * a workshop LAN it never leaves the building and costs this backend no
+   * bandwidth, which is the whole reason the relay is built this way rather
+   * than proxying bytes - that would have put every viewer's video through
+   * the cloud and added a second of fragment buffering.
+   *
+   * It is also the *only* way a browser can play these cameras. go2rtc
+   * sends no CORS headers and checks its API password before CORS, so a
+   * browser signalling to a gateway directly gets a 401 on its preflight -
+   * measured against 1.9.14, not assumed. And a gateway is behind a workshop
+   * NAT, so this backend cannot dial in either; the gateway's own outbound
+   * socket is the only path.
+   *
+   * Takes the offer as JSON rather than `application/sdp` so it validates
+   * like every other route here, and because `application/sdp` is not a
+   * CORS-safelisted content type - which is exactly the trap that makes the
+   * direct path impossible.
+   */
+  .post(
+    "/:id/webrtc",
+    async ({ user, params, body, status }) => {
+      // "viewer" is deliberate: watching a camera is reading. Anything that
+      // moves the machine wants "operator".
+      await requirePrinter(user.id, params.id, "viewer");
+
+      const result: { sdp?: string; error?: string } = await negotiateCameraStream(
+        params.id,
+        body.sdp,
+      ).catch((err: unknown) => ({ error: err instanceof Error ? err.message : String(err) }));
+
+      // 503, not 500: nothing is wrong with this request, and a client that
+      // gets this should try again later rather than change what it sent.
+      if (!result.sdp) {
+        return status(503, {
+          error: "CAMERA_UNAVAILABLE",
+          message: result.error ?? "the gateway did not return an answer",
+        });
+      }
+      return { sdp: result.sdp };
+    },
+    {
+      params: IdParams,
+      body: t.Object({
+        sdp: t.String({
+          // An SDP offer from a browser is a few kilobytes. Bounded because
+          // this is forwarded verbatim over a farm's control socket, and that
+          // socket also carries telemetry for every printer on it.
+          minLength: 1,
+          maxLength: 64_000,
+          description: "The browser's WebRTC offer SDP",
+        }),
+      }),
+      detail: {
+        tags: ["printers"],
+        summary: "Relay a WebRTC offer to this printer's camera (signalling only)",
+      },
     },
   );
diff --git a/src/routes/ws/edge.ts b/src/routes/ws/edge.ts
index b19c437..0145363 100644
--- a/src/routes/ws/edge.ts
+++ b/src/routes/ws/edge.ts
@@ -68,6 +68,11 @@ interface PendingCommand {
   timer: ReturnType<typeof setTimeout>;
 }
 
+interface PendingWebrtc {
+  resolve: (result: { sdp?: string; error?: string }) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
 interface EdgeConn {
   farmId: string;
   gatewayId: string;
@@ -104,6 +109,13 @@ interface EdgeConn {
   printerIds: Map<string, string>;
   /** Commands sent but not yet answered, keyed by command_id. */
   pending: Map<string, PendingCommand>;
+  /**
+   * In-flight camera negotiations, keyed by session id. Separate from
+   * `pending` because the two resolve with different things and a webrtc
+   * session is not a command - nothing physical happens, and nothing is
+   * retried.
+   */
+  webrtc: Map<string, PendingWebrtc>;
 }
 
 const connections = new Map<string, EdgeConn>();
@@ -183,6 +195,15 @@ export function listUnclaimedPrinters(farmId: string): UnclaimedPrinter[] {
 /** How long to wait for a gateway to answer a command before giving up. */
 const COMMAND_TIMEOUT_MS = 10_000;
 
+/**
+ * Longer than a command, because answering means gathering ICE candidates
+ * and that includes a STUN round trip from the gateway. Measured against
+ * go2rtc 1.9.14 it is well under this, but the gateway's own request to
+ * go2rtc is capped at 8s, so this has to outlast that or the cloud would
+ * give up on an answer that was still coming.
+ */
+const WEBRTC_TIMEOUT_MS = 12_000;
+
 /**
  * How long an authenticated socket may stay open without sending `hello`.
  * Generous compared with the round trip it covers - a gateway sends `hello`
@@ -369,6 +390,67 @@ export async function sendPrinterCommand(
   return { ...result, commandId };
 }
 
