@cero-base/core 1.3.0 → 1.5.0

package/src/network/{bluetooth.js → transports/ble.js}

@@ -3,15 +3,14 @@ import b4a from 'b4a'
 import { hash, randomBytes } from 'hypercore-crypto'
 import safetyCatch from 'safety-catch'
 
-import { GattStream } from './gatt-stream.js'
+import { GattStream } from './gatt.js'
 
-// One data characteristic (write + notify) carries a framed byte stream both
-// ways. iOS never answers an L2CAP channel opened by a Mac central and gives no
-// L2CAP disconnect signal; GATT with app-level framing is the proven transport
-// (the bitchat mesh app uses exactly this on iOS and Android).
+// iOS never answers an L2CAP channel opened by a Mac central and gives no L2CAP
+// disconnect signal, so one data characteristic (write + notify) carries a
+// framed byte stream both ways instead.
 const DATA_UUID = 'ce1a0004-0000-1000-8000-00805f9b34fb'
 
-// Wire frame on the characteristic (both directions): [type:1][sessionId:8][payload].
+// Wire frame both directions: [type:1][sessionId:8][payload].
 const TYPE_OPEN = 1
 const TYPE_DATA = 2
 const TYPE_CLOSE = 3
@@ -19,23 +18,23 @@ const TYPE_HELLO = 4
 const SID_LEN = 8
 const HEADER = 1 + SID_LEN
 
-const DEFAULT_CAP = 4
+const DEFAULT_MAX_OUTBOUND = 4
+const DEFAULT_MAX_INBOUND = 8
 const CONNECT_TIMEOUT = 15000
-// per-peer dial backoff bases (bitchat model): eager while unlinked, patient once
-// we have a link. The actual cooldown grows exponentially per consecutive failure.
+// per-peer dial backoff: eager while unlinked, patient once linked; the cooldown
+// grows exponentially per consecutive failure.
 const DIAL_COOLDOWN_BASE = 8000
 const DIAL_COOLDOWN_BASE_LONELY = 2000
 const DIAL_COOLDOWN_MAX = 30000
-// no two dials globally closer than this — one radio can't usefully dial faster
+// one radio can't usefully dial faster than this
 const DIAL_MIN_INTERVAL = 500
-// Lonely: scan continuously, cycling every SCAN_RESTART_LONELY so a re-advertised
-// peer is re-reported (iOS suppresses duplicate discoveries within a scan session).
+// iOS reports a peripheral once per scan session; restart to re-report a
+// re-advertised peer.
 const SCAN_RESTART_LONELY = 5000
-// Linked: continuous scanning is the dominant BLE battery cost, so duty-cycle it
-// (bitchat model) — scan for SCAN_DUTY_ON, then stay dark for SCAN_DUTY_OFF.
+// linked: continuous scanning is the dominant battery cost, so duty-cycle it.
 const SCAN_DUTY_ON = 5000
 const SCAN_DUTY_OFF = 25000
-// suspend() drain window: how long to let goodbye frames flush before hanging up.
+// suspend() drain window: let goodbye frames flush before hanging up.
 const DRAIN_MS = 300
 
 const EMPTY = b4a.alloc(0)
@@ -57,7 +56,7 @@ function frame(type, sid, payload = EMPTY) {
 }
 
