Add tests

Merge branch 'main' into refactor/relay-foreign-cache
# Conflicts: # shared/relay/client/manager.go
2026-07-22 08:21:30 +02:00 · 2026-07-21 15:40:39 +02:00 · 2026-07-21 11:27:09 +02:00 · 2026-07-02 12:22:01 +02:00 · 2026-07-01 19:22:41 +02:00 · 2026-07-01 17:11:23 +02:00
46 changed files with 1038 additions and 692 deletions
--- a/.github/workflows/agent-network-e2e.yml
+++ b/.github/workflows/agent-network-e2e.yml
@@ -17,25 +17,25 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

      # Container-driver builder so the harness can build the combined/proxy/
      # client images from source with a local layer cache.
      - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      # Persist the Docker layer cache across runs. This caches the base, apt,
      # and go-mod-download layers; the Go compile still re-runs, as BuildKit
      # mount caches cannot be exported to the GitHub cache.
      - name: Cache Docker layers
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
--- a/.github/workflows/check-license-dependencies.yml
+++ b/.github/workflows/check-license-dependencies.yml
@@ -20,7 +20,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -59,12 +59,12 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: true
--- a/.github/workflows/frontend-ui.yml
+++ b/.github/workflows/frontend-ui.yml
@@ -32,17 +32,17 @@ jobs:
        working-directory: client/ui/frontend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 11

@@ -50,7 +50,7 @@ jobs:
      # are not checked in (see client/ui/frontend/bindings/). Without them,
      # typecheck/build fail on missing module imports.
      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -78,7 +78,7 @@ jobs:
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Cache pnpm store
-        uses: actions/cache@v6
+        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('client/ui/frontend/pnpm-lock.yaml') }}
--- a/.github/workflows/git-town.yml
+++ b/.github/workflows/git-town.yml
@@ -15,7 +15,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: git-town/action@3d8b878379abb1ee393fb49865a28b4a6c2cd3b0 # v1.2.1
--- a/.github/workflows/golang-test-darwin.yml
+++ b/.github/workflows/golang-test-darwin.yml
@@ -16,18 +16,18 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false

      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: ~/go/pkg/mod
          key: macos-gotest-${{ hashFiles('**/go.sum') }}
--- a/.github/workflows/golang-test-freebsd.yml
+++ b/.github/workflows/golang-test-freebsd.yml
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -28,7 +28,7 @@ jobs:
        id: test
        env:
          GO_VERSION: ${{ steps.goversion.outputs.version }}
-        uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2
+        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
        with:
          usesh: true
          copyback: false
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -18,11 +18,11 @@ jobs:
      management: ${{ steps.filter.outputs.management }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
@@ -30,7 +30,7 @@ jobs:
              - 'management/**'

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -41,7 +41,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        id: cache
        with:
          path: |
@@ -119,12 +119,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -135,7 +135,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -182,12 +182,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -199,7 +199,7 @@ jobs:
          echo "modcache_dir=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        id: cache-restore
        with:
          path: |
@@ -253,12 +253,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -273,7 +273,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -313,12 +313,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -332,7 +332,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -370,12 +370,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -390,7 +390,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -431,12 +431,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -447,7 +447,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -464,7 +464,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -536,12 +536,12 @@ jobs:
            prom/prometheus

      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -552,7 +552,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -569,7 +569,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -631,12 +631,12 @@ jobs:
            prom/prometheus

      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -647,7 +647,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
@@ -664,7 +664,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -701,12 +701,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -717,7 +717,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
--- a/.github/workflows/golang-test-windows.yml
+++ b/.github/workflows/golang-test-windows.yml
@@ -18,12 +18,12 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        id: go
        with:
          go-version-file: "go.mod"
@@ -35,7 +35,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $env:GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ${{ env.cache }}
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: codespell
@@ -48,7 +48,7 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for duplicate constants
@@ -56,7 +56,7 @@ jobs:
        run: |
          ! awk '/const \(/,/)/{print $0}' management/server/activity/codes.go | grep -o '= [0-9]*' | sort | uniq -d | grep .
      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -73,7 +73,7 @@ jobs:
          mkdir -p client/ui/frontend/dist
          touch client/ui/frontend/dist/.embed-placeholder
      - name: golangci-lint
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a #v9.3.0
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
        with:
          version: latest
          skip-cache: true
--- a/.github/workflows/install-script-test.yml
+++ b/.github/workflows/install-script-test.yml
@@ -22,7 +22,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

