Resolver transport and Tailscale key state

How the resolver reaches a host and what it says about the host's Tailscale key. Remote commands and the authority's snapshot are on Remote commands.

Resolver transport and Tailscale key state

A resolver's native SSH tunnel races the currently usable declared paths and keeps the first authenticated session. One current Tailscale observation can leave out an expired-key path when another candidate exists; unknown paths are not removed. A primary path that cannot connect does not hold a working path behind the system's connection wait. Pending attempts are dropped after one succeeds; if none succeeds, each failure is named in declaration order.

The native relay and resolver adapter refuse early only when one current Tailscale observation says every declared path has an expired node key. The refusal names each path, destination and key-expiry cause; an adapter returns HTTP 502 with that cause. A failed write of that answer or shutdown of its socket is also recorded, not reported as an answer delivered to its client.

A running resolver reads the real local Tailscale status on its existing declared refresh interval, even when the refusals left no standing traffic. This reader is independent of registry refresh and SSH-session renewal. Its owned status process is cancelled with the resolver, rather than left running. The observation's age starts before the native status command: a reply that already outlasted the interval supplies no current negative proof.

Pending, failed or expired observations mean unknown, not healthy and not permission to deny a restored path from startup data. In that state the real SSH race decides. Once the next current observation sees the renewed key, new connections can use it without restarting the resolver. DNS pinning keeps its separate process snapshot; it does not permanently exclude renewed SSH paths. SSH host-key checks, credentials and transport membership are unchanged.

stado service logs <unit> --host <host> --lines <N> reads the resolver's actual status-read and refusal-delivery failures. Use the managed unit name shown by service status. In Desktop's routes operations, Read the managed resolver unit's service logs on this host runs that command with the selected host, unit and line count. Complete operation receipt shows stdout, stderr and the process result; a truncation marker means the receipt is not complete proof.

The real OpenSSH regression starts a stopped primary beside a live path running the native authority command. It checks the status diagnostic's measured read against the declared refresh interval and that the answered host is not kept as unanswered:

kompilator test --manifest-path stado-rs/Cargo.toml --test host-silence-silent-authority -- a_real_authority_refusal_ends_the_race_beside_a_silent_path

Its retained source inputs, binary digest, command output and real server logs are not a real Tailscale key-expiry/renewal or Desktop qualification.