+/**
+ * Relays a browser's WebRTC offer to the gateway that owns this printer and
+ * returns go2rtc's answer.
+ *
+ * **Signalling only.** No video passes through this process: once the
+ * browser has the answer, it and the gateway's go2rtc negotiate media
+ * directly over ICE. On a workshop LAN that keeps the stream inside the
+ * building and costs this backend no bandwidth at all, which is why the
+ * relay carries SDP rather than bytes.
+ *
+ * The cloud has to be in the middle because neither end can reach the other
+ * directly. A browser cannot signal to go2rtc - measured against 1.9.14, it
+ * sends no CORS headers and checks its password before CORS, so a browser's
+ * unauthenticated preflight gets a 401 - and a gateway is behind a workshop
+ * NAT, so this backend cannot dial in either. The gateway's own outbound
+ * socket is the only path, and it already exists.
+ *
+ * Throws for a printer that is unknown, has no camera, or whose farm has no
+ * gateway connected. Resolves `{ error }` when the gateway answered with a
+ * failure or did not answer in time - the caller needs to tell "no camera
+ * here" from "the gateway never replied".
+ */
+export async function negotiateCameraStream(
+  printerId: string,
+  offerSdp: string,
+): Promise<{ sdp?: string; error?: string }> {
+  const printer = await db.query.printers.findFirst({
+    columns: { id: true, farmId: true, cameraStream: true },
+    where: eq(printers.id, printerId),
+  });
+
+  if (!printer) throw new Error(`printer ${printerId} not found`);
+  // Checked here rather than left to go2rtc: the gateway would refuse an
+  // unknown stream anyway, but 12 seconds later and as a vaguer error.
+  if (!printer.cameraStream) {
+    throw new Error(`printer ${printerId} has no camera stream`);
+  }
+
+  const wsId = gatewayByFarm.get(printer.farmId);
+  const conn = wsId ? connections.get(wsId) : undefined;
+  if (!conn) throw new Error(`no gateway connected for farm ${printer.farmId}`);
+
+  const sessionId = crypto.randomUUID();
+
+  return new Promise<{ sdp?: string; error?: string }>((resolve) => {
+    const timer = setTimeout(() => {
+      conn.webrtc.delete(sessionId);
+      resolve({ error: `gateway did not answer within ${WEBRTC_TIMEOUT_MS}ms` });
+    }, WEBRTC_TIMEOUT_MS);
+
+    conn.webrtc.set(sessionId, { resolve, timer });
+
+    conn.send({
+      type: "webrtc_offer",
+      session_id: sessionId,
+      camera_stream: printer.cameraStream!,
+      sdp: offerSdp,
+    });
+  });
+}
+
 /** Whether a farm currently has a gateway connected. */
 export function isGatewayOnline(farmId: string): boolean {
   const wsId = gatewayByFarm.get(farmId);
@@ -380,6 +462,13 @@ export function isGatewayOnline(farmId: string): boolean {
  * undefined if no gateway is connected or it advertised none. Deliberately
  * does not distinguish those two: callers only need to know it is unusable.
  */
+/**
+ * No longer part of the playback path, and kept deliberately rather than
+ * deleted: gateways still report `stream_base_url` in their hello, and it is
+ * the only record of where a gateway thinks it is reachable - useful when
+ * diagnosing one. Nothing serves it to a browser any more, because a browser
+ * cannot use it (no CORS on go2rtc, and a workshop NAT in the way).
+ */
 export function getStreamBaseUrl(farmId: string): string | undefined {
   const wsId = gatewayByFarm.get(farmId);
   return wsId ? connections.get(wsId)?.streamBaseUrl : undefined;
@@ -426,6 +515,7 @@ export const edgeWsRoute = new Elysia()
         send: (message) => ws.send(message),
         printerIds: new Map(),
         pending: new Map(),
+        webrtc: new Map(),
       };
 
       conn.handshakeTimer = setTimeout(() => {
@@ -498,6 +588,29 @@ export const edgeWsRoute = new Elysia()
           break;
         }
 
+        case "webrtc_answer":
+        case "webrtc_error": {
+          const waiting = conn.webrtc.get(message.session_id);
+          if (!waiting) {
+            // The browser's request already timed out, or this gateway
+            // answered a session nobody asked about. Either way there is
+            // nobody left to hand it to.
+            console.warn(
+              `[edge] gateway ${conn.gatewayId} answered camera session ` +
+                `${message.session_id}, which is no longer waiting`,
+            );
+            return;
+          }
+          clearTimeout(waiting.timer);
+          conn.webrtc.delete(message.session_id);
+          waiting.resolve(
+            message.type === "webrtc_answer"
+              ? { sdp: message.sdp }
+              : { error: message.message },
+          );
+          break;
+        }
+
         case "command_result": {
           const pending = conn.pending.get(message.command_id);
           if (!pending) {
@@ -579,6 +692,15 @@ export const edgeWsRoute = new Elysia()
           pending.resolve({ ok: false, error: "gateway disconnected before answering" });
           conn.pending.delete(commandId);
         }
+        // Same for camera negotiations, and it matters more here: a browser
+        // is holding an HTTP request open on each one, so waiting out the
+        // full timeout for a gateway that has already gone is 12 seconds of
+        // a spinner that could say "offline" now.
+        for (const [sessionId, waiting] of conn.webrtc) {
+          clearTimeout(waiting.timer);
+          waiting.resolve({ error: "gateway disconnected before answering" });
+          conn.webrtc.delete(sessionId);
+        }
         if (conn.farmId && gatewayByFarm.get(conn.farmId) === ws.id) {
           gatewayByFarm.delete(conn.farmId);
         }
diff --git a/src/stream.ts b/src/stream.ts
index 1cee64d..43276e3 100644
--- a/src/stream.ts
+++ b/src/stream.ts
@@ -1,29 +1,37 @@
 /**
  * Camera stream resolution, on its own with no imports - the same reason as
  * `dispatch/job_status.ts`: `../db` opens a connection at import time, and
- * the two distinct failure messages here are worth testing without one.
+ * the distinct failure messages here are worth testing without one.
+ *
+ * This used to hand back the gateway's own LAN address for the browser to
+ * play from. It cannot: go2rtc sends no CORS headers and checks its API
+ * password before CORS, so a browser's unauthenticated preflight gets a 401 -
+ * measured against 1.9.14 - and a gateway is behind a workshop NAT anyway.
+ * So there is no URL to give out. What a viewer needs is a camera name to ask
+ * for and a gateway that is connected to relay the SDP exchange.
  */
 