--- a/.github/workflows/mobile-build-validation.yml
+++ b/.github/workflows/mobile-build-validation.yml
@@ -16,11 +16,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
      - name: Setup Android SDK
@@ -28,13 +28,13 @@ jobs:
        with:
          cmdline-tools-version: 8512546
      - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520
        with:
          java-version: "11"
          distribution: "adopt"
      - name: NDK Cache
        id: ndk-cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: /usr/local/lib/android/sdk/ndk
          key: ndk-cache-23.1.7779620
@@ -54,11 +54,11 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
      - name: install gomobile
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -64,7 +64,7 @@ jobs:
        if: steps.check_diff.outputs.diff_exists == 'true'
        env:
          GO_VERSION: ${{ steps.goversion.outputs.version }}
-        uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2
+        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
        with:
          usesh: true
          copyback: false
@@ -135,7 +135,7 @@ jobs:
      ghcr_images: ${{ steps.tag_and_push_images.outputs.images_markdown }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
@@ -166,12 +166,12 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ~/go/pkg/mod
@@ -186,18 +186,18 @@ jobs:
      - name: check git status
        run: git --no-pager diff --exit-code
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 #v4.2.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
      - name: Login to Docker hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Log in to the GitHub container registry
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -221,7 +221,7 @@ jobs:
        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
      - name: Run GoReleaser
        id: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --clean ${{ env.flags }}
@@ -350,7 +350,7 @@ jobs:
      release_ui_artifact_url: ${{ steps.upload_release_ui.outputs.artifact-url }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
@@ -377,12 +377,12 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ~/go/pkg/mod
@@ -398,12 +398,12 @@ jobs:
        run: git --no-pager diff --exit-code

      - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 11

@@ -439,7 +439,7 @@ jobs:
        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --config .goreleaser_ui.yaml --clean ${{ env.flags }}
@@ -483,17 +483,17 @@ jobs:
      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "flags=--snapshot" >> $GITHUB_ENV
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: |
            ~/go/pkg/mod
@@ -506,11 +506,11 @@ jobs:
      - name: check git status
        run: git --no-pager diff --exit-code
      - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 11
      - name: Install wails3 CLI
@@ -521,7 +521,7 @@ jobs:
          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
      - name: Run GoReleaser
        id: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --config .goreleaser_ui_darwin.yaml --clean ${{ env.flags }}
@@ -555,7 +555,7 @@ jobs:
      downloadPath: '${{ github.workspace }}\temp'
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -629,7 +629,7 @@ jobs:
        run: 7z x -o"${{ github.workspace }}/NSIS_Plugins" "${{ github.workspace }}/ShellExecAsUser_amd64-Unicode.7z"

      - name: Set up Go for wails3 CLI
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
          cache: false
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -68,17 +68,17 @@ jobs:
        run: sudo apt-get install -y curl

      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"

      - name: Cache Go modules
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -256,7 +256,7 @@ jobs:
        run: sudo apt-get install -y jq

      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

--- a/.github/workflows/wasm-build-validation.yml
+++ b/.github/workflows/wasm-build-validation.yml
@@ -19,17 +19,17 @@ jobs:
      GOARCH: wasm
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
      - name: Install dependencies
        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
      - name: Install golangci-lint
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a #v9.3.0
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
        with:
          version: latest
          install-mode: binary
@@ -44,11 +44,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: "go.mod"
      - name: Build Wasm client
--- a/client/internal/peer/worker_relay.go
+++ b/client/internal/peer/worker_relay.go
@@ -54,19 +54,15 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relaySupportedOnRemotePeer.Store(true)

 	// the relayManager will return with error in case if the connection has lost with relay server
-	currentRelayAddress, _, err := w.relayManager.RelayInstanceAddress()
+	_, _, err := w.relayManager.RelayInstanceAddress()
 	if err != nil {
 		w.log.Errorf("failed to handle new offer: %s", err)
 		return
 	}

-	srv := w.preferredRelayServer(currentRelayAddress, remoteOfferAnswer.RelaySrvAddress)
-	var serverIP netip.Addr
-	if srv == remoteOfferAnswer.RelaySrvAddress {
-		serverIP = remoteOfferAnswer.RelaySrvIP
-	}
-
-	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
+	preferForeign := !w.isController
+	remoteRelayServer := relayClient.RelayServer{Addr: remoteOfferAnswer.RelaySrvAddress, IP: remoteOfferAnswer.RelaySrvIP}
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, remoteRelayServer, w.config.Key, preferForeign)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -80,14 +76,13 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relayedConn = relayedConn
 	w.relayLock.Unlock()

