Module lan_instances 

A host-global record of this machine’s LAN-enabled instances, so the one instance that holds the UDP probe port can list the others as siblings in its reply (docs/specs/SPEC_LAN_FLEET_FEED_2026_10_03.md §3, which links the mobile spec that owns the wire contract).

One <channel>.json per instance under registry::resolve_shared_lan_instances_dir(), written only while LAN discovery runs. It carries the instance’s lan_key, which that instance already broadcasts to the LAN over mDNS, and never the full auth_key. A channel with LAN off writes nothing, so it is never listed.

Structs

InstanceRecord 🔒

One instance’s record, as stored on disk.

Constants

MAX_CHANNEL_LEN 🔒

MAX_FILES_SCANNED 🔒

Directory entries looked at per read. Every file here is written by a local process, but a full disk of junk must not stall a probe reply.

MAX_FILE_BYTES 🔒

A real record is about 200 bytes.

MAX_KEY_LEN 🔒

MAX_REPLY_BYTES 🔒

Serialized size a probe reply with siblings is kept under: a single unfragmented datagram on an Ethernet/Wi-Fi MTU of 1500, with headroom.

MAX_SIBLINGS 🔒

Siblings listed in one reply, before the byte budget below applies.

MAX_VERSION_LEN 🔒

REWRITE_INTERVAL 🔒

How often a running instance rewrites its record.

STALE_AFTER_MS 🔒

A record not rewritten for this long (three missed rewrites) is not listed.

Functions

attach_siblings 🔒

Set response["siblings"] to as many of siblings as keep the serialized reply within budget bytes. Always present, empty when there are none, so a client can tell “no siblings” from “a build that does not send them”.

instances_dir 🔒

Where this instance’s record goes: None when the shared root can’t be resolved, and always None under cargo test, whose LanDiscovery::start calls must not overwrite a real instance’s record on the developer’s machine. Tests that exercise the files pass a temp directory.

read_record 🔒

Read one record, refusing an oversized file or out-of-bounds fields.

read_siblings 🔒

The other LAN-enabled instances on this host: records in dir that are fresh (rewritten within STALE_AFTER_MS), whose process is alive, and that are not this instance (neither own_channel nor own_pid). Sorted by channel, one per channel, at most MAX_SIBLINGS.

record_file_name 🔒

The file a channel’s record lives in: a readable stem, reduced to [a-z0-9_-] (plus other Unicode letters and digits) and capped so it can never name a path outside the directory, then 8 hex chars of a SHA-256 of the exact channel name. The slug alone is lossy (Foo and foo, or foo bar and foo_bar, share one), and two LAN-enabled channels sharing a file would overwrite each other’s record (#4297). The real name stays in the file.

remove_own_record 🔒

Remove channel’s record if it is this process’s (pid). Another process on the same channel name owns its own record; this one leaves it alone.

sibling_json 🔒

A sibling as it appears in the UDP reply. auth_key is that sibling’s lan_key, under the field name every client already reads.

write_record 🔒

Write record atomically (temp file, then rename) with mode 0600 on Unix at open time, the same care reactive::registry::write_entry_file takes for the shared registry, which also holds keys. On Windows the file inherits the user-only ACL of the user’s own profile directory.