Three small things the review found

- a windows access change reopens the pipe; it no longer also warns
  that the socket vanished
- the control server sets its kernel-trust flag before the new access
  is served, not after, so a group member arriving as a reload lands is
  not refused by a peer check that should have stood aside; a bind that
  fails puts the flag back
- print-relays copies the relay map under the read lock, as on master

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

commands.go

@@ -542,10 +542,9 @@ func textPrintCert(v any, w io.Writer) error {
 }
 
 func runPrintRelays(ifce *Interface) any {
-	relays := map[uint32]*HostInfo{}
-	ifce.hostMap.Lock()
-	maps.Copy(relays, ifce.hostMap.Relays)
-	ifce.hostMap.Unlock()
+	ifce.hostMap.RLock()
+	relays := maps.Clone(ifce.hostMap.Relays)
+	ifce.hostMap.RUnlock()
 
 	co := relaysOutput{}
 

localapi/endpoint.go

@@ -93,14 +93,14 @@ func (e *endpoint) rebindLocked(ctx context.Context, path string, acc Access, se
 			old := e.closer
 			e.closer, e.path, e.access, e.id = nil, "", Access{}, socketID{}
 			_ = old.Close()
+		} else {
+			// The node at the path is not the one this endpoint bound: something outside
+			// nebula removed it, logind clearing /run/user/<uid> on logout or a unit
+			// cleaning a RuntimeDirectory= it shares, or replaced it. The listener is still
+			// open and nothing can reach it, so it is bound afresh below; listen's stale
+			// check decides whether whatever is there now may be cleared.
+			e.l.Warn("The "+e.name+"'s socket is no longer at its path, binding it again", "path", path)
 		}
-
-		// The node at the path is not the one this endpoint bound: something outside
-		// nebula removed it, logind clearing /run/user/<uid> on logout or a unit cleaning a
-		// RuntimeDirectory= it shares, or replaced it. The listener is still open and
-		// nothing can reach it, so it is bound afresh below; listen's stale check decides
-		// whether whatever is there now may be cleared.
-		e.l.Warn("The "+e.name+"'s socket is no longer at its path, binding it again", "path", path)
 	}
 
 	ln, err := listen(path, acc)

localapi/server.go

@@ -103,6 +103,11 @@ func (s *Server) Rebind(ctx context.Context, path string, acc Access) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	// Set before the access is applied, not after, so no connection the new access
+	// admits is checked against the old setting. Early is safe either way: a member
+	// arriving before a group's mode is set is refused by the kernel, and with a group
+	// being taken away the peer check applies a moment before the mode tightens.
+	prev := s.trustSocket.Swap(acc.Group != nil)
 	err := s.rebindLocked(ctx, path, acc, func(ln net.Listener) io.Closer {
 		logListening(s.l, path, acc)
 		// Closing the listener, when it is given up, ends the accept loop on the
@@ -111,8 +116,9 @@ func (s *Server) Rebind(ctx context.Context, path string, acc Access) error {
 		go s.accept(ln, s.semaphore())
 		return ln
 	})
-	if err == nil {
-		s.trustSocket.Store(acc.Group != nil)
+	if err != nil {
+		// Whatever was serving still is, with the access it had.
+		s.trustSocket.Store(prev)
 	}
 	return err
 }