[puddly]

When a device rejoins, pending route requests to it will not be answered and all pending requests to it should be invalidated.

Should address #88 alongside #89.

[Copilot]

🟡 Changes recommended

Active issues leave stale route-discovery entries after discovery removal and allow queued Leave requests to survive a rejoin, potentially forcing a freshly rejoined device to leave again.

2 open issues

• Drop stale indirect transactions before responding to a rejoin · New
• Remove stale DiscoveryUnderway entries when their last discovery is forgotten · New

What changed in this PR

This PR clears stale per-device state on joins, rejoins, and departures, complementing #89’s routing changes to address the pairing delays in #88.

Changes:

• Remove routes, route records, and related discovery entries for a device.
• Clear APS duplicate tracking and fail pending unrouted sends when its session resets.
• Preserve session state when learning address mappings from ordinary traffic.

File	Description
crates/​ziggurat-zigbee/​src/​nwk/​routing.rs	Adds per-device routing-state cleanup.
crates/​ziggurat-driver/​src/​zigbee_stack/​nwk.rs	Adds session cleanup while preserving state during ordinary address learning.
crates/​ziggurat-driver/​src/​zigbee_stack/​joining.rs	Invokes cleanup when devices leave.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Rejoin cleanup leaves stale sends and old-address state active and accepts outdated leave reports, allowing prior-session traffic or events to disrupt the new session.

4 open issues

• Reject stale DeviceLeft reports from a previous parent session · New
• Invalidate pending sends for both old and new addresses on rejoin · New
• Cancel queued unicasts and suppress stale in-flight retries · New
• Cancel prior broadcast requests before replacing the discovery ID · New

2 resolved since last review

• Remove stale DiscoveryUnderway entries when their last discovery is forgotten
• Drop stale indirect transactions before responding to a rejoin

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Incomplete leave/rejoin cleanup leaves stale routing state and pending unicasts active, allowing old-session retries—including leave requests—to disrupt rejoined devices.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Preserve old-address route state until rejoin invalidation

crates/​ziggurat-driver/​src/​zigbee_stack/​nwk.rs:185

For a secured rejoin under a different short address, this overwrites the old mapping before handle_rejoin_request calls update_nwk_eui64_mapping. That helper then sees the new address as previous_nwk, leaving the old address's cached routes, pending discoveries, and route-request broadcasts intact. Skip this cache update for RejoinRequest frames so the rejoin handler can invalidate the previous address before replacing its mapping.

Reset route discoveries originated by the rejoining device

crates/​ziggurat-zigbee/​src/​nwk/​routing.rs:297

This retains discoveries originated by the rejoining device, even though its route-request identifier can restart with the new session. A new request reusing an old identifier is then compared against the previous session's forward_cost in accept_route_request and is rejected if its new path costs more; relayed replies can also be rejected against the stale residual_cost. Reset discovery state originating at the rejoining nwk, not only our discoveries targeting it, while keeping any necessary late-copy suppression separate.

Prevent failed in-flight indirect sends from requeueing after rejoin

crates/​ziggurat-zigbee/​src/​sends/​unicasts.rs:364

An indirect frame already transmitting when the device rejoins is skipped here, but it can still be retried afterward: on a failed radio report, transmitted returns it to AwaitingPoll while its persistence deadline remains live. If that frame is the stale-child leave request, the rejoined device receives it on its next poll and is told to leave again. Although the current copy cannot be recalled, mark the in-flight record as cancelled so its report settles it rather than requeueing it.

4 resolved since last review

• Cancel prior broadcast requests before replacing the discovery ID
• Cancel queued unicasts and suppress stale in-flight retries
• Invalidate pending sends for both old and new addresses on rejoin
• Reject stale DeviceLeft reports from a previous parent session

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Rejoin handling leaves pending sends and route-request broadcasts active for the previous address and can drop valid replies for retained relayed discoveries, causing router timeouts.

2 open issues

• Invalidate pending sends for the previous address after rejoin · New
• Preserve relayed discovery state when clearing a rejoined device route · New

_{Review effort: Balanced}