 export const NO_CAMERA_MESSAGE = "this printer reports no camera that can be streamed";
-export const NO_GATEWAY_STREAM_MESSAGE =
-  "this farm's gateway is not connected or advertises no stream base URL";
+export const NO_GATEWAY_MESSAGE =
+  "this farm's gateway is not connected, so its camera cannot be negotiated";
 
 export type StreamResolution =
-  | { ok: true; stream: { streamUrl: string; cameraId: string } }
-  | { ok: false; reason: "no_camera" | "no_stream_base"; message: string };
+  | { ok: true; stream: { cameraId: string } }
+  | { ok: false; reason: "no_camera" | "gateway_offline"; message: string };
 
 /**
- * Both halves or an error naming the missing one. The printer is checked
+ * A camera name, or an error naming what is missing. The printer is checked
  * first: if it can never stream, saying the gateway is offline would send
- * someone off to fix the wrong thing.
+ * someone off to fix the wrong thing - and a P1/A1 can never stream, so this
+ * is the common case rather than the unlucky one.
  */
 export function resolveStream(
   cameraStream: string | null | undefined,
-  streamBaseUrl: string | undefined,
+  gatewayOnline: boolean,
 ): StreamResolution {
   if (!cameraStream) return { ok: false, reason: "no_camera", message: NO_CAMERA_MESSAGE };
-  if (!streamBaseUrl) {
-    return { ok: false, reason: "no_stream_base", message: NO_GATEWAY_STREAM_MESSAGE };
+  if (!gatewayOnline) {
+    return { ok: false, reason: "gateway_offline", message: NO_GATEWAY_MESSAGE };
   }
-  return { ok: true, stream: { streamUrl: streamBaseUrl, cameraId: cameraStream } };
+  return { ok: true, stream: { cameraId: cameraStream } };
 }
diff --git a/tests/stream.test.ts b/tests/stream.test.ts
index ca39564..bf46f73 100644
--- a/tests/stream.test.ts
+++ b/tests/stream.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { Value } from "@sinclair/typebox/value";
 import { EdgeClientMessageSchema } from "@continuum/ts-types";
-import { NO_CAMERA_MESSAGE, NO_GATEWAY_STREAM_MESSAGE, resolveStream } from "../src/stream";
+import { NO_CAMERA_MESSAGE, NO_GATEWAY_MESSAGE, resolveStream } from "../src/stream";
 
 const hello = { type: "hello", gateway_id: "gw-1", farm_id: "f1", token: "t" };
 
@@ -37,26 +37,29 @@ describe("telemetry camera_stream", () => {
 });
 
 describe("resolveStream", () => {
+  // No streamUrl any more, and its absence is the point: a browser cannot
+  // play from a gateway's own address (no CORS, and a workshop NAT besides),
+  // so handing one out only invited a player that could never load. What is
+  // left is the camera name to negotiate for.
   test("returns the endpoint's success shape", () => {
-    expect(resolveStream("p1", "http://gateway.local:1984")).toEqual({
-      ok: true,
-      stream: { streamUrl: "http://gateway.local:1984", cameraId: "p1" },
-    });
+    expect(resolveStream("p1", true)).toEqual({ ok: true, stream: { cameraId: "p1" } });
   });
 
   test("the two failures are distinguishable", () => {
-    const noCamera = resolveStream(null, "http://gateway.local:1984");
-    const noBase = resolveStream("p1", undefined);
-    if (noCamera.ok || noBase.ok) throw new Error("expected both to fail");
+    const noCamera = resolveStream(null, true);
+    const offline = resolveStream("p1", false);
+    if (noCamera.ok || offline.ok) throw new Error("expected both to fail");
     expect(noCamera.reason).toBe("no_camera");
-    expect(noBase.reason).toBe("no_stream_base");
+    expect(offline.reason).toBe("gateway_offline");
     expect(noCamera.message).toBe(NO_CAMERA_MESSAGE);
-    expect(noBase.message).toBe(NO_GATEWAY_STREAM_MESSAGE);
-    expect(noCamera.message).not.toBe(noBase.message);
+    expect(offline.message).toBe(NO_GATEWAY_MESSAGE);
+    // Different problems for whoever is debugging: a P1/A1 that can never
+    // stream, versus a gateway that is merely unplugged.
+    expect(noCamera.message).not.toBe(offline.message);
   });
 
   test("a printer with no camera is blamed first, even if the gateway is also absent", () => {
-    const both = resolveStream(undefined, undefined);
+    const both = resolveStream(undefined, false);
     expect(!both.ok && both.reason).toBe("no_camera");
   });
 });