carlos / platform Public

Follow-ups from the relay implementation review (spec docs/superpowers/specs/2026-09-07-relay-stun-turn-design.md, merged 4316089), none blocking go-live:

1. Spec §7 lists end-to-end tests the branch does not carry: a real pion client allocating against carlos relay serve with a minted credential, permission refusal into deny CIDRs, and allocations ending on disable within one authority read. Today the only end-to-end proof is the manual probe run against Carloku on 2026-09-07. Bring these into internal/relay as socket tests (they need TMPDIR outside the sandbox).
2. carlos relay status does not show a retiring master's RetireNoEarlierThan, so an operator mid-rotation cannot see from the CLI when the old key may be dropped from /etc/carlos/relay-masters.
3. Spec §5 step 5 still says the authority record carries config_generation; the implementation records issued_digest (sha256 of the sealed envelope) on Record.IssuedDigest. Amend the spec to match.
4. carlos relay enable refuses with "does not hold the relay writer lease" for up to 60s after a console restart while the previous process's lease expires. Expected, but the message should say to retry and when.