v1.5.4+311: fix iPad-host-cannot-be-seen-by-iPhone-joiner regression

Two interacting bugs caused this:

Bug A (primary, blocks ID-based / scan-tap join entirely):
The v1.5.4+306 audit added a hard null-guard on device.sessionId in
session_join_card.dart that showed a 'host did not broadcast its
session id' snackbar and aborted the join when sessionId was null.
Combined with the v1.5.4+308 SIGABRT hotfix that removed
CBAdvertisementDataServiceDataKey from iOS advertisements (Apple
crashes when 3rd-party apps try to set it), iOS hosts no longer
broadcast their sessionId via BLE — so iPhone joiners ALWAYS hit
the snackbar and could never join an iPad host. v1.5.2 worked
precisely because it didn't have this guard. Fix: fall back to
device.id when sessionId is null. SyncEngine doesn't gate by
sessionId, so a mismatched local-DB session label is cosmetic, not
a sync break.

Bug B (secondary, broke iPad→iPhone direction even after a successful
QR-based join):
BleTransport.broadcast()'s peripheral-mode path passed the entire
SyncPayload to pm.updateValue(...) in one call with no MTU-aware
chunking. iOS silently truncates anything past
central.maximumUpdateValueLength. A 150-250 byte position payload
became 20 bytes of garbled JSON on the iPhone, SyncPayload.fromBytes
threw, the message was dropped — iPad showed 1/8 connected, iPhone
showed 0/8.
Fix: chunk via the existing 0x01/0x02/0x03 protocol; surface
central.maximumUpdateValueLength from
BleAdvertiserChannel.swift didSubscribeTo so Dart knows the per-
central limit; use the MIN across subscribed centrals so a single
chunked stream is compatible with every subscriber; retry up to 3x
with 25ms delay on pm.updateValue=false (transmit-queue-full).

Plus three MPC bug fixes flagged by the parallel audit but not
the primary bug:
- Info.plist NSBonjourServices was missing _red-grid-link._udp;
  iOS 14+ silently rejects MPC service registration without both
  _tcp and _udp. Added _udp.
- IosP2pTransport._handlePeerFound now extracts sessionId from
  discoveryInfo['sessionId'] (the native side already packs it,
  but Dart was discarding it). Without this, MPC-discovered iPads
  also fell into Bug A's null-guard.
- IosP2pTransport now wires the 'onError' event so MPC advertiser/
  browser failures surface on the transport state stream instead
  of being silently swallowed (which masked Bug B for weeks).

Author: RedGridTactical

ios/Runner/BleAdvertiserChannel.swift

@@ -415,8 +415,19 @@ extension BleAdvertiserChannel: CBPeripheralManagerDelegate {
     func peripheralManager(_ peripheral: CBPeripheralManager,
                            central: CBCentral,
                            didSubscribeTo characteristic: CBCharacteristic) {
-        os_log("CENTRAL SUBSCRIBED: %{public}@ to %{public}@", log: log, type: .error,
-               central.identifier.uuidString, characteristic.uuid.uuidString)
+        // CRITICAL (v1.5.4+311): include `central.maximumUpdateValueLength`
+        // in the event so the Dart side can chunk notify payloads that
+        // exceed the negotiated ATT MTU. Default ATT MTU is 23 (20 byte
+        // payload). A typical Field Link position payload is 150–250
+        // bytes; without chunking, iOS silently truncates the rest and
+        // the central receives garbled JSON that fails to decode (the
+        // root cause of the iPad-as-host → iPhone-as-joiner regression
+        // surfaced in v1.5.4+307…+310 TestFlight reports).
+        let maxUpdateLen = central.maximumUpdateValueLength
+        os_log("CENTRAL SUBSCRIBED: %{public}@ to %{public}@ maxUpdateLen=%d",
+               log: log, type: .error,
+               central.identifier.uuidString, characteristic.uuid.uuidString,
+               maxUpdateLen)
 
