zebra-spaces: idempotent welcome on signal reconnect — quiet 'already publishing'

The signal-WS reconnects periodically (network blips, tab background-
ing). Each reconnect produces a fresh welcome → onRoleEntered() fired
the full setup again, which called sfuPublish() → it bailed out via the
'already publishing' early-return + logged it as an alarm. Looked
exactly like 'something kicked out my speaker' in the log even though
the existing mic publish was still healthy.

Two fixes:
- welcome handler detects re-entry by checking myUUID === m.your_uuid.
  When true, just refresh role + state + flushSfuStreams + renderRoom
  and break — don't re-run sessionStorage saves, spotlight broadcasts,
  onRoleEntered, etc.
- sfuPublish silently returns when sfuPubPC is non-null (still
  idempotent, just not log-noisy).

ICE-failure recovery on sub PC stays unchanged — that's a real
'failed' state, not a duplicate welcome.

web/zebra-spaces.html

@@ -1868,7 +1868,7 @@ function renderCameraTile(pubHex, stream, opts){ return renderVideoTile('camera'
 function removeCameraTile(pubHex){ return removeVideoTile('camera', pubHex); }
 
 async function sfuPublish(){
-  if (sfuPubPC){ logLine('','sfu publish: already publishing'); return; }
+  if (sfuPubPC) return;     /* idempotent — re-entry from signal reconnect is fine */
   if (!micStream || !myKeys || !roomID){
     logLine('err','sfu publish skipped: mic='+(!!micStream)+' keys='+(!!myKeys)+' room='+(!!roomID));
     return;
@@ -2618,9 +2618,23 @@ async function handleSignal(raw){
   let m; try { m = JSON.parse(raw); } catch(_){ return; }
   switch (m.type){
     case 'welcome':
-      myUUID = m.your_uuid; myRole = m.role; roomEpoch = m.epoch;
-      applyState(m.state);
-      roomMachines.call.send('WELCOME', { uuid: myUUID, role: myRole });
+      {
+        /* a second welcome arrives whenever the signal-WS reconnects.
+         * If our uuid hasn't changed, the SFU + mesh are still alive —
+         * just refresh state + role, don't re-run the whole setup
+         * (that's what caused 'sfu publish: already publishing' +
+         * other duplicate-effect noise during reconnect cycles). */
+        const reentry = !!myUUID && myUUID === m.your_uuid;
+        myUUID = m.your_uuid; myRole = m.role; roomEpoch = m.epoch;
+        applyState(m.state);
+        roomMachines.call.send('WELCOME', { uuid: myUUID, role: myRole });
+        if (reentry){
+          logLine('', 'signal re-welcomed — role still '+myRole);
+          flushSfuStreams();
+          renderRoom();
+          break;
+        }
+      }
       /* any tile auto-spotlit before welcome (during fast-path subscribe)
        * needs to be broadcast now so the room sees our viewing state */
       spotlights.set(myUUID, spotlightKey());
@@ -3491,8 +3505,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');
 
 <footer style="margin:2.2rem auto 0;font-size:0.65rem;color:#999;line-height:1.7;word-break:break-all;font-family:monospace">
   <span id="pi-seal" style="color:#777;cursor:default;user-select:none" title="">page integrity</span> &nbsp;·&nbsp; built <span class="stamp-date">2026-06-02</span><br>
-  md5 <span class="stamp-md5">e02a2a8882f51ba59c410ca9ae472655</span><br>
-  sha256 <span class="stamp-sha">08b05ffb874a5068e05edd061ce00d41b1bc1711dd35a575074628785f812fef</span><br>
+  md5 <span class="stamp-md5">d172a155506552a507a4a388667ed5eb</span><br>
+  sha256 <span class="stamp-sha">79e1fef971301f0514b4a0acda58e8526d8dfb0958d5aa1ce05bb07b1e7e787d</span><br>
   <span style="color:#bbb">hashes are of this page with these two fields zeroed — to verify, blank them and re-hash</span><br>
   <span style="color:#bbb">one self-contained file — <strong>save a copy</strong> and verify against these hashes; point at your own servers with ?signal= and ?turncred=, or <a href="host-your-own.html" style="color:#999">host your own community</a></span>
 </footer>