smc: gate arc draws on origin coords + accurate event type doc

Four Copilot findings:

1. replayCurrentPeers fired before _initOrigin completed — replayed
   arcs drew to GlobeCoordinates(0,0) and never got corrected.
   Moved the replay call into _initOrigin's continuation so it
   runs only AFTER origin coords are known.

2. _addPeer fell back to GlobeCoordinates(0,0) when _originCoords
   hadn't loaded yet, so real-time +1 events arriving during the
   origin-lookup window could still draw to (0,0). Added a null
   guard: if origin isn't resolved, skip the draw — the peer is
   still tracked in the notifier's _peerArcs map (source of
   truth), and replayCurrentPeers in _initOrigin's continuation
   picks it up.

   Reordered initState: subscribe FIRST so real-time events
   accumulate in _peerArcs while origin is loading, then call
   _initOrigin which finishes by calling replayCurrentPeers.
   With both changes there's no window where a peer is drawn
   without correct origin coords.

3. debugPrint comment claimed it 'avoids bringing in the
   appLogger' and that 'real impl can switch to slog' — but the
   file already uses appLogger, and slog isn't a Dart logger.
   Rewrote to describe the actual rationale: avoid escalating a
   single malformed wire event to a user-visible error toast in
   debug builds; keep the listener subscribed so subsequent
   well-formed events still arrive.

4. lantern-core's EventTypePeerConnection doc described it as
   samizdat-only with a {state, source} payload. Both donor
   protocols now emit on this event type with the unified
   {state, source, timestamp} payload (peer-share's marshal was
   bumped in the previous round to include timestamp). Updated
   the doc accordingly with source-format details for both
   protocols.

dart analyze clean; Go build clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: myleshorton

lantern-core/core.go

@@ -40,10 +40,15 @@ const (
 	EventTypeServerLocation EventType = "server-location"
 	EventTypeConfig         EventType = "config"
 	EventTypeCountryCode    EventType = "country-code"
-	// EventTypePeerConnection signals a samizdat peer accept/close on the
-	// local Share My Connection inbound. Message is JSON
-	// {"state": +1|-1, "source": "ip:port"}; consumers extract the IP for
-	// geo-lookup or rate-limit attribution.
+	// EventTypePeerConnection signals a peer accept/close on the local
+	// peer-share inbound. Both donor protocols emit this event type:
+	// samizdat-over-UPnP "Share My Connection" and broflake
+	// "Unbounded". Message is JSON
+	// {"state": +1|-1, "source": "...", "timestamp": <unix-millis>}.
+	// Source is "host:port" / "[host]:port" for SmC, bare consumer IP
+	// for Unbounded. Consumers extract the IP for geo-lookup or
+	// rate-limit attribution; timestamp is useful for ordering when
+	// the event-bus dispatch is async.
 	EventTypePeerConnection EventType = "peer-connection"
 	// EventTypePeerStatus signals a peer.Client lifecycle phase change
 	// (mapping_port → registering → verifying → serving on the way up,

lib/features/share_my_connection/share_my_connection.dart

@@ -468,8 +468,12 @@ class ShareNotifier extends Notifier<ShareState> {
           );
         }
       } catch (e) {
-        // Malformed event — log via dev print to avoid bringing in the
-        // appLogger here. Real impl can switch to slog.
+        // Malformed event — log without bringing down the listener.
+        // debugPrint is intentional: appLogger.error would surface as
+        // a user-visible error toast in some debug builds, and a
+        // single bad event from the wire shouldn't escalate that
+        // far. The listener stays subscribed so subsequent
+        // well-formed events still arrive.
         debugPrint('share-my-connection: bad peer-connection event: $e');
       }
     });
@@ -854,16 +858,18 @@ class _GlobeViewState extends ConsumerState<_GlobeView> {
       if (!mounted) return;
       _applyTheme();
     };
-    _initOrigin();
-    // Subscribe BEFORE the replay call so we don't miss any concurrent
-    // +1 events. The broadcast stream delivers synchronously when added,
-    // but the replay events come from inside the same notifier so order
-    // is preserved.
+    // Subscribe FIRST so we don't miss any real-time +1 events while
+    // _initOrigin is in flight. _addPeer guards on _originCoords —
+    // events that arrive before origin lookup completes are still
+    // tracked by the notifier's _peerArcs map (the source of truth);
+    // _initOrigin's continuation calls replayCurrentPeers to draw
+    // them with the now-known origin coords. Without this ordering,
+    // arcs drew to GlobeCoordinates(0,0) and never got corrected.
     _eventSub = ref
         .read(shareProvider.notifier)
         .connectionEvents
         .listen(_handleEvent);
-    ref.read(shareProvider.notifier).replayCurrentPeers();
+    _initOrigin();
   }
 
   @override
@@ -897,6 +903,11 @@ class _GlobeViewState extends ConsumerState<_GlobeView> {
       coordinates: coords,
       style: PointStyle(color: _originPointColor, size: 8),
     ));
+    // Origin coords are now known — draw any peers that connected
+    // before (or during) the origin lookup. _addPeer's null-guard
+    // skipped them earlier; replayCurrentPeers re-fires +1 events
+    // for everything in _peerArcs.
+    ref.read(shareProvider.notifier).replayCurrentPeers();
   }
 
   void _handleEvent(UnboundedConnectionEvent event) {
@@ -928,14 +939,20 @@ class _GlobeViewState extends ConsumerState<_GlobeView> {
 
   void _addPeer(UnboundedConnectionEvent event) {
     if (!mounted) return;
+    // Origin not yet resolved — skip the draw rather than render an
+    // arc to GlobeCoordinates(0, 0). The peer is still tracked in
+    // the notifier's _peerArcs map, and _initOrigin's continuation
+    // calls replayCurrentPeers once origin is known so anything
+    // skipped here gets drawn with the correct destination.
+    if (_originCoords == null) return;
     final coords = _jittered(event.coordinates!, event.workerIdx);
     // Arc direction is censored user → uncensored peer (us). The dash
     // animation flows from start to end, so the visual "travel" reads
     // as traffic arriving at our peer to escape censorship.
     _globeController.addPointConnection(PointConnection(
       id: 'conn_${event.workerIdx}',
       start: coords,
-      end: _originCoords ?? const GlobeCoordinates(0, 0),
+      end: _originCoords!,
       curveScale: .6,
       style: PointConnectionStyle(
         color: _arcColor,