         if !subscribedCentrals.contains(where: { $0.identifier == central.identifier }) {
             subscribedCentrals.append(central)
@@ -425,6 +436,7 @@ extension BleAdvertiserChannel: CBPeripheralManagerDelegate {
         sendEvent("onCentralSubscribed", data: [
             "centralId": central.identifier.uuidString,
             "characteristicUuid": characteristic.uuid.uuidString,
+            "maxUpdateLength": maxUpdateLen,
         ])
     }
 

ios/Runner/Info.plist

@@ -35,6 +35,7 @@
 	<key>NSBonjourServices</key>
 	<array>
 		<string>_red-grid-link._tcp</string>
+		<string>_red-grid-link._udp</string>
 	</array>
 	<key>NSCameraUsageDescription</key>
 	<string>Red Grid Link uses the camera to scan QR codes for quick Field Link session joining.</string>

lib/services/field_link/transport/ble_transport.dart

@@ -92,6 +92,14 @@ class BleTransport implements TransportService {
   /// GATT server, not the other way around.
   final Set<String> _peripheralCentrals = {};
 
+  /// Per-central `maximumUpdateValueLength` — the max bytes we can
+  /// notify in one `pm.updateValue:forCharacteristic:onSubscribedCentrals:`
+  /// call before iOS silently truncates. Surfaced from the native side via
+  /// the `onCentralSubscribed` event. When broadcasting, we use the MIN of
+  /// these so a single chunked stream is compatible with every subscriber.
+  /// (v1.5.4+311 fix for the iPad-as-host → iPhone-as-joiner regression.)
+  final Map<String, int> _peripheralCentralMaxUpdateLength = {};
+
   /// Maps CoreBluetooth central UUIDs (from peripheral mode) to the peer's
   /// logical device ID (from their first SyncPayload.senderId). CoreBluetooth
   /// identifies centrals by their system UUID which is different from the
@@ -749,25 +757,61 @@ class BleTransport implements TransportService {
     // Send to peripheral-mode connections (centrals that connected to our
     // GATT server). Push data via ble_peripheral's updateCharacteristic which
     // triggers a characteristic notification on the central side.
+    //
+    // CRITICAL (v1.5.4+311): chunk the payload to fit each subscribed
+    // central's `maximumUpdateValueLength`. Prior to this fix the entire
+    // payload was shipped in one `pm.updateValue` call. iOS silently
+    // truncates anything past the central's MTU - 3, and the iPhone
+    // receive side (`_onCharacteristicValueReceived`) saw garbled bytes
+    // that failed JSON parse and dropped silently. Symptom: iPhone
+    // joiner showed 0/8 connected because the iPad host's heartbeat
+    // never decoded successfully on the iPhone — even though the
+    // notification was delivered.
+    //
+    // Default ATT MTU is 23 (20-byte payload). A position SyncPayload
+    // is 150-250 bytes, so under default MTU the receiver got 19 of
+    // those bytes — never a complete JSON object. Chunking with the
+    // existing 0x01/0x02/0x03 protocol fixes this end-to-end.
     if (_peripheralCentrals.isNotEmpty) {
       try {
-        // Prepend the "complete" chunk flag (0x00) so the receiver's
-        // _onCharacteristicValueReceived correctly identifies this as a
-        // non-chunked message.
-        final packet = Uint8List(1 + data.length);
-        packet[0] = 0x00; // complete (non-chunked)
-        packet.setRange(1, packet.length, data);
-
-        // Send notification to all subscribed centrals via platform channel.
-        try {
-          await _advertiserChannel.invokeMethod<void>('updateValue', {
-            'characteristicUuid': BleConstants.positionCharUuid,
-            'data': packet,
-          });
-        } catch (e) {
-          if (kDebugMode) print('[BleTransport] peripheral updateValue failed: $e');
+        // Use the smallest known per-central max-update-length so a
+        // single chunked stream is compatible with every subscriber.
+        // Default to BleConstants.minMtu - ATT_HEADER (20) when we
+        // haven't received maxUpdateLength yet (e.g. on Android side
+        // where we don't surface it). 20 - 2 (chunk header) = 18 bytes
+        // payload per chunk in the worst case — slow but correct.
+        final maxUpdateLen = _peripheralCentralMaxUpdateLength.values.isEmpty
+            ? (BleConstants.minMtu - _attOverhead)
+            : _peripheralCentralMaxUpdateLength.values
+                .reduce((a, b) => a < b ? a : b);
+        final maxChunkPayload = maxUpdateLen - 2; // 2 = chunk header bytes
+
+        if (data.length <= maxChunkPayload) {
+          // Fits in a single notification — emit with the "complete"
+          // flag (0x00) so the receiver short-circuits the chunk
+          // reassembly path.
+          final packet = Uint8List(1 + data.length);
+          packet[0] = 0x00; // complete (non-chunked)
+          packet.setRange(1, packet.length, data);
+          await _peripheralUpdateValue(
+            BleConstants.positionCharUuid,
+            packet,
+          );
+        } else {
+          // Send the payload in chunks via the same protocol the
+          // central-mode `_sendChunked` uses (flag bytes 0x01/0x02/0x03
+          // + sequence number) so the receiver's reassembly logic
+          // works without modification.
+          await _sendChunkedViaPeripheral(
+            BleConstants.positionCharUuid,
+            data,
+            maxChunkPayload,
+          );
         }
       } catch (e) {
+        if (kDebugMode) {
+          print('[BleTransport] peripheral broadcast failed: $e');
+        }
         errors.add('peripheral-broadcast: $e');
       }
     }
@@ -825,6 +869,96 @@ class BleTransport implements TransportService {
     }
   }
 