-	err = w.relayManager.AddCloseListener(srv, w.onRelayClientDisconnected)
-	if err != nil {
-		log.Errorf("failed to add close listener: %s", err)
+	if err := w.relayManager.AddCloseListener(relayedConn.RemoteAddr().String(), w.onRelayClientDisconnected); err != nil {
+		w.log.Errorf("failed to add close listener: %s", err)
 		_ = relayedConn.Close()
 		return
 	}

-	w.log.Debugf("peer conn opened via Relay: %s", srv)
+	w.log.Debugf("peer conn opened via Relay: %s", relayedConn.RemoteAddr())
 	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
 		relayedConn:     relayedConn,
 		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
@@ -126,13 +121,6 @@ func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	return answer.RelaySrvAddress != ""
 }

-func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress string) string {
-	if w.isController {
-		return myRelayAddress
-	}
-	return remoteRelayAddress
-}
-
 func (w *WorkerRelay) onRelayClientDisconnected() {
 	go w.conn.onRelayDisconnected()
 }
--- a/client/internal/routemanager/dynamic/route.go
+++ b/client/internal/routemanager/dynamic/route.go
@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }

 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains(ctx)
+	resolved, err := r.resolveDomains()
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }

-func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
+func (r *Route) resolveDomains() (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(ctx, results)
+	go r.resolve(results)

 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }

-func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
+func (r *Route) resolve(results chan resolveResult) {
 	var wg sync.WaitGroup

 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()

-			ips, err := r.getIPsFromResolver(ctx, domain)
+			ips, err := r.getIPsFromResolver(domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = lookupHostIPs(ctx, domain)
+				ips, err = net.LookupIP(domain.PunycodeString())
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,20 +364,6 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }

-// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
-func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
-	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
-	if err != nil {
-		return nil, err
-	}
-
-	ips := make([]net.IP, 0, len(addrs))
-	for _, addr := range addrs {
-		ips = append(ips, addr.IP)
-	}
-	return ips, nil
-}
-
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {
--- a/client/internal/routemanager/dynamic/route_generic.go
+++ b/client/internal/routemanager/dynamic/route_generic.go
@@ -3,12 +3,11 @@
 package dynamic

 import (
-	"context"
 	"net"

 	"github.com/netbirdio/netbird/shared/management/domain"
 )

-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
-	return lookupHostIPs(ctx, domain)
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+	return net.LookupIP(domain.PunycodeString())
 }
--- a/client/internal/routemanager/dynamic/route_ios.go
+++ b/client/internal/routemanager/dynamic/route_ios.go
@@ -3,7 +3,6 @@
 package dynamic

 import (
-	"context"
 	"fmt"
 	"net"
 	"time"
@@ -17,7 +16,7 @@ import (

 const dialTimeout = 10 * time.Second

-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -33,7 +32,7 @@ func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)

-		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -1081,10 +1081,7 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes

 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		if errors.Is(err, ErrServiceNotUp) {
-			log.Debugf("Down called while service not up: %v", err)
-			return nil, err
-		}
+		// todo review to update the status in case any type of error
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1157,7 +1154,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			log.Errorf("failed to stop engine during cleanup: %v", err)
+			return err
 		}
 	}

--- a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
+++ b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
@@ -1,13 +1,10 @@
-import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
-import { Version } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useStatus } from "@/contexts/StatusContext.tsx";

 const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
-const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";

 function openUrl(url: string) {
    Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
@@ -15,26 +12,7 @@ function openUrl(url: string) {

 export const DaemonOutdatedOverlay = () => {
    const { t } = useTranslation();
-    const { status, isDaemonOutdated } = useStatus();
-
-    const [guiVersion, setGuiVersion] = useState<string>("-");
-    const clientVersion = status?.daemonVersion ?? "—";
-
-    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
-    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
-
-    useEffect(() => {
-        if (!isDaemonOutdated) return;
-        let cancelled = false;
-        Version.GUI()
-            .then((v) => {
-                if (!cancelled) setGuiVersion(v);
-            })
-            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
-        return () => {
-            cancelled = true;
-        };
-    }, [isDaemonOutdated]);
+    const { isDaemonOutdated } = useStatus();

    if (!isDaemonOutdated) return null;

@@ -60,37 +38,10 @@ export const DaemonOutdatedOverlay = () => {
                    <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
                </div>

