18 · Shared-NDI ownership and independent teardown

Starting state

One local scoped NDI endpoint serves several authenticated peers through aggregated or separate Android routing bindings.

Ordered events

1. Android → Aware

   Callbacks identify request-owned Network and scoped address

2. Aware → Runtime

   Install equivalent or distinct routing binding with incarnation

3. Runtime → Peers

   Share responder listener while negotiating each peer UDP endpoint

4. Peers → Runtime

   One peer fails or leaves

5. Runtime → Aware

   Close peer and release exact outgoing owner; retain shared responder references

Fields and messages

Endpoint normalized address/scope versus Network handle/binding versus request owners versus TLS peer/link.

Authorization and invariants

Do not demultiplex by IP alone; expected peer pinning and negotiated UDP port identify packets. Hard current Network loss differs from ordinary request release.

Timers

Native installation acknowledgment; stale callback rejection; per-peer 3/6-s health independent of shared owner lifetime.

Resource lifetime

Equivalent binding owners reference-count installation; distinct bindings retain independently network-bound sockets even with same endpoint.

What the rider sees

Metrics report installedBindings/localEndpoints/listeners/authenticatedLinks, not invented measured NDP counts.

Failure branches

Late onLost for old incarnation cannot remove replacement; one peer timeout never unregisters wildcard responder; actual hard binding loss invalidates every owner of that binding.

Resulting state

One peer/request can retire without closing sibling peers or shared listener; last owner releases its own sockets/binding.

Evidence boundary

Real multi-peer loopback and JVM request/incarnation ownership tests. Physical vendor aggregation and routing unqualified.