 /**
- * Parse a wire frame. Short/empty buffers → null (the caller logs + drops).
+ * Parse a wire frame. Short/empty buffers → null (caller drops).
  *
  * @param {Uint8Array} buf
  * @returns {{ type: number, sid: Uint8Array, sidHex: string, payload: Uint8Array } | null}
@@ -112,26 +111,24 @@ const findByUUID = (items, uuid) => (items || []).find((i) => uuidEq(i.uuid, uui
  * byte-stream to each discovered peer, and feeds it into `network.inject`. From
  * there replication and pairing are transport-agnostic (see Network.inject).
  *
- * Choreography: the server adds one data characteristic (write + notify) and
- * advertises. The central connects, discovers the characteristic, subscribes,
- * then framed bytes flow both ways — central→server as GATT writes, server→
- * central as notifications — each tagged with an 8-byte session id (bitchat
- * model). `backend` is bare-bluetooth in production and a mock in tests.
- *
- * ponytail: capability-handshake DoS link-scoring is deferred — it needs a
- * replication-progress signal (design §4b). v1 caps links + times out dials.
+ * The server adds one data characteristic (write + notify) and advertises. The
+ * central connects, discovers the characteristic, subscribes, then framed bytes
+ * flow both ways — central→server as GATT writes, server→central as
+ * notifications — each tagged with an 8-byte session id. `backend` is
+ * bare-bluetooth in production and a mock in tests.
  *
  * @extends ReadyResource
  */
-export class BluetoothTransport extends ReadyResource {
+export class BLETransport extends ReadyResource {
   /**
    * @param {object} opts
    * @param {any} opts.backend            bare-bluetooth-shaped module (Central, Server, Service, Characteristic).
-   * @param {import('./index.js').Network} opts.network
+   * @param {import('../index.js').Network} opts.network
    * @param {Uint8Array} opts.uuid        The 32-byte topic the service UUID derives from.
    * @param {Uint8Array} opts.nodeId      Stable local id (identity/device key) for the initiate tie-break.
    * @param {string} [opts.tag]           UUID namespace (channel mesh vs invite mesh).
-   * @param {number} [opts.cap]           Max concurrent links; gossip covers the rest.
+   * @param {number} [opts.maxOutbound]   Max concurrent outbound dials/links; gossip covers the rest.
+   * @param {number} [opts.maxInbound]    Max concurrent inbound sessions; newcomers past this are refused.
    * @param {{ scanMode?: any }} [opts.scanOptions]  Platform scan options (e.g. Android low-power).
    * @param {boolean} [opts.keepLinks]    On close, stop the radio but leave established links alive (invite rendezvous: the link outlives the QR and carries the initial replication).
    * @param {string} [opts.name]          Local app-user display name, sent to peers over a hello frame.
@@ -142,7 +139,8 @@ export class BluetoothTransport extends ReadyResource {
     uuid,
     nodeId,
     tag = 'cero-ble',
-    cap = DEFAULT_CAP,
+    maxOutbound = DEFAULT_MAX_OUTBOUND,
+    maxInbound = DEFAULT_MAX_INBOUND,
     scanOptions,
     keepLinks = false,
     name
@@ -154,7 +152,8 @@ export class BluetoothTransport extends ReadyResource {
     this.nodeId = nodeId
     this.nodeHex = b4a.toString(nodeId, 'hex')
     this.serviceUUID = toServiceUUID(uuid, tag)
-    this.cap = cap
+    this.maxOutbound = maxOutbound
+    this.maxInbound = maxInbound
     this.scanOptions = scanOptions
     this.keepLinks = keepLinks
 
@@ -169,19 +168,8 @@ export class BluetoothTransport extends ReadyResource {
     this._scanning = false
     this._advertising = false
     this._serviceAdded = false
-    /** peripheral id being dialed → its connect-timeout timer */
-    this._dialing = new Map()
-    /** peripheral ids that carry a live channel — never re-dialed (a second
-     * dial's failure would disconnect the peripheral and kill the good link) */
-    this._linked = new Set()
-    /** peripheral id → retry-after timestamp; failed dials back off */
-    this._coolUntil = new Map()
-    /** peripheral id → consecutive failure count; drives exponential backoff */
-    this._failures = new Map()
-    /** peripheral id → remote peer key, learned at handshake — dial guard */
-    this._peerByPeripheral = new Map()
-    /** live central-side peripheral wrappers — for goodbye + physical hang-up on suspend */
-    this._connectedPeripherals = new Set()
+    /** peripheral id → per-peer dial state { timer, linked, coolUntil, failures, peerKey, peripheral } */
+    this._devices = new Map()
     /** last central.connect timestamp — global inter-dial rate limit */
     this._lastDial = 0
     this._scanTimer = null
@@ -206,6 +194,22 @@ export class BluetoothTransport extends ReadyResource {
     return this.peers.size
   }
 
