fix(dns): use the port holder enable said it would use

Preflight finds a bridge this run did not start, asks it the clearnet
question, and on a good answer prints that it "is being used as-is".
Then `enable` started a second daemon anyway.

`startDaemon` decides "already running" from our own pidfile, so a
holder it did not record is invisible to it. Both bridges then bind --
the socket is created with reuseAddr -- and the kernel hands the query
to whichever took the more specific address. On the machine that found
this, ours took 127.0.0.1 while the holder had 0.0.0.0, so the bridge
the note promised would serve was the one receiving nothing.

`holderForwards` was computed, returned and printed, and never read
again before the start. This gates the start on it.

The existing test was already named for this -- "a holder that forwards
is used, not refused" -- and only asserted the note was printed, which
is why the second daemon went unnoticed. It now asserts the bridge is
not started, and a new test covers the other half: a holder that fails
the clearnet question is the stale-bridge case, so --force past it must
still start ours.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ralyodio

src/dns.mjs

@@ -2312,10 +2312,24 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     // which on catch-all routing is a window where every lookup on the machine
     // goes to a port with nothing behind it. It also left nothing to verify
     // against: there is no answer to ask for until the bridge exists.
-    const started = await startBridge({ port: wanted, registryBase, entry: cliEntry() });
-    out(started.alreadyRunning
-      ? `  ok   bridge already running (pid ${started.pid})`
-      : `  ok   bridge started on ${DEFAULT_HOST}:${wanted} (pid ${started.pid})`);
+    // Unless a bridge this run did not start already holds the port and
+    // forwards. Preflight has just said out loud that it is being used as-is,
+    // and starting ours anyway makes that line a lie: `startDaemon` decides
+    // "already running" from our pidfile alone, so a stranger on the port is
+    // invisible to it and it spawns a second daemon. Both then bind — the
+    // socket is created with reuseAddr — and the kernel delivers to whichever
+    // took the more specific address, so the holder the note promised would
+    // serve is silently shadowed by the bridge it said would not be started.
+    // Honoring the note is the whole of the fix.
+    const reusing = cleared.holder && cleared.holderForwards ? cleared.holder : null;
+    const started = reusing
+      ? { started: false, pid: reusing.pid, alreadyRunning: true, reused: true }
+      : await startBridge({ port: wanted, registryBase, entry: cliEntry() });
+    out(started.reused
+      ? `  ok   using the bridge already on ${DEFAULT_HOST}:${wanted} (pid ${reusing.pid || "?"}) — not starting a second one`
+      : started.alreadyRunning
+        ? `  ok   bridge already running (pid ${started.pid})`
+        : `  ok   bridge started on ${DEFAULT_HOST}:${wanted} (pid ${started.pid})`);
 
     const outcome = await applyWith(plan, {
       verify: () => verify({ moshpit: moshpitProbe }),

test/dns-enable-rollback.test.mjs

@@ -110,6 +110,7 @@ test("a holder that forwards is used, not refused — or --force becomes the nor
   // would train everyone to pass --force, which is how a safety check stops
   // being one. Behaviour is the test: it answers a clearnet name.
   const lines = [];
+  let startedOurs = false;
   const code = await dnsCommand(["enable"], (l) => lines.push(String(l)), {
     ...noSystem(),
     preflight: (o) => preflightEnable({
@@ -118,10 +119,44 @@ test("a holder that forwards is used, not refused — or --force becomes the nor
       listeners: async () => [{ address: "0.0.0.0", port: 5354, pid: 2471795, process: "bun" }],
       forwards: async () => true,
     }),
+    startBridge: async () => { startedOurs = true; return { started: true, pid: 1, alreadyRunning: false }; },
     applyWith: async () => ({ saved: { ok: true }, applied: { ok: true, results: [] }, verified: { ok: true, checks: [] }, rolledBack: null, backups: [] }),
   });
   assert.equal(code, 0);
-  assert.match(lines.join("\n"), /held by pid 2471795, which this run did not start — it forwards/);
+  const out = lines.join("\n");
+  assert.match(out, /held by pid 2471795, which this run did not start — it forwards/);
+  // "Used as-is" has to mean it. This assertion is the one this test was missing
+  // while it was named for it: the note printed, and then a second daemon was
+  // started anyway. `startDaemon` reads our pidfile to decide "already running",
+  // so it cannot see the holder; both bind, because the socket sets reuseAddr,
+  // and the kernel gives the query to the more specific bind. On the machine
+  // that found this, ours took 127.0.0.1 while the holder had 0.0.0.0 — so the
+  // bridge the note promised would serve was the one getting nothing.
+  assert.equal(startedOurs, false, "the holder is used as-is, so there is nothing to start");
+  assert.match(out, /using the bridge already on 127\.0\.0\.1:5354 \(pid 2471795\)/);
+  assert.doesNotMatch(out, /bridge started on/);
+});
+
+test("a holder that does not forward is still not reused — --force starts ours over it", async () => {
+  // The other half of the gate. A holder that fails the clearnet question is the
+  // stale-bridge case, and forcing past it means deliberately putting a working
+  // bridge in front of it — so the start still has to happen.
+  const lines = [];
+  let startedOurs = false;
+  const code = await dnsCommand(["enable", "--force"], (l) => lines.push(String(l)), {
+    ...noSystem(),
+    preflight: (o) => preflightEnable({
+      ...o,
+      dropins: async () => [],
+      listeners: async () => [{ address: "127.0.0.1", port: 5354, pid: 4242, process: "node" }],
+      forwards: async () => false,
+    }),
+    startBridge: async () => { startedOurs = true; return { started: true, pid: 7, alreadyRunning: false }; },
+    applyWith: async () => ({ saved: { ok: true }, applied: { ok: true, results: [] }, verified: { ok: true, checks: [] }, rolledBack: null, backups: [] }),
+  });
+  assert.equal(code, 0);
+  assert.equal(startedOurs, true);
+  assert.match(lines.join("\n"), /bridge started on 127\.0\.0\.1:5354 \(pid 7\)/);
 });
 
 test("a wildcard bind is caught too — it is the same query, taken by the same stranger", () => {