Module lan_mdns_diag 

Why can’t this host announce itself on mDNS? One line for the log.

mdns-sd skips an interface whose socket cannot be set up and says so only at debug!, so when lan_mdns_health finds the host undiscoverable the log has no reason. On Area54 (2026-10-02, 0.59.4) the watchdog rebuilt the daemon three times and gave up while the cause, Chrome and then the Windows DNS client taking turns holding UDP 5353, had to be found by hand over several cloud round trips. This replays what mdns-sd does on one interface, and names who holds the port, so that the next one is a single WARN line.

It runs only AFTER the daemon has already failed to announce, once per recovery attempt, and each probe socket lives for a few milliseconds. It is a diagnosis, not a health check: a health check on UDP 5353 would compete with the daemon it is checking (Codex P1 on #4133), and this never decides anything. See docs/specs/SPEC_LAN_FIREWALL_SETUP_2026_10_01.md sections 4.7 and 8.1.

Structs

BindFailure

The step of mdns-sd’s per-interface set-up that failed, and the OS’s error.

PortHolder

A process holding a socket on UDP 5353.

Constants

MAX_HOLDERS_NAMED 🔒

At most this many distinct holders are named; the rest are counted.

MDNS_GROUP 🔒

MDNS_PORT 🔒

Functions

diagnose

Probe each uncovered address and look up the holders. Blocking; call it from a blocking context. Never fails: a problem becomes part of the text.

fail 🔒

format_diagnosis

The one log line. Pure, so every shape is unit-tested without a network.

group_holders 🔒

One entry per (process, pid, address) with a count, because a program holds one socket per interface and per family: on a developer machine Chrome alone is dozens of sockets, and a line that repeats it is unreadable. Sorted by pid so the line is stable.

probe_bind

Replay mdns-sd’s new_socket_bind for the IPv4 interface ip: a UDP socket with address reuse, bound to 0.0.0.0:5353, joined to the mDNS group on ip, with ip as the multicast interface, then one empty packet to the group. Ok means every step worked, so a failure to announce was not a bind failure.

udp_5353_holders