+  _device(id) {
+    let d = this._devices.get(id)
+    if (!d) {
+      d = { timer: null, linked: false, coolUntil: 0, failures: 0, peerKey: null, peripheral: null }
+      this._devices.set(id, d)
+    }
+    return d
+  }
+
+  _prune(id) {
+    const d = this._devices.get(id)
+    if (d && !d.timer && !d.linked && !d.coolUntil && !d.failures && !d.peerKey && !d.peripheral) {
+      this._devices.delete(id)
+    }
+  }
+
   async _open() {
     const { Central, Server, Service, Characteristic } = this.backend
 
@@ -219,13 +223,9 @@ export class BluetoothTransport extends ReadyResource {
       this._maybeAdvertise()
     })
     this.server.on('writeRequest', (reqs) => this._onWriteRequests(reqs))
-    // Notify queue drain signal: the last updateValue was refused (queue full);
-    // retry the head frame now that the peripheral can accept more.
     this.server.on('readyToUpdate', () => this._drainNotify())
-    // WriteRequests carry no central identifier (see peripheral-manager
-    // _onwriterequests), so sessions can't be mapped to the unsubscribing
-    // central; teardown is left to the per-link keepalive/timeout liveness in
-    // _onChannel (15s).
+    // writeRequests carry no central identifier, so an unsubscribe can't be
+    // mapped to a session; teardown is left to _onChannel's keepalive/timeout.
     this.server.on('unsubscribe', () => {})
     this.server.on('error', safetyCatch)
 
@@ -245,7 +245,7 @@ export class BluetoothTransport extends ReadyResource {
   }
 
   _startServer(Service, Characteristic) {
-    if (this.server.state !== 'poweredOn') return // wait for the adapter (stateChange)
+    if (this.server.state !== 'poweredOn') return
     if (!this._serviceAdded) {
       this._dataChar = new Characteristic(DATA_UUID, { write: true, notify: true })
       this.server.addService(new Service(this.serviceUUID, [this._dataChar]))
@@ -263,20 +263,24 @@ export class BluetoothTransport extends ReadyResource {
   _onWriteRequests(requests) {
     const ok = this.server.constructor.ATT_SUCCESS ?? 0
     for (const req of requests) {
-      // respond within ms or the central times out — before any parsing
+      // must respond within ms or the central times out — before any parsing
       if (req.responseNeeded !== false) this.server.respondToRequest(req, ok)
-      if (this._suspended) continue // off means off: acknowledge but drop
+      if (this._suspended) continue
       this._onServerFrame(req.data)
     }
   }
 
   _onServerFrame(data) {
     const f = parseFrame(data)
-    if (!f) {
-      return
-    }
+    if (!f) return
     if (f.type === TYPE_OPEN) {
-      if (this._sessions.has(f.sidHex)) return // duplicate open
+      if (this._sessions.has(f.sidHex)) return
+      if (this._sessions.size >= this.maxInbound) {
+        // established links win: refuse newcomers with a CLOSE so the dialer's
+        // stream ends cleanly and backs off — the mesh converges transitively.
+        this._enqueueNotify(frame(TYPE_CLOSE, f.sid)).catch(safetyCatch)
+        return
+      }
       const sid = b4a.from(f.sid) // copy: f.sid views the transient request buffer
       const stream = new GattStream({
         send: (payload) => this._enqueueNotify(frame(TYPE_DATA, sid, payload)),
@@ -285,7 +289,6 @@ export class BluetoothTransport extends ReadyResource {
       const session = { stream, sid, conn: null, name: null }
       this._sessions.set(f.sidHex, session)
       session.conn = this._onChannel(stream, false, null)
-      // greet the peer with our app-user name so it can label this link
       this._enqueueNotify(frame(TYPE_HELLO, sid, this._helloPayload())).catch(safetyCatch)
     } else if (f.type === TYPE_DATA) {
       const s = this._sessions.get(f.sidHex)
@@ -299,29 +302,21 @@ export class BluetoothTransport extends ReadyResource {
         this._sessions.delete(f.sidHex)
         s.stream.remoteEnd()
       }
-    } else {
     }
   }
 
