fix(core): keep a device's newest advert when an older one arrives later

ts/packages/core/src/domain/mesh-session.ts

@@ -444,11 +444,11 @@ function createSessionCore(
         frame.peers.map(async (advert) => verifyPeerAdvert(identity, advert)),
       );
       for (const advert of frame.peers.filter((_, i) => verdicts[i] === true)) {
-        // Latest advert per device wins, order preserved by first insertion -- a re-advert updates in place.
-        directory.set(deviceIdToHex(advert.device), {
-          device: advert.device,
-          advert,
-        });
+        // Newest advert per device wins, order preserved by first insertion -- a re-advert updates in place. Newest is by the device's own signed `snapshot-seconds`, never by arrival: a hub or gateway forwards adverts it holds from earlier, so an older one can arrive after a newer one, and applying it would roll the device back (and, on every later event, the same device alternates between its two versions).
+        const deviceHex = deviceIdToHex(advert.device);
+        const held = directory.get(deviceHex)?.advert["snapshot-seconds"];
+        if (held !== undefined && advert["snapshot-seconds"] < held) continue;
+        directory.set(deviceHex, { device: advert.device, advert });
         topology.recordAdvert(advert.device);
         onPeerAdvert?.(advert);
       }

ts/packages/core/test/mesh-session-advert-verification.unit.test.ts

@@ -15,6 +15,7 @@ import {
   testIdentity,
 } from "./mesh-session-fixtures.js";
 import {
+  FIXTURE_SNAPSHOT_SECONDS,
   peerAdvertFor,
   withBrokenSignature,
 } from "./relay-hub-test-helpers.js";
@@ -107,6 +108,39 @@ describe("a mesh session verifies gossiped adverts before its directory sees the
     await session.close();
   });
 
+  it("keeps a device's newest advert when an older one arrives after it", async () => {
+    const { connection, session } = await connectedSession();
+    const older = await peerAdvertFor(identityA, FIXTURE_SNAPSHOT_SECONDS);
+    const newer = await peerAdvertFor(identityA, FIXTURE_SNAPSHOT_SECONDS + 1);
+    connection.push({ type: "gossip", peers: [newer] });
+    connection.push({ type: "gossip", peers: [older] });
+
+    const event = await nthEvent(session, EVENTS_THROUGH_CONNECT + 2);
+    expect(
+      directoryOf(event).map((entry) => entry.advert["snapshot-seconds"]),
+      "a replayed older advert must not replace the newer one",
+    ).toEqual([FIXTURE_SNAPSHOT_SECONDS + 1]);
+    await session.close();
+  });
+
+  it("replaces a device's advert with a newer one", async () => {
+    const { connection, session } = await connectedSession();
+    connection.push({
+      type: "gossip",
+      peers: [await peerAdvertFor(identityA, FIXTURE_SNAPSHOT_SECONDS)],
+    });
+    connection.push({
+      type: "gossip",
+      peers: [await peerAdvertFor(identityA, FIXTURE_SNAPSHOT_SECONDS + 1)],
+    });
+
+    const event = await nthEvent(session, EVENTS_THROUGH_CONNECT + 2);
+    expect(
+      directoryOf(event).map((entry) => entry.advert["snapshot-seconds"]),
+    ).toEqual([FIXTURE_SNAPSHOT_SECONDS + 1]);
+    await session.close();
+  });
+
   it("keeps the valid adverts of a frame that also carries an invalid one", async () => {
     const { connection, session } = await connectedSession();
     const valid = await peerAdvertFor(identityA);