-                <div className={"flex flex-col items-center gap-0.5 text-center"}>
-                    <p className={"text-sm font-semibold text-nb-gray-100"}>
-                        {clientVersion === "development" ? (
-                            <span>
-                                {t("settings.about.clientName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.client", { version: clientVersion })
-                        )}
-                    </p>
-                    <p className={"text-sm font-medium text-nb-gray-250"}>
-                        {guiVersion === "development" ? (
-                            <span>
-                                {t("settings.about.guiName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.gui", { version: guiVersion })
-                        )}
-                    </p>
-                </div>
-
                <div className={"wails-no-draggable"}>
-                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
                        <DownloadIcon size={14} />
-                        {t("daemon.outdated.download")}
+                        {t("update.card.getInstaller")}
                    </Button>
                </div>
            </div>
--- a/client/ui/frontend/src/contexts/ProfileContext.tsx
+++ b/client/ui/frontend/src/contexts/ProfileContext.tsx
@@ -28,7 +28,6 @@ type ProfileContextValue = {
    loaded: boolean;
    refresh: () => Promise<void>;
    switchProfile: (id: string) => Promise<void>;
-    switchProfileNoConnect: (id: string) => Promise<void>;
    addProfile: (name: string) => Promise<string>;
    removeProfile: (id: string) => Promise<void>;
    renameProfile: (id: string, newName: string) => Promise<void>;
@@ -113,16 +112,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
        [username, refresh],
    );

-    // Manage-profiles variant: switches without connecting, so the user can
-    // still adjust the management URL before bringing the connection up.
-    const switchProfileNoConnect = useCallback(
-        async (id: string) => {
-            await ProfileSwitcher.SwitchActiveNoConnect({ profileName: id, username });
-            await refresh();
-        },
-        [username, refresh],
-    );
-
    // addProfile creates a profile by display name and returns the
    // daemon-generated ID, so the caller can immediately address it by ID.
    const addProfile = useCallback(
@@ -169,7 +158,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
            loaded,
            refresh,
            switchProfile,
-            switchProfileNoConnect,
            addProfile,
            removeProfile,
            renameProfile,
@@ -183,7 +171,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
            loaded,
            refresh,
            switchProfile,
-            switchProfileNoConnect,
            addProfile,
            removeProfile,
            renameProfile,
--- a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -45,7 +45,7 @@ export function ProfilesTab() {
        activeProfileId,
        loaded,
        username,
-        switchProfileNoConnect,
+        switchProfile,
        addProfile,
        removeProfile,
        renameProfile,
@@ -100,7 +100,7 @@ export function ProfilesTab() {
            confirmLabel: t("profile.switch.confirm"),
        });
        if (!ok) return;
-        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfileNoConnect(id));
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfile(id));
    };

    const handleDeregister = async (id: string, name: string) => {
@@ -129,13 +129,14 @@ export function ProfilesTab() {
        await guarded(i18next.t("profile.error.createTitle"), async () => {
            const id = await addProfile(name);
            // SetConfig is keyed by the new profile's ID, so it writes the
-            // not-yet-active profile before the switch makes it current.
+            // not-yet-active profile. Write before switching so any reconnect
+            // targets the right deployment.
            if (!isNetbirdCloud(managementUrl)) {
                await SettingsSvc.SetConfig(
                    new SetConfigParams({ profileName: id, username, managementUrl }),
                );
            }
-            await switchProfileNoConnect(id);
+            await switchProfile(id);
        });
    };

--- a/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
+++ b/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
@@ -73,13 +73,6 @@ export default function SessionExpirationDialog() {

        let offCancel: (() => void) | undefined;

-        // Return the dialog to its interactive state and dismiss the browser popup
-        const resetDialog = () => {
-            offCancel?.();
-            WindowManager.CloseBrowserLogin().catch(console.error);
-            setBusy(false);
-        };
-
        try {
            const start = await Session.RequestExtend({ hint: "" });
            const uri = start.verificationUriComplete || start.verificationUri;
@@ -112,22 +105,25 @@ export default function SessionExpirationDialog() {
            if (outcome.kind === "cancel") {
                waitPromise.cancel?.();
                waitPromise.catch(() => {});
-                resetDialog();
                return;
            }

            // Another surface owns this flow; keep the dialog open to retry.
            if (outcome.result.preempted) {
-                resetDialog();
                return;
            }
-            WindowManager.CloseRenewFlow().catch(console.error);
+
+            // Close before the popup so the restore can't flash this window back.
+            WindowManager.CloseSessionExpiration().catch(console.error);
        } catch (e) {
-            resetDialog();
            await errorDialog({
                Title: t("sessionExpiration.extendFailedTitle"),
                Message: formatErrorMessage(e),
            });
+        } finally {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
        }
    }, [busy, t]);