   _closeServerSession(sidHex, sid) {
-    if (!this._sessions.has(sidHex)) return // already torn down (peer sent close)
+    if (!this._sessions.has(sidHex)) return
     this._sessions.delete(sidHex)
-    this._enqueueNotify(frame(TYPE_CLOSE, sid)).catch(safetyCatch) // best effort
+    this._enqueueNotify(frame(TYPE_CLOSE, sid)).catch(safetyCatch)
   }
 
   // ─── peer display name (hello frame) ──────────────────────────────────────
 
-  /** Our hello payload: the local app-user name the peer labels this link with. */
   _helloPayload() {
     return b4a.from(JSON.stringify({ n: this.name || '' }))
   }
 
-  /**
-   * Parse a hello payload. Malformed → null (the caller ignores it).
-   *
-   * @param {Uint8Array} payload
-   * @returns {string | null}
-   */
   _parseHello(payload) {
     try {
       const { n } = JSON.parse(b4a.toString(payload))
@@ -331,18 +326,17 @@ export class BluetoothTransport extends ReadyResource {
     }
   }
 
-  /** Stash a peer's name onto a server session + its conn, then refresh mirrors. */
   _applyPeerName(session, payload) {
     const name = this._parseHello(payload)
-    if (name === null) return // malformed hello — ignore
+    if (name === null) return
     session.name = name
     if (session.conn) session.conn._peerName = name
     this.emit('update')
   }
 
   // Serialize notifications through the single characteristic: updateValue
-  // returns false when the peripheral's queue is full — hold the frame and retry
-  // on the next 'readyToUpdate', preserving order.
+  // returns false when the peripheral's queue is full — hold the head frame and
+  // retry on the next 'readyToUpdate', preserving order.
   _enqueueNotify(f) {
     return new Promise((resolve, reject) => {
       this._notifyQueue.push({ frame: f, resolve, reject })
@@ -361,7 +355,7 @@ export class BluetoothTransport extends ReadyResource {
         item.reject(err)
         continue
       }
-      if (!ok) return // queue full — wait for 'readyToUpdate', retry same frame
+      if (!ok) return
       this._notifyQueue.shift()
       item.resolve()
     }
@@ -374,11 +368,9 @@ export class BluetoothTransport extends ReadyResource {
     this._armScanRestart()
   }
 
-  // Scan scheduler (bitchat model). Lonely: cycle the scan every
-  // SCAN_RESTART_LONELY so a re-advertised peer is re-reported (iOS suppresses
-  // duplicate discoveries within a scan session). Linked: duty-cycle to save the
-  // battery — scan SCAN_DUTY_ON, then go dark SCAN_DUTY_OFF, repeat. The next
-  // delay is derived from the current phase, so one timer drives the whole cycle.
+  // Lonely: cycle the scan every SCAN_RESTART_LONELY so a re-advertised peer is
+  // re-reported. Linked: duty-cycle SCAN_DUTY_ON on / SCAN_DUTY_OFF dark to save
+  // battery. One timer drives the whole cycle; the next delay derives from phase.
   _armScanRestart() {
     if (this._scanTimer) clearTimeout(this._scanTimer)
     const delay =
@@ -387,19 +379,19 @@ export class BluetoothTransport extends ReadyResource {
       this._scanTimer = null
       if (this.closing || this.closed || this._suspended) return
       // never toggle the scan mid-dial (would kill the connect) — defer a phase
-      if (this._dialing.size > 0) {
+      if (this._isDialing()) {
         this._armScanRestart()
         return
       }
       if (this.linkCount > 0) {
         if (this._scanning) {
-          this._stopScan() // enter the dark half of the duty cycle
+          this._stopScan()
           this._armScanRestart()
         } else {
-          this._startScan() // wake up and re-arm for the next dark window
+          this._startScan()
         }
       } else {
-        this._stopScan() // lonely: cycle so re-advertised peers re-report
+        this._stopScan()
         this._startScan()
       }
     }, delay)
@@ -424,23 +416,21 @@ export class BluetoothTransport extends ReadyResource {
   }
 
