fix: Broken voice states and connectivity drops

toju-app/src/app/domains/server-directory/README.md

@@ -90,10 +90,15 @@ stateDiagram-v2
 The facade exposes `testServer(endpointId)` and `testAllServers()`. Both delegate to `ServerEndpointHealthService.probeEndpoint()`, which:
 
 1. Sends `GET /api/health` with a 5-second timeout
-2. On success, checks the response's `serverVersion` against the client version via `ServerEndpointCompatibilityService`
-3. If versions are incompatible, the endpoint is marked `incompatible` and deactivated
-4. If `/api/health` fails, falls back to `GET /api/servers` as a basic liveness check
-5. Updates the endpoint's status, latency, and version info in the state service
+2. Reads the response's `serverVersion` and stable `serverInstanceId`
+3. Checks the reported version against the client version via `ServerEndpointCompatibilityService`
+4. If versions are incompatible, the endpoint is marked `incompatible` and deactivated
+5. If `/api/health` fails, falls back to `GET /api/servers` as a basic liveness check
+6. Updates the endpoint's status, latency, and version info in the state service
+
+`serverInstanceId` lets the client detect when multiple configured URLs point at the same backend. `ServerEndpointStateService.resolveCanonicalEndpoint()` prefers one canonical endpoint per backend instance so REST calls, WebSocket routing, and room fallback logic do not treat same-instance aliases as different signaling clusters.
+
+Room signaling now waits for that initial health sweep before the first saved-room reconnect attempt. That avoids a cold-start race where alias endpoints could open separate WebSocket managers before `serverInstanceId` had been learned.
 
 ```mermaid
 sequenceDiagram
@@ -106,7 +111,7 @@ sequenceDiagram
     Health->>API: GET /api/health (5s timeout)
 
     alt 200 OK
-        API-->>Health: { serverVersion }
+        API-->>Health: { serverVersion, serverInstanceId }
         Health->>Compat: evaluateServerVersion(serverVersion, clientVersion)
         Compat-->>Health: { isCompatible, serverVersion }
         Health-->>Facade: online / incompatible + latency + versions
@@ -132,6 +137,10 @@ The facade's `searchServers(query)` method supports two modes controlled by a `s
 
 The API service normalises every `ServerInfo` response, filling in `sourceId`, `sourceName`, and `sourceUrl` so the UI knows which endpoint each server came from.
 
+That search fan-out is discovery only. Once a room is created or joined, the room keeps an authoritative signal-server affinity via its `sourceId` / `sourceUrl`. The join response can repair stale saved metadata, and reconnect logic now retries that authoritative endpoint first before probing any other configured endpoints.
+
+Fallback stays temporary. If the authoritative endpoint is unavailable, the client can probe other active compatible endpoints as a last resort for the current session, but it does not rewrite the room's saved affinity to that fallback endpoint.
+
 ## Server-owned room metadata
 
 `ServerInfo` also carries the server-owned `channels` list for each room. Register and update calls persist this channel metadata on the server, and search or hydration responses return the normalised channel list so text and voice channel topology survives reloads, reconnects, and fresh joins.
@@ -147,6 +156,8 @@ Default servers are configured in the environment file. The state service builds
 - `restoreDefaultServers()` re-adds any removed defaults and clears the removal tracking
 - The primary default URL is used as a fallback when no endpoint is resolved
 
+Saved rooms can also self-heal their endpoint metadata. If a room has missing or stale source information, the client now searches the configured endpoints for that room, restores the correct source mapping, and persists the repair locally.
+
 URL sanitisation strips trailing slashes and `/api` suffixes. Protocol-less URLs get `http` or `https` based on the current page protocol.
 
 ## Server administration