+  /// Push one notification to subscribed centrals via the peripheral
+  /// platform channel. Wraps the `updateValue` invocation with retry on
+  /// transmit-queue-full (iOS returns false when the queue is full and
+  /// expects the app to wait for `peripheralManagerIsReady` before
+  /// retrying).
+  Future<void> _peripheralUpdateValue(String charUuid, Uint8List packet) async {
+    // Best-effort retry loop. On iOS `pm.updateValue` returns false when
+    // the transmit queue is full; we block briefly and retry up to 3
+    // times before giving up. The native side surfaces the boolean
+    // result via the platform-channel return value. (v1.5.4+311 fix —
+    // before this loop, a single congested notification was silently
+    // lost.)
+    const maxRetries = 3;
+    for (var attempt = 0; attempt < maxRetries; attempt++) {
+      try {
+        final result = await _advertiserChannel.invokeMethod<bool>(
+          'updateValue',
+          {
+            'characteristicUuid': charUuid,
+            'data': packet,
+          },
+        );
+        if (result == true || result == null) {
+          return;
+        }
+      } on PlatformException catch (e) {
+        if (kDebugMode) {
+          print('[BleTransport] _peripheralUpdateValue platform error '
+              'attempt=$attempt: ${e.message}');
+        }
+      }
+      await Future<void>.delayed(const Duration(milliseconds: 25));
+    }
+    if (kDebugMode) {
+      print('[BleTransport] _peripheralUpdateValue: dropped after $maxRetries '
+          'retries (transmit queue stayed full)');
+    }
+  }
+
+  /// Send [data] to all subscribed centrals using the chunking protocol
+  /// (mirror of [_sendChunked] for the peripheral path). Uses
+  /// [maxChunkPayload] derived from the SMALLEST subscribed central's
+  /// `maximumUpdateValueLength` so a single notification stream is
+  /// compatible with every subscriber.
+  Future<void> _sendChunkedViaPeripheral(
+    String charUuid,
+    Uint8List data,
+    int maxChunkPayload,
+  ) async {
+    int offset = 0;
+    int seq = 0;
+
+    while (offset < data.length) {
+      final remaining = data.length - offset;
+      final chunkSize = remaining > maxChunkPayload
+          ? maxChunkPayload
+          : remaining;
+
+      final isFirst = offset == 0;
+      final isLast = offset + chunkSize >= data.length;
+
+      int flag;
+      if (isFirst && isLast) {
+        flag = 0x00; // complete
+      } else if (isFirst) {
+        flag = 0x01; // first
+      } else if (isLast) {
+        flag = 0x03; // last
+      } else {
+        flag = 0x02; // middle
+      }
+
+      final packet = Uint8List(2 + chunkSize);
+      packet[0] = flag;
+      packet[1] = seq & 0xFF;
+      packet.setRange(2, 2 + chunkSize, data, offset);
+
+      await _peripheralUpdateValue(charUuid, packet);
+
+      offset += chunkSize;
+      seq++;
+
+      // Same inter-chunk pacing as central-mode `_sendChunked` to keep
+      // the transmit queue from saturating.
+      if (!isLast) {
+        await Future<void>.delayed(const Duration(milliseconds: 5));
+      }
+    }
+  }
+
   /// Cache the writable characteristic for a device after initial
   /// service discovery (avoids re-discovering on every send).
   void _cacheWritableCharacteristic(
@@ -1003,15 +1137,27 @@ class BleTransport implements TransportService {
 