   _onDiscover(peripheral) {
-    if (this.closing || this.closed) return
-    if (this._suspended) return
-    if (this._linked.has(peripheral.id)) return // already linked
-    const knownPeer = this._peerByPeripheral.get(peripheral.id)
-    if (knownPeer && this.peers.has(knownPeer)) return // device already linked via another channel
-    const cool = this._coolUntil.get(peripheral.id)
-    if (cool && cool > Date.now()) return // failed recently — back off
-    if (this._dialing.has(peripheral.id)) return // already connecting to this one
-    if (this.linkCount >= this.cap) return // gossip covers the rest
-    // global rate limit: one radio can't usefully dial faster than this, and
-    // back-to-back connects thrash CoreBluetooth (bitchat connect hygiene)
+    if (this.closing || this.closed || this._suspended) return
+    const d = this._devices.get(peripheral.id)
+    if (d) {
+      if (d.linked) return
+      if (d.peerKey && this.peers.has(d.peerKey)) return // linked via another channel
+      if (d.coolUntil > Date.now()) return // failed recently — back off
+      if (d.timer) return // already connecting to this one
+    }
+    if (this.linkCount >= this.maxOutbound) return // gossip covers the rest
     if (Date.now() - this._lastDial < DIAL_MIN_INTERVAL) return
-    // no tie-break: dial every discovery and open a session (bitchat model);
-    // a redundant link to the same peer is dropped by _track's dedup
+    // dial every discovery and open a session; a redundant link is dropped by
+    // _track's dedup
     this._lastDial = Date.now()
     const timer = setTimeout(() => this._abortDial(peripheral, 'timeout'), CONNECT_TIMEOUT)
-    this._dialing.set(peripheral.id, timer)
+    this._device(peripheral.id).timer = timer
     try {
       this._stopScan()
       this.central.connect(peripheral)
@@ -450,7 +440,7 @@ export class BluetoothTransport extends ReadyResource {
   }
 
   _onConnect(peripheral) {
-    this._connectedPeripherals.add(peripheral)
+    this._device(peripheral.id).peripheral = peripheral
     peripheral.on('error', () => this._abortDial(peripheral, 'peripheral-error'))
     peripheral.once('servicesDiscover', (services) => {
       const svc = findByUUID(services, this.serviceUUID)
@@ -469,10 +459,9 @@ export class BluetoothTransport extends ReadyResource {
       }
       this._startCentralSession(peripheral, char)
     })
-    // No tie-break: both sides open a session (bitchat model). On iOS the peer
-    // id isn't known until after connect, so a tie-break can only yield
-    // post-handshake — which deadlocks when the other side never dials back.
-    // Redundant links are tolerated; _track keeps the first and drops the dup.
+    // both sides open a session: on iOS the peer id isn't known until after
+    // connect, so a tie-break yields only post-handshake and deadlocks if the
+    // other side never dials back. _track keeps the first, drops the dup.
     peripheral.discoverServices([this.serviceUUID])
   }
 