@@ -143,11 +139,12 @@ export default function SessionExpirationDialog() {
            });
            WindowManager.CloseSessionExpiration().catch(console.error);
        } catch (e) {
-            setBusy(false);
            await errorDialog({
                Title: t("sessionExpiration.logoutFailedTitle"),
                Message: formatErrorMessage(e),
            });
+        } finally {
+            setBusy(false);
        }
    }, [busy, t]);

--- a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
@@ -22,9 +22,6 @@ type WelcomeStepTrayProps = {
 export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>) {
    const { t } = useTranslation();
    const trayScreenshot = trayScreenshotForOS();
-    // macOS has no tray — the icon sits in the menu bar, so the copy says so.
-    const titleKey = isMacOS() ? "welcome.titleMac" : "welcome.title";
-    const descriptionKey = isMacOS() ? "welcome.descriptionMac" : "welcome.description";

    return (
        <>
@@ -39,9 +36,9 @@ export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>)

            <div className={"flex w-full flex-col gap-1"}>
                <DialogHeading id={"nb-welcome-title"} align={"left"}>
-                    {t(titleKey)}
+                    {t("welcome.title")}
                </DialogHeading>
-                <DialogDescription align={"left"}>{t(descriptionKey)}</DialogDescription>
+                <DialogDescription align={"left"}>{t("welcome.description")}</DialogDescription>
            </div>

