test(iroh): reproduce #4114 invalid retry token with multi-homed peers

Manual retry-then-validate accept loop (no Router) with both peers bound to
the wildcard address; the client dials all of the server's discovered
addresses. On a multi-homed host the client sprays the Initial from several
source IPs, so a retry token minted for one source can be answered from
another -> INVALID_TOKEN. Runs 10 handshakes and asserts none fail.

Reproduces on this April 2026 state (iroh 0.98.1, noq 0.18).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: rklaehn

iroh/src/protocol.rs

@@ -1043,6 +1043,94 @@ mod tests {
             Ok(())
         }
 
+        /// Reproduces <https://github.com/n0-computer/iroh/issues/4114> with a
+        /// manual retry-then-validate accept loop (no Router / incoming filter).
+        ///
+        /// Both peers bind the wildcard address (every interface, dual-stack);
+        /// the client dials all of the server's discovered addresses. On a
+        /// multi-homed host the client sprays from several source IPs, so a retry
+        /// token minted for one source can be answered from another →
+        /// `INVALID_TOKEN`. Runs many handshakes and reports the failure rate.
+        ///
+        /// On this (April 2026) code we expect failures > 0 on a multi-homed box.
+        #[tokio::test]
+        #[traced_test]
+        async fn addr_retry_multihomed() -> Result {
+            use crate::endpoint::IncomingAddr;
+
+            const ITERS: usize = 10;
+            let mut failures = 0usize;
+            let mut first_err: Option<String> = None;
+            let mut ip_count = 0usize;
+            let mut max_client_sources = 0usize;
+            let mut multi_source_iters = 0usize;
+
+            for i in 0..ITERS {
+                let server = Endpoint::builder(presets::Minimal)
+                    .alpns(vec![ECHO_ALPN.to_vec()])
+                    .bind()
+                    .await?;
+                let client = Endpoint::builder(presets::Minimal).bind().await?;
+
+                let addr = server.addr();
+                ip_count = addr.addrs.iter().filter(|a| a.is_ip()).count();
+
+                let sources = Arc::new(std::sync::Mutex::new(std::collections::HashSet::<
+                    std::net::IpAddr,
+                >::new()));
+                let sources_task = sources.clone();
+                let server_accept = server.clone();
+                let accept = tokio::spawn(async move {
+                    while let Some(incoming) = server_accept.accept().await {
+                        if let IncomingAddr::Ip(sa) = incoming.remote_addr() {
+                            sources_task.lock().unwrap().insert(sa.ip());
+                        }
+                        if incoming.remote_addr_validated() {
+                            if let Ok(accepting) = incoming.accept() {
+                                let _ = accepting.await;
+                            }
+                        } else {
+                            let _ = incoming.retry();
+                        }
+                    }
+                });
+
+                let conn =
+                    tokio::time::timeout(Duration::from_secs(8), client.connect(addr, ECHO_ALPN))
+                        .await;
+                match conn {
+                    Ok(Ok(_)) => {}
+                    Ok(Err(err)) => {
+                        failures += 1;
+                        first_err.get_or_insert_with(|| format!("iter {i}: {err:#}"));
+                    }
+                    Err(_) => {
+                        failures += 1;
+                        first_err.get_or_insert_with(|| format!("iter {i}: connect timed out"));
+                    }
+                }
+
+                accept.abort();
+                client.close().await;
+                server.close().await;
+
+                let n = sources.lock().unwrap().len();
+                max_client_sources = max_client_sources.max(n);
+                if n >= 2 {
+                    multi_source_iters += 1;
+                }
+            }
+
+            // Demo branch: fail unconditionally so the tally prints in CI output
+            // (a passing test swallows it). `multi_source_iters` tells us whether
+            // the runner was actually multi-homed; `failures` is the #4114 signal.
+            panic!(
+                "addr_retry_multihomed: failures={failures}/{ITERS} \
+                 server_ip_count={ip_count} max_client_sources={max_client_sources} \
+                 multi_source_iters={multi_source_iters}/{ITERS} first_err={first_err:?}",
+            );
+        }
+
         /// Verify that returning `Retry` for a relay connection also causes
         /// the remote to retry with a token. The "validation" has no
         /// security meaning over a relay, but it does impose a round-trip