@@ -488,7 +477,8 @@ export class BluetoothTransport extends ReadyResource {
       send: (payload) => this._centralSend(peripheral, char, frame(TYPE_DATA, sid, payload)),
       onclose: () => {
         this._centralSend(peripheral, char, frame(TYPE_CLOSE, sid)).catch(safetyCatch)
-        this._connectedPeripherals.delete(peripheral)
+        const d = this._devices.get(peripheral.id)
+        if (d) d.peripheral = null
         try {
           this.central.disconnect(peripheral)
         } catch (err) {
@@ -499,7 +489,6 @@ export class BluetoothTransport extends ReadyResource {
     peripheral._stream = stream
     // open frame first: it registers the session on the server before any data
     this._centralSend(peripheral, char, frame(TYPE_OPEN, sid)).catch(safetyCatch)
-    // greet the peer with our app-user name so it can label this link
     this._centralSend(peripheral, char, frame(TYPE_HELLO, sid, this._helloPayload())).catch(
       safetyCatch
     )
@@ -511,14 +500,12 @@ export class BluetoothTransport extends ReadyResource {
     const sess = peripheral._session
     if (!sess || !peripheral._stream) return
     const f = parseFrame(data)
-    if (!f) {
-      return
-    }
-    if (f.sidHex !== sess.sidHex) return // not our session (broadcast to others)
+    if (!f) return
+    if (f.sidHex !== sess.sidHex) return // not our session
     if (f.type === TYPE_DATA) peripheral._stream.receive(b4a.from(f.payload))
     else if (f.type === TYPE_HELLO) {
       const name = this._parseHello(f.payload)
-      if (name === null) return // malformed hello — ignore
+      if (name === null) return
       peripheral._peerName = name
       if (peripheral._conn) peripheral._conn._peerName = name
       this.emit('update')
@@ -564,17 +551,15 @@ export class BluetoothTransport extends ReadyResource {
 
   _abortDial(peripheral, _reason) {
     const id = peripheral?.id
-    // eager when unlinked, patient once linked; per-peer exponential backoff so a
-    // peer that keeps failing is retried ever less often (bitchat connect hygiene)
     if (id != null) {
-      const count = (this._failures.get(id) || 0) + 1
-      this._failures.set(id, count)
+      const d = this._device(id)
+      d.failures += 1
       const base = this.linkCount === 0 ? DIAL_COOLDOWN_BASE_LONELY : DIAL_COOLDOWN_BASE
-      const cooldown = Math.min(DIAL_COOLDOWN_MAX, base * 2 ** Math.min(4, count - 1))
-      this._coolUntil.set(id, Date.now() + cooldown)
+      d.coolUntil =
+        Date.now() + Math.min(DIAL_COOLDOWN_MAX, base * 2 ** Math.min(4, d.failures - 1))
+      d.peripheral = null
     }
     this._clearDial(id)
-    this._connectedPeripherals.delete(peripheral)
     try {
       this.central.disconnect(peripheral)
     } catch (err) {
@@ -585,9 +570,16 @@ export class BluetoothTransport extends ReadyResource {
 
   _clearDial(id) {
     if (id == null) return
-    const timer = this._dialing.get(id)
-    if (timer) clearTimeout(timer)
-    this._dialing.delete(id) // free the slot — rediscovery can re-dial
+    const d = this._devices.get(id)
+    if (!d) return
+    if (d.timer) clearTimeout(d.timer)
+    d.timer = null
+    this._prune(id)
+  }
+
+  _isDialing() {
+    for (const d of this._devices.values()) if (d.timer) return true
+    return false
   }
 
   // iOS & Android report errored connects as 'error' with a code, not
@@ -596,51 +588,54 @@ export class BluetoothTransport extends ReadyResource {
     safetyCatch(err)
     const code = err && err.code
     if (code === 'CONNECTION_FAILED' || code === 'DISCONNECT') {
-      for (const id of [...this._dialing.keys()]) this._clearDial(id)
+      for (const [id, d] of this._devices) if (d.timer) this._clearDial(id)
     }
   }
 
