* Heal peer-ID rotation: rebind link on verified announce, retire ghost
When a peer relaunches it rotates its ephemeral peer ID, but a
still-open BLE connection kept its stale peripheral/central→peerID
binding for the reachability retention window (~45-60s). Until it aged
out, the other side showed a duplicate ghost peer and dropped the
rotated peer's direct announces as spoofing attempts.
Root cause: the ingress guard rejected a direct announce whose claimed
sender differed from the link binding before signature verification
could ever see it, so the binding could never heal.
- Ingress guard: let a mismatched direct announce through, attributed
to the claimed sender; REQUEST_SYNC keeps the strict binding check.
- Bind sites: raw (pre-verification) announces may only bind unbound
links, never rebind bound ones — rebinding now requires the announce
handler's signature verification to pass.
- On a verified direct announce whose ingress link is bound to a
different peer, rebind the link to the announced ID and retire the
rotated-away ID immediately (registry + gossip + UI), mirroring
handleLeave.
- BLELinkStateStore.bindPeripheral: drop the previous peer's reverse
mapping on rebind so the retired ID no longer claims the link.
Fixes#1387
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Contain forged-directness rebinds: no identity steal, per-link cooldown
The announce signature does not authenticate directness (TTL is
excluded from signing because relays mutate it), so a bound peer could
replay another peer's fresh signed announce with its TTL restored and
reach the rotation rebind path. Contain what such a replay can do:
- Refuse a rebind when the claimed identity already owns another live
link — a replayed announce can no longer steal a connected peer's
binding or route its directed traffic to the replaying link.
- Allow at most one rebind per link per cooldown window (60s) so two
identities cannot fight over a link in a replay flip-flop, with each
flip retiring the other peer.
A replay against an identity with no live link remains possible, but
that capability already exists today on unbound links, where any raw
direct announce binds pre-verification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