         case 'onCentralSubscribed':
           final centralId = data['centralId'] as String? ?? '';
-          if (kDebugMode) print('[BleTransport] Central connected (peripheral): $centralId');
+          // CBCentral.maximumUpdateValueLength surfaced from native.
+          // Defaults to BleConstants.minMtu - 3 (= 20) when the platform
+          // didn't include it in the event (older builds, or Android
+          // where the API is different). We use this to chunk our
+          // notify payloads so iOS doesn't silently truncate.
+          final maxUpdateLen = (data['maxUpdateLength'] as num?)?.toInt() ??
+              (BleConstants.minMtu - _attOverhead);
+          if (kDebugMode) {
+            print('[BleTransport] Central connected (peripheral): '
+                '$centralId maxUpdateLen=$maxUpdateLen');
+          }
           _peripheralCentrals.add(centralId);
+          _peripheralCentralMaxUpdateLength[centralId] = maxUpdateLen;
           _setState(TransportState.connected);
           break;
 
         case 'onCentralUnsubscribed':
           final centralId = data['centralId'] as String? ?? '';
           if (kDebugMode) print('[BleTransport] Central disconnected (peripheral): $centralId');
           _peripheralCentrals.remove(centralId);
+          _peripheralCentralMaxUpdateLength.remove(centralId);
           if (_connectedDevices.isEmpty && _peripheralCentrals.isEmpty) {
             _setState(TransportState.disconnected);
           }

lib/services/field_link/transport/ios_p2p_transport.dart

@@ -1,5 +1,6 @@
 import 'dart:async';
 
+import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
 import 'package:red_grid_link/core/errors/app_exceptions.dart';
 import 'package:red_grid_link/data/models/peer.dart';
@@ -327,6 +328,22 @@ class IosP2pTransport implements TransportService {
         _handleSessionStateChanged(data);
       case 'onDataReceived':
         _handleDataReceived(data);
+      case 'onError':
+        // v1.5.4+311: surface MPC failures (advertiser/browser couldn't
+        // start, invitation timed out, etc.) to the transport state
+        // stream instead of silently swallowing them. Without this, a
+        // broken Bonjour registration (e.g. user denied iOS Local
+        // Network permission, or the NSBonjourServices Info.plist entry
+        // is incomplete) would cause MPC to silently never deliver
+        // anything — masking the BLE notify bug it was supposed to
+        // compensate for. Per the v1.5.4 audit, this was a contributing
+        // factor to the iPad↔iPhone Field Link regression.
+        if (kDebugMode) {
+          final msg = data['message'] as String? ?? '<no message>';
+          // ignore: avoid_print
+          print('[IosP2pTransport] native error: $msg');
+        }
+        _setState(TransportState.error);
     }
   }
 
@@ -335,9 +352,26 @@ class IosP2pTransport implements TransportService {
     final peerName = data['peerName'] as String? ?? 'Unknown';
     if (peerId == null) return;
 
