Fix the stuck-rescan lifecycle: browse dedup, ghost listeners, op ordering

[darioalessandro]

The field bug

Remote-shutter with the Stormo swap: after a session disconnect the camera returns to its advertising screen and every subsequent connect fails — until the camera backs out to the role picker (full teardown) and re-enters. Repro-first: each fix below has a test that failed before it.

Error-mode mapping (what actually breaks in the field)

The camera's screen revisit cycles its advertiser (stop → new compat advertiser → start), re-registering the same Bonjour instance name with milliseconds of downtime. Over AWDL the monitor usually never observes that flap (goodbyes are lossy; mDNS caching bridges the gap), so no .lost fires and its discovery state goes stale. The monitor's only other refresh path — restarting its browse on the scanning screen — was permanently blind (bug 1). Result: stale invites forever. The role-picker "fix" worked because the camera stayed gone long enough for a real .lost → re-found to refresh the monitor through its live browsers. Loopback can't reproduce the camera-side half (instant, lossless mDNS) — the deterministic repro asserts the monitor-side blindness at the transport layer; the camera-side hazards (2, 3) are fixed and pinned where they are deterministic.

Three root causes

1. Transport-lifetime browse dedup — QUICTransport.seenPeers survived browse restarts, so a new browse session never re-emitted .found for a still-advertising peer. Over AWDL the plain browse is the only source of finds (failure mode 8) — TXT enrichment's per-stream .updated masked this on loopback, which is why nothing caught it. Dedup state is now per browse session, exactly like the enrichment set already was.
   Repro: BrowseRestartTests.browseRestartRefindsAdvertisedPeer (failed 15s-timeout before, passes ~1s after).

2. Ghost listeners on advertising restart — startAdvertising overwrote the listener box without cancelling the previous listener, stranding a live Bonjour registration: a ghost peer that browsers keep finding but that can never accept. Listener + TLS identity + advertised peer now live in one Locked slot and swap as a unit; the displaced triple is cancelled/disposed by whoever displaced it, under any call ordering (including concurrent starts). Failure during the ready-wait unpublishes and retires its own pair.

3. Unordered lifecycle bridging — CompatCore turned MC's synchronous, implicitly-ordered calls (stopBrowsingForPeers(); startBrowsingForPeers() — remote-shutter's exact scanning-screen revisit) into independent unstructured Tasks racing through a reentrant actor: stop/start could invert or overlap, stranding a radio or ending up with none. Lifecycle ops (advertise/browse start+stop, leave, teardown's disconnect) now chain behind the previous op.
   Repro for 2+3 together: MPCCompatE2ETests.advertiserRestartLeavesNoGhostListener (start, start, stop must end with the Bonjour record withdrawn — needs both the atomic swap and ordered ops).

MC-fidelity fix the tests surfaced: lostPeer now delivers the same enriched PeerID that foundPeer delivered, not the transport's name-only AWDL placeholder — real MC hands back the identical MCPeerID both times, and PeerID equality is key-hash-only, so an app matching rows by display name would never have seen the departure.

Flow coverage

• MPCCompatE2ETests.rescanAfterDisconnectOverQUIC — monitor's scanning-screen revisit end to end (connect → disconnect → stop+start browse → re-find → reconnect) over real QUIC+Bonjour. Doc comment records the TXT-masking trap.
• MPCCompatE2ETests.cameraReadvertiseAfterDisconnectOverQUIC — the camera's app-exact advertiser cycle plus round-2 invite accepted with freshly rebuilt sessions on both sides (rebuildSessionIfIdle). Coverage, not a repro: passes on loopback even pre-fix (see mapping above); guards the cycle + fresh-session accept path.

Testing

• swift test: 76 tests / 19 suites green, repeatedly (was 72 — 4 new).
• The previously-existing reinviteAfterDisconnectOverQUIC (retained-endpoint re-invite) still passes — leaveSession() semantics untouched.
• Decisive validation is two-device hardware over AWDL: disconnect → both screens rescan → reconnect, plus camera-cycle-only revisit.

🤖 Generated with Claude Code