accept_fresh_init treats last_accepted_init_ts==None as always-fresh (bin/yipd/src/peer_manager.rs:1686) and never persists it. After a responder restart the baseline is None, so the first Init — including a captured stale one replayed off-path — is accepted and the cold-start arm learns endpoint=src from it (transient session-build + endpoint-hijack window; the replayer can't complete Noise-IK, so it self-heals on the next genuine fresh Init). Fix: an explicit boot-time floor on the baseline (no accepted Init may be older than this responder's boot time). Same family as the reg_seq wall-clock fix.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.
accept_fresh_init treats last_accepted_init_ts==None as always-fresh (bin/yipd/src/peer_manager.rs:1686) and never persists it. After a responder restart the baseline is None, so the first Init — including a captured stale one replayed off-path — is accepted and the cold-start arm learns endpoint=src from it (transient session-build + endpoint-hijack window; the replayer can't complete Noise-IK, so it self-heals on the next genuine fresh Init). Fix: an explicit boot-time floor on the baseline (no accepted Init may be older than this responder's boot time). Same family as the reg_seq wall-clock fix.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.