-  _onChannel(l2cap, isInitiator, peripheralId) {
+  _onChannel(stream, isInitiator, peripheralId) {
     if (this.closing || this.closed || this._suspended) {
-      l2cap.destroy()
+      stream.destroy()
       return
     }
-    const conn = this.network.inject(l2cap, { isInitiator })
-    // Liveness: iOS never signals an L2CAP disconnect, so ping the peer and
-    // drop the link if we stop hearing back (keepalive refreshes the timeout).
+    const conn = this.network.inject(stream, { isInitiator })
+    // iOS never signals a disconnect for a vanished peer: keepalive pings and the
+    // timeout are the liveness detector (keepalive refreshes the timeout).
     conn.setKeepAlive(5000)
     conn.setTimeout(15000)
-    l2cap.on('error', safetyCatch)
+    stream.on('error', safetyCatch)
     // marked at channel-open (not handshake-open): rediscovery must not dial a
     // peripheral whose channel is still handshaking
     if (peripheralId != null) {
-      this._linked.add(peripheralId)
-      this._coolUntil.delete(peripheralId)
-      this._failures.delete(peripheralId) // reached a live session — reset backoff
-      conn.once('close', () => this._linked.delete(peripheralId))
+      const d = this._device(peripheralId)
+      d.linked = true
+      d.coolUntil = 0
+      d.failures = 0 // reached a live session — reset backoff
+      conn.once('close', () => {
+        const rec = this._devices.get(peripheralId)
+        if (rec) {
+          rec.linked = false
+          this._prune(peripheralId)
+        }
+      })
     }
     conn.on('open', () => this._track(conn, peripheralId, isInitiator))
-    conn.on('close', () => this._untrack(conn, peripheralId))
+    conn.on('close', () => this._untrack(conn))
     this._startScan()
     return conn
   }
 
   _track(conn, peripheralId, isInitiator) {
     if (peripheralId != null && conn.remotePublicKey) {
-      this._peerByPeripheral.set(peripheralId, b4a.toString(conn.remotePublicKey, 'hex'))
+      this._device(peripheralId).peerKey = b4a.toString(conn.remotePublicKey, 'hex')
     }
     if (this.closing || this.closed) return
     const key = b4a.toString(conn.remotePublicKey, 'hex')
     const existing = this.peers.get(key)
     if (existing && existing !== conn) {
-      // Both sides dial (bitchat model) so a pair links twice — two separate
-      // channels, each with an initiator end on one device and a responder end
-      // on the other. Dropping a channel closes it for BOTH devices, so the two
-      // devices MUST retire the same channel or one tears down the peer's kept
-      // link. Deterministic winner: keep the channel whose initiator has the
-      // smaller static key. Both peers compute it identically (initiator end:
-      // our key smaller; responder end: remote key smaller), so the loser
-      // channel is dropped on both ends and never cascades onto the survivor.
+      // Both sides dial, so a pair links twice. Dropping a channel closes it for
+      // BOTH devices, so both must retire the SAME channel. Deterministic winner:
+      // keep the channel whose initiator has the smaller static key — computed
+      // identically on both ends, so the loser drops on both and never cascades.
       const initiatorIsUsSmaller = b4a.compare(conn.publicKey, conn.remotePublicKey) < 0
       const preferred = isInitiator === initiatorIsUsSmaller
       if (!preferred) {
@@ -665,21 +660,17 @@ export class BluetoothTransport extends ReadyResource {
     }
   }
 