            <DialogActions>
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Suchen Sie NetBird in der Taskleiste"
    },
-    "welcome.titleMac": {
-        "message": "Suchen Sie NetBird in der Menüleiste"
-    },
    "welcome.description": {
        "message": "NetBird läuft in Ihrer Taskleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird läuft in Ihrer Menüleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
-    },
    "welcome.continue": {
        "message": "Weiter"
    },
@@ -1299,13 +1293,10 @@
        "message": "Dokumentation"
    },
    "daemon.outdated.title": {
-        "message": "NetBird Client ist veraltet"
+        "message": "NetBird-Dienst ist veraltet"
    },
    "daemon.outdated.description": {
-        "message": "Die neue GUI ist nicht mit Ihrem älteren Client kompatibel. Aktualisieren Sie Ihren Client, um die neue Anwendung zu verwenden."
-    },
-    "daemon.outdated.download": {
-        "message": "Neueste Version herunterladen"
+        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
    },
    "error.jwt_clock_skew": {
        "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -1377,19 +1377,11 @@
    },
    "welcome.title": {
        "message": "Look for NetBird in your tray",
-        "description": "Heading on the first onboarding step, pointing the user to the tray icon. Shown on Windows and Linux; macOS uses welcome.titleMac."
-    },
-    "welcome.titleMac": {
-        "message": "Look for NetBird in your menu bar",
-        "description": "Heading on the first onboarding step on macOS, pointing the user to the menu bar icon. Use your language's Apple term for the macOS menu bar."
+        "description": "Heading on the first onboarding step, pointing the user to the tray icon. 'tray' = system tray / menu bar."
    },
    "welcome.description": {
        "message": "NetBird lives in your tray. Click the icon to connect, switch profiles, or open settings.",
-        "description": "Body of the first onboarding step explaining the tray icon. Shown on Windows and Linux; macOS uses welcome.descriptionMac."
-    },
-    "welcome.descriptionMac": {
-        "message": "NetBird lives in your menu bar. Click the icon to connect, switch profiles, or open settings.",
-        "description": "Body of the first onboarding step on macOS explaining the menu bar icon. Use your language's Apple term for the macOS menu bar."
+        "description": "Body of the first onboarding step explaining the tray icon."
    },
    "welcome.continue": {
        "message": "Continue",
@@ -1732,16 +1724,12 @@
        "description": "Documentation link on the daemon-unavailable overlay."
    },
    "daemon.outdated.title": {
-        "message": "NetBird Client Is Outdated",
-        "description": "Title of the overlay shown when the NetBird client (daemon) is too old to drive this UI."
+        "message": "NetBird Service Is Outdated",
+        "description": "Title of the overlay shown when the NetBird background service is too old to drive this UI."
    },
    "daemon.outdated.description": {
-        "message": "The new GUI isn't compatible with the older NetBird client. Update your client to use the new application.",
-        "description": "Body of the daemon-outdated overlay explaining that the GUI is newer than the client and the client must be updated."
-    },
-    "daemon.outdated.download": {
-        "message": "Download Latest",
-        "description": "Button on the daemon-outdated overlay that opens the download page for the latest release."
+        "message": "Update the NetBird service to use this app.",
+        "description": "Body of the daemon-outdated overlay telling the user to upgrade the service."
    },
    "error.jwt_clock_skew": {
        "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Busque NetBird en su bandeja del sistema"
    },
-    "welcome.titleMac": {
-        "message": "Busque NetBird en su barra de menús"
-    },
    "welcome.description": {
        "message": "NetBird reside en su bandeja del sistema. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird reside en su barra de menús. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
-    },
    "welcome.continue": {
        "message": "Continuar"
    },
@@ -1299,13 +1293,10 @@
        "message": "Documentación"
    },
    "daemon.outdated.title": {
-        "message": "NetBird Client está desactualizado"
+        "message": "El servicio de NetBird está desactualizado"
    },
    "daemon.outdated.description": {
-        "message": "La nueva GUI no es compatible con su cliente anterior. Actualice su cliente para usar la nueva aplicación."
-    },
-    "daemon.outdated.download": {
-        "message": "Descargar la última versión"
+        "message": "Actualice el servicio de NetBird para usar esta aplicación."
    },
    "error.jwt_clock_skew": {
        "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Cherchez NetBird dans votre barre d’état système"
    },
-    "welcome.titleMac": {
-        "message": "Cherchez NetBird dans votre barre des menus"
-    },
    "welcome.description": {
        "message": "NetBird se trouve dans votre barre d’état système. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird se trouve dans votre barre des menus. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
-    },
    "welcome.continue": {
        "message": "Continuer"
    },
@@ -1299,13 +1293,10 @@
        "message": "Documentation"
    },
    "daemon.outdated.title": {
-        "message": "Le Client NetBird est obsolète"
+        "message": "Le service NetBird est obsolète"
    },
    "daemon.outdated.description": {
-        "message": "La nouvelle GUI n'est pas compatible avec votre ancien client. Mettez à jour votre client pour utiliser la nouvelle application."
-    },
-    "daemon.outdated.download": {
-        "message": "Télécharger la dernière version"
+        "message": "Mettez à jour le service NetBird pour utiliser cette application."
    },
