Two small things the review found

- the control server sets its kernel-trust flag before the new access
  is served, not after, so a group member arriving as a reload lands is
  not refused by a peer check that should have stood aside; a bind that
  fails puts the flag back
- print-relays copies the relay map under the read lock, as on master

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

commands.go

@@ -542,10 +542,9 @@ func textPrintCert(v any, w io.Writer) error {
 }
 
 func runPrintRelays(ifce *Interface) any {
-	relays := map[uint32]*HostInfo{}
-	ifce.hostMap.Lock()
-	maps.Copy(relays, ifce.hostMap.Relays)
-	ifce.hostMap.Unlock()
+	ifce.hostMap.RLock()
+	relays := maps.Clone(ifce.hostMap.Relays)
+	ifce.hostMap.RUnlock()
 
 	co := relaysOutput{}
 

localapi/server.go

@@ -103,6 +103,11 @@ func (s *Server) Rebind(ctx context.Context, path string, acc Access) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	// Set before the access is applied, not after, so no connection the new access
+	// admits is checked against the old setting. Early is safe either way: a member
+	// arriving before a group's mode is set is refused by the kernel, and with a group
+	// being taken away the peer check applies a moment before the mode tightens.
+	prev := s.trustSocket.Swap(acc.Group != nil)
 	err := s.rebindLocked(ctx, path, acc, func(ln net.Listener) io.Closer {
 		logListening(s.l, path, acc)
 		// Closing the listener, when it is given up, ends the accept loop on the
@@ -111,8 +116,9 @@ func (s *Server) Rebind(ctx context.Context, path string, acc Access) error {
 		go s.accept(ln, s.semaphore())
 		return ln
 	})
-	if err == nil {
-		s.trustSocket.Store(acc.Group != nil)
+	if err != nil {
+		// Whatever was serving still is, with the access it had.
+		s.trustSocket.Store(prev)
 	}
 	return err
 }