-  /**
-   * Best-effort TYPE_CLOSE to every live session — server sessions over the
-   * notify path, central sessions over the write path — reusing the same helpers
-   * a normal stream close uses. Waits up to DRAIN_MS for the frames to flush,
-   * then resolves regardless: suspend must never hang on a wedged radio.
-   *
-   * @returns {Promise<void>}
-   */
+  // Best-effort TYPE_CLOSE to every live session — server sessions over notify,
+  // central sessions over write — then wait up to DRAIN_MS for the frames to
+  // flush. Resolves regardless: suspend must never hang on a wedged radio.
   async _sayGoodbye() {
     const sent = []
     for (const { sid } of this._sessions.values()) {
       sent.push(this._enqueueNotify(frame(TYPE_CLOSE, sid)).catch(safetyCatch))
     }
-    for (const peripheral of this._connectedPeripherals) {
-      const sess = peripheral._session
+    for (const d of this._devices.values()) {
+      const peripheral = d.peripheral
+      const sess = peripheral && peripheral._session
       if (!sess || !peripheral._char) continue
       const f = frame(TYPE_CLOSE, sess.sid)
       sent.push(this._centralSend(peripheral, peripheral._char, f).catch(safetyCatch))
@@ -691,29 +682,27 @@ export class BluetoothTransport extends ReadyResource {
   /**
    * Pause radio activity but KEEP the Server/Central instances and the
    * registered GATT service alive — the toggle-friendly counterpart to _close.
-   * iOS CoreBluetooth managers can't be destroy()ed (native double-free), so a
-   * fresh transport per toggle leaks a manager whose stale peripheral-manager
-   * keeps a duplicate GATT service registered; remote centrals then subscribe to
-   * the dead service and hear silence. Reuse one instance instead. Idempotent.
+   * CoreBluetooth managers can't be destroy()ed (native double-free), so one
+   * transport is reused across toggles rather than recreated. Idempotent.
    */
   async suspend() {
     this._suspended = true
     if (this._scanTimer) clearTimeout(this._scanTimer)
     this._scanTimer = null
-    for (const timer of this._dialing.values()) clearTimeout(timer)
-    this._dialing.clear()
-    // Say goodbye BEFORE teardown so the remote reacts in <1s instead of waiting
-    // out the 15s keepalive: close frames, a short drain, then drop the physical
-    // links (an ACL disconnect is an instant OS-level signal on both roles).
+    for (const d of this._devices.values()) if (d.timer) clearTimeout(d.timer)
+    // say goodbye BEFORE teardown so the remote reacts in <1s instead of waiting
+    // out the 15s keepalive: close frames, a short drain, then an ACL disconnect
+    // (an instant OS-level signal on both roles).
     await this._sayGoodbye()
-    for (const peripheral of this._connectedPeripherals) {
+    for (const d of this._devices.values()) {
+      if (!d.peripheral) continue
       try {
-        this.central.disconnect(peripheral)
+        this.central.disconnect(d.peripheral)
       } catch (err) {
         safetyCatch(err)
       }
     }
-    this._connectedPeripherals.clear()
+    this._devices.clear()
     try {
       this._stopScan()
     } catch (err) {
@@ -743,9 +732,6 @@ export class BluetoothTransport extends ReadyResource {
     this._sessions.clear()
     for (const item of this._notifyQueue) item.reject(new Error('suspended'))
     this._notifyQueue = []
-    this._linked.clear()
-    this._coolUntil.clear()
-    this._failures.clear()
     this.state = 'off'
     this.emit('update')
   }
@@ -769,10 +755,10 @@ export class BluetoothTransport extends ReadyResource {
   async _close() {
     if (this._scanTimer) clearTimeout(this._scanTimer)
     this._scanTimer = null
-    // doctor-app rule: never call central/server.destroy() — it double-frees in
-    // the native teardown; stop advertising/scanning and let the runtime reclaim.
-    for (const timer of this._dialing.values()) clearTimeout(timer)
-    this._dialing.clear()
+    // never call central/server.destroy() — it double-frees in native teardown;
+    // stop advertising/scanning and let the runtime reclaim.
+    for (const d of this._devices.values()) if (d.timer) clearTimeout(d.timer)
+    this._devices.clear()
     try {
       this.central?.stopScan()
     } catch (err) {
@@ -784,7 +770,6 @@ export class BluetoothTransport extends ReadyResource {
       safetyCatch(err)
     }
     if (!this.keepLinks) {
-      // channel mesh: toggling nearby off means stop syncing nearby
       for (const conn of this.peers.values()) {
         try {
           conn.destroy()