    "error.jwt_clock_skew": {
        "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Keresse a NetBirdöt a tálcán"
    },
-    "welcome.titleMac": {
-        "message": "Keresse a NetBirdöt a menüsorban"
-    },
    "welcome.description": {
        "message": "A NetBird a tálcán fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
    },
-    "welcome.descriptionMac": {
-        "message": "A NetBird a menüsorban fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
-    },
    "welcome.continue": {
        "message": "Folytatás"
    },
@@ -1299,13 +1293,10 @@
        "message": "Dokumentáció"
    },
    "daemon.outdated.title": {
-        "message": "A NetBird Kliens elavult"
+        "message": "A NetBird szolgáltatás elavult"
    },
    "daemon.outdated.description": {
-        "message": "Az új GUI nem kompatibilis a régebbi klienseddel. Frissítsd a klienst az új alkalmazás használatához."
-    },
-    "daemon.outdated.download": {
-        "message": "Legújabb letöltése"
+        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
    },
    "error.jwt_clock_skew": {
        "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Cerchi NetBird nella tray"
    },
-    "welcome.titleMac": {
-        "message": "Cerchi NetBird nella barra dei menu"
-    },
    "welcome.description": {
        "message": "NetBird risiede nella tray. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird risiede nella barra dei menu. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
-    },
    "welcome.continue": {
        "message": "Continua"
    },
@@ -1299,13 +1293,10 @@
        "message": "Documentazione"
    },
    "daemon.outdated.title": {
-        "message": "NetBird Client è obsoleto"
+        "message": "Il servizio NetBird è obsoleto"
    },
    "daemon.outdated.description": {
-        "message": "La nuova GUI non è compatibile con il tuo client precedente. Aggiorna il client per usare la nuova applicazione."
-    },
-    "daemon.outdated.download": {
-        "message": "Scarica l'ultima versione"
+        "message": "Aggiorna il servizio NetBird per usare questa app."
    },
    "error.jwt_clock_skew": {
        "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."
--- a/client/ui/i18n/locales/ja/common.json
+++ b/client/ui/i18n/locales/ja/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "トレイの NetBird を確認してください"
    },
-    "welcome.titleMac": {
-        "message": "メニューバーの NetBird を確認してください"
-    },
    "welcome.description": {
        "message": "NetBird はトレイに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird はメニューバーに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
-    },
    "welcome.continue": {
        "message": "続ける"
    },
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Procure o NetBird na sua bandeja"
    },
-    "welcome.titleMac": {
-        "message": "Procure o NetBird na sua barra de menus"
-    },
    "welcome.description": {
        "message": "O NetBird fica na sua bandeja. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
    },
-    "welcome.descriptionMac": {
-        "message": "O NetBird fica na sua barra de menus. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
-    },
    "welcome.continue": {
        "message": "Continuar"
    },
@@ -1299,13 +1293,10 @@
        "message": "Documentação"
    },
    "daemon.outdated.title": {
-        "message": "O NetBird Client está desatualizado"
+        "message": "O serviço NetBird está desatualizado"
    },
    "daemon.outdated.description": {
-        "message": "A nova GUI não é compatível com o seu cliente mais antigo. Atualize o seu cliente para usar o novo aplicativo."
-    },
-    "daemon.outdated.download": {
-        "message": "Baixar a versão mais recente"
+        "message": "Atualize o serviço NetBird para usar este aplicativo."
    },
    "error.jwt_clock_skew": {
        "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "Найдите NetBird в системном трее"
    },
-    "welcome.titleMac": {
-        "message": "Найдите NetBird в строке меню"
-    },
    "welcome.description": {
        "message": "NetBird находится в системном трее. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird находится в строке меню. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
-    },
    "welcome.continue": {
        "message": "Продолжить"
    },
@@ -1299,13 +1293,10 @@
        "message": "Документация"
    },
    "daemon.outdated.title": {
-        "message": "Клиент NetBird устарел"
+        "message": "Служба NetBird устарела"
    },
    "daemon.outdated.description": {
-        "message": "Новый GUI несовместим с вашим более старым клиентом. Обновите клиент, чтобы использовать новое приложение."
-    },
-    "daemon.outdated.download": {
-        "message": "Скачать последнюю версию"
+        "message": "Обновите службу NetBird, чтобы использовать это приложение."
    },
    "error.jwt_clock_skew": {
        "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -1034,15 +1034,9 @@
    "welcome.title": {
        "message": "在托盘中查找 NetBird"
    },
-    "welcome.titleMac": {
-        "message": "在菜单栏中查找 NetBird"
-    },
    "welcome.description": {
        "message": "NetBird 驻留在您的托盘中。点击图标即可连接、切换配置文件或打开设置。"
    },
-    "welcome.descriptionMac": {
-        "message": "NetBird 驻留在您的菜单栏中。点击图标即可连接、切换配置文件或打开设置。"
-    },
    "welcome.continue": {
        "message": "继续"
    },
@@ -1299,13 +1293,10 @@
        "message": "文档"
    },
    "daemon.outdated.title": {
-        "message": "NetBird 客户端版本过旧"
+        "message": "NetBird 服务版本过旧"
    },
    "daemon.outdated.description": {
-        "message": "新版 GUI 与您较旧的客户端不兼容。请更新客户端以使用新应用。"
-    },
-    "daemon.outdated.download": {
-        "message": "下载最新版本"
+        "message": "请更新 NetBird 服务以使用此应用。"
    },
    "error.jwt_clock_skew": {
        "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"
--- a/client/ui/services/profileswitcher.go
+++ b/client/ui/services/profileswitcher.go
@@ -12,15 +12,13 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )

