Three bugs a mock network couldn't see
The first real two-daemon run found an mDNS advert with no A-record: discovery reported success while the peer resolved to a .local name with zero addresses.
The safety net had a hole
The test, the audit log, the scanner, the CI run — covering less than I assumed it did.
The two-node in-memory harness had been green for weeks by the time the first real two-daemon run happened. That run found three bugs in one pass, all on the same day:
The mDNS advert had no A-record. discovery_ok=true on both sides, both advertising, but a browsing peer resolved the other to a .local hostname with zero addresses — so TcpStream::connect had nothing to connect to. Fixed with enable_addr_auto() on the service info, plus trying each resolved IP before falling back to the hostname.
A queued item to an already-known peer just sat there. mdns-sd doesn't re-emit ServiceResolved for an unchanged service, so the one-shot re-drive on first resolve never fired again. Fixed with a 5s periodic re-check for any known peer with pending outbox work.
The IPC channel reused the P2P wire's 64 KiB frame cap for a whole-file Open response. Fine for a chunk, wrong for a payload — anything over ~48 KiB failed with "frame length exceeds maximum." Fixed with a separate 64 MiB IPC cap, keeping the P2P wire's 64 KiB limit untouched.
None of these are state-machine bugs — the state machine was fine. They're all bugs in the boundary the mock replaces: real DNS resolution, real event delivery timing, real frame sizes. A harness that fakes the network will tell you the logic is right and nothing about whether the logic ever gets to run.