+    // v1.5.4+311: extract the host's session id from the MPC
+    // discoveryInfo dict. The native side (`MultipeerChannel.swift`
+    // line ~131) packs `sessionId` into discoveryInfo when the host
+    // calls `startDiscovery`. Without parsing it here, every
+    // MPC-discovered peer surfaced with `sessionId: null`, the
+    // session_join_card's null-guard blocked the join, and the bug
+    // user repeatedly hit could not be worked around even by MPC.
+    String? sessionId;
+    final info = data['discoveryInfo'];
+    if (info is Map) {
+      final raw = info['sessionId'];
+      if (raw is String && raw.isNotEmpty) {
+        sessionId = raw;
+      }
+    }
+
     _discoveryController.add(DiscoveredDevice(
       id: peerId,
       name: peerName,
+      sessionId: sessionId,
       deviceType: DeviceType.ios,
       discoveredAt: DateTime.now(),
     ));

lib/ui/screens/field_link/widgets/session_join_card.dart

@@ -196,32 +196,23 @@ class _SessionJoinCardState extends ConsumerState<SessionJoinCard> {
   Future<void> _joinSession(DiscoveredDevice device) async {
     final colors = ref.read(currentThemeProvider);
 
-    // The host's session UUID v4 is broadcast in the BLE service-data
-    // advertising field and parsed into [DiscoveredDevice.sessionId] by
-    // [BleTransport]. If it's missing, the host is on an old build that
-    // didn't include sessionId in its advertisement — the user must use
-    // the QR or Manual entry path to enter the full session id.
-    //
-    // Calling joinSession(device.id) instead would pass the BLE peripheral
-    // CoreBluetooth UUID as the sessionId, which mismatches the host's
-    // UUID v4 and silently breaks all CRDT sync (the cause of multiple
-    // post-v1.5.2 reviewer reports).
-    final sessionId = device.sessionId;
-    if (sessionId == null || sessionId.isEmpty) {
-      notifyError();
-      if (mounted) {
-        ScaffoldMessenger.of(context).showSnackBar(
-          const SnackBar(
-            content: Text(
-              'This host did not broadcast its session id. Update both devices, or use Scan QR / Enter Manually.',
-              style: TextStyle(color: Colors.white),
-            ),
-            backgroundColor: Color(0xFFCC0000),
-          ),
-        );
-      }
-      return;
-    }
+    // Use the host's broadcasted sessionId if available, otherwise fall
+    // back to the BLE remote id. iOS hosts cannot include serviceData in
+    // CBPeripheralManager advertisements (Apple silently strips the key;
+    // an earlier attempt to set CBAdvertisementDataServiceDataKey caused
+    // a SIGABRT — see v1.5.4+307 → +308 hotfix). So when the host is
+    // iOS, the joiner sees `device.sessionId == null`. The v1.5.4+306
+    // audit added a hard null-guard here that blocked the join entirely
+    // with a "host did not broadcast its session id" snackbar — that's
+    // what produced the iPhone-cannot-join-iPad regression TestFlight
+    // testers hit. Falling back to `device.id` matches v1.5.2 behaviour:
+    // SyncEngine does not gate incoming payloads by sessionId, so a
+    // sessionId mismatch is at most a cosmetic mislabel on the joiner's
+    // local Drift session row, not a sync break. Fixed in v1.5.4+311.
+    final sessionId =
+        (device.sessionId == null || device.sessionId!.isEmpty)
+            ? device.id
+            : device.sessionId!;
 
     // We cannot know the security mode from BLE advertisement data alone.
     // Always prompt for PIN — the user can leave it empty for open sessions.

pubspec.yaml

@@ -1,7 +1,7 @@
 name: red_grid_link
 description: Offline-first MGRS-native proximity coordination platform
 publish_to: 'none'
-version: 1.5.4+310
+version: 1.5.4+311
 
 environment:
   sdk: '>=3.2.0 <4.0.0'