fix(relay): a host restarting onto a deleted tunnel gets a new one

[juliusmarminge]

When a desktop quit kills the server after the relay deleted its tunnel but before the server dropped its stored config, the next start registers the deleted tunnel's id. The relay keeps the recorded id after a release, so with an unchanged origin it answered ready without asking Cloudflare, and the host's connector sat at zero connections until someone killed it.

Registration now looks the tunnel up in Cloudflare first. If it is gone, the relay answers recovery_required and the host gets a replacement at the same hostname straight away. This costs one Cloudflare call per server start.

This fixes every client version with one relay deploy. The shorter desktop kill grace that opens the race stays as is: with this change, losing that race heals on the next start, and a longer grace would only make quitting slower when the server hangs.

Tests: a release followed by registration now gets recovery_required, and removing the check fails that test. The two existing registration tests now also expect the lookup.

Built with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

---

[macroscopeapp]

Approvability

Verdict: Approved at 404eb4a

Macroscope's review found this PR approvable — This is a focused relay bug fix that validates the recorded Cloudflare tunnel before reporting a host as ready, with tests covering both normal registration and deleted-tunnel recovery. The only existing-path change is one bounded lookup per registration start.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: e7f0a533-bed6-4068-b6e9-72f1cbff7524

📥 Commits

Reviewing files that changed from the base of the PR and between 517188b and 404eb4a.

📒 Files selected for processing (2)

• infra/relay/src/environments/ManagedEndpointProvider.test.ts
• infra/relay/src/environments/ManagedEndpointProvider.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

Origin reconciliation now fetches the recorded tunnel before continuing. Missing or deleted tunnels return "recovery_required", while other lookup errors become provisioning failures at verify-tunnel.

Changes

Origin reconciliation

Layer / File(s)	Summary
Verify the recorded tunnel infra/relay/src/environments/ManagedEndpointProvider.ts, infra/relay/src/environments/ManagedEndpointProvider.test.ts	The provider checks the recorded tunnel before origin reconciliation. Tests cover unchanged origins, deleted tunnels, and port changes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 404eb

No actionable merge-blocking issue is identified; the tunnel verification change is ready for normal merge checks.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem, the change, and focused test results. It does not include the required Scope and approval information or explain why this focused fix qualifies without prior issu…	Add a Scope and approval section. Link the triaged issue or maintainer approval, or explain why this is a small, focused fix for an obvious bug that qualifies without prior discussion.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the fix: a host restarting with a deleted tunnel receives a new one.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the problem, the change, and focused test results. It does not include the required Scope and approval information or explain why this focused fix qualifies without prior issue or maintainer approval.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−24 B (−0.5%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−24 B (−2.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	−41 B (−0.2%)	29.3 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: 517188b · PR result: 404eb4a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.