fix(net): record the placeholder-rewrite decline like every other

[kixelated]

A regression that landed on dev when #3066 squashed onto a base that already carried #3065. Neither side conflicted, so nothing flagged it.

What broke

#3065 made every path out of start_announce that declines an announce record it first, via announced.declined(path). That is the whole of the #3050 fix: a declined announce keeps its path, so a later ANNOUNCE_START for it is reported rather than accepted, and the declined one's ANNOUNCE_END retires nothing instead of a stranger's route.

#3066 added a decline path that #3065 never saw, where rewriting a Lite03 placeholder hop would name this session twice. It was written against a base without the record, so it just returns:

if self.version_lacks_hops() && hops.replace_first(crate::Origin::UNKNOWN, self.session_origin).is_err() {
    tracing::debug!(broadcast = %self.log_path(&path), "dropping announce reflected by its session");
    return Ok(false);
}

On dev today that leaves five ways to decline an announce and four that record it. git merge-tree reports the merge clean, both branches compile, and every existing test passes, because the invariant lives across sibling call sites rather than in anything a merge can see.

The fix

Record it like the other four. The mechanical half is one line.

The rest is every_declined_announce_is_recorded, which walks the path that was missed: a chain the placeholder rewrite cannot take because this session's id is already in it, then a second ANNOUNCE_START for the same path, which must be Error::ProtocolViolation. Removing the declined call fails it with "a declined announce still holds its path, so a second start for it is a violation".

That converts the rule from something a reviewer has to notice into something CI enforces, which is the actual point: the decline list is exactly the kind of thing the next edit falls off the end of, and the failure is silent.

Verification

just check clean; 3277 Rust tests and 590 @moq/net tests pass. cargo check -p moq-ffi -p libmoq clean too, since just check never builds those.

🤖 Generated with Claude Code

(written by Claude Opus 5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acd9417a0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".