A call moved between devices has to leave the other person ONE entry in
their log, not two. The peer files by call id, so the whole of that
promise is that the device taking the call re-offers under the ORIGINAL
id rather than minting a fresh one, and that is one argument on one line
of takeHandoff.
Android does this correctly and nothing checked it. The iOS side gained
the same guard, and breaking the line there deliberately showed why it
is worth having: all eleven existing handoff tests still passed, because
they encode a signal with a fixed id and check it survives the round
trip, which tests the encoder rather than the manager's choice. Kotlin's
handoff tests have the same shape.
The mistake is also invisible from the side that makes it. The device
handing the call over sees a correct log, the caller keeps talking, and
only the peer ends up with two rows for one conversation.
Four checks, in the shape PollSharesGoToOneMemberTest already uses here:
a control that the source was read at all, the rule stated positively,
the rule stated again as "no identifier is minted here" so that renaming
a local cannot quietly retire it, and a check that placing an ordinary
call DOES mint one, so the third is a difference between two paths
rather than a fact about a file that never mints anything.
Falsified: replacing offer.callId with UUID.randomUUID() in takeHandoff
fails two of the four. Full app unit suite green, 338 tests.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