-// ProfileSwitcher holds the switch policy shared by the tray and React
-// frontend so both flip profiles identically. SwitchActive (plain selection:
-// header dropdown, tray submenu) always connects after the switch;
-// SwitchActiveNoConnect (manage-profiles screen) never does, so the user can
-// still adjust the management URL before connecting. prevStatus from
-// DaemonFeed.Get at entry only decides the teardown:
+// ProfileSwitcher holds the reconnect policy shared by the tray and React
+// frontend so both flip profiles identically. The policy keys off prevStatus
+// from DaemonFeed.Get at SwitchActive entry:
 //
-//	Connected/Connecting/NeedsLogin/LoginFailed/SessionExpired → Down first.
-//	Idle → no Down.
+//	Connected/Connecting → Switch + Down + Up; optimistic Connecting paint.
+//	NeedsLogin/LoginFailed/SessionExpired → Switch + Down; clear stale error for re-login.
+//	Idle → Switch only.
 type ProfileSwitcher struct {
 	profiles   *Profiles
 	connection *Connection
@@ -31,40 +29,29 @@ func NewProfileSwitcher(profiles *Profiles, connection *Connection, feed *Daemon
 	return &ProfileSwitcher{profiles: profiles, connection: connection, feed: feed}
 }

-// SwitchActive switches to the named profile and always connects afterwards.
+// SwitchActive switches to the named profile applying the reconnect policy.
 func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error {
-	return s.switchActive(ctx, p, true)
-}
-
-// SwitchActiveNoConnect switches to the named profile without connecting,
-// tearing down any existing connection first.
-func (s *ProfileSwitcher) SwitchActiveNoConnect(ctx context.Context, p ProfileRef) error {
-	return s.switchActive(ctx, p, false)
-}
-
-func (s *ProfileSwitcher) switchActive(ctx context.Context, p ProfileRef, connect bool) error {
 	prevStatus := ""
-	if s.feed != nil {
-		if st, err := s.feed.Get(ctx); err == nil {
-			prevStatus = st.Status
-		} else {
-			log.Warnf("profileswitcher: get status: %v", err)
-		}
+	if st, err := s.feed.Get(ctx); err == nil {
+		prevStatus = st.Status
+	} else {
+		log.Warnf("profileswitcher: get status: %v", err)
 	}

-	needsDown := strings.EqualFold(prevStatus, StatusConnected) ||
-		strings.EqualFold(prevStatus, StatusConnecting) ||
+	wasActive := strings.EqualFold(prevStatus, StatusConnected) ||
+		strings.EqualFold(prevStatus, StatusConnecting)
+	needsDown := wasActive ||
 		strings.EqualFold(prevStatus, StatusNeedsLogin) ||
 		strings.EqualFold(prevStatus, StatusLoginFailed) ||
 		strings.EqualFold(prevStatus, StatusSessionExpired)

-	log.Infof("profileswitcher: switch profile=%q prevStatus=%q connect=%v needsDown=%v",
-		p.ProfileName, prevStatus, connect, needsDown)
+	log.Infof("profileswitcher: switch profile=%q prevStatus=%q wasActive=%v needsDown=%v",
+		p.ProfileName, prevStatus, wasActive, needsDown)

-	// Optimistic Connecting paint plus stale-push suppression during Down (see
-	// DaemonFeed suppression table); also arms the login-watch that pops
-	// browser-login when the new profile turns out to need SSO.
-	if connect && s.feed != nil {
+	// Optimistic Connecting paint only when wasActive: those prevStatuses emit
+	// stale Connected + transient Idle pushes during Down that must be
+	// suppressed until Up resumes the stream (see DaemonFeed suppression table).
+	if wasActive {
 		s.feed.BeginProfileSwitch()
 	}

@@ -89,9 +76,9 @@ func (s *ProfileSwitcher) switchActive(ctx context.Context, p ProfileRef, connec
 		}
 	}

-	if connect {
+	if wasActive {
 		if err := s.connection.Up(ctx, UpParams(p)); err != nil {
-			return fmt.Errorf("connect %q: %w", p.ProfileName, err)
+			return fmt.Errorf("reconnect %q: %w", p.ProfileName, err)
 		}
 	}

--- a/client/ui/services/windowmanager.go
+++ b/client/ui/services/windowmanager.go
@@ -185,38 +185,37 @@ func (s *WindowManager) OpenBrowserLogin(uri string) {
 			startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
 		}
 		s.hideOtherWindowsLocked("browser-login")
+		// Prefer the main window's screen (multi-monitor); falls back to OS-default centering.
+		var screen *application.Screen
+		if s.mainWindow != nil {
+			if sc, err := s.mainWindow.GetScreen(); err == nil {
+				screen = sc
+			}
+		}
 		opts := DialogWindowOptions("browser-login", s.title("window.title.signIn"), startURL, s.linuxIcon)
 		// Not always-on-top: it would obscure the browser tab the user logs in through.
 		opts.AlwaysOnTop = false
 		opts.InitialPosition = application.WindowCentered
-		// Open on the active (where users cursor is) display, like the session-expiration dialog.
-		opts.Screen = s.getScreenBasedOnCursorPosition()
+		opts.Screen = screen
 		s.browserLogin = s.app.Window.NewWithOptions(opts)
 		bl := s.browserLogin
+		// Red-X close means cancel: emit the event so startLogin() tears down the SSO wait.
 		bl.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.app.Event.Emit(EventBrowserLoginCancel)
 			s.mu.Lock()
-			// Only a live user red-X still has this registered; programmatic closers
-			// nil s.browserLogin first and clean up themselves. Guarding here stops a
-			// stale close event from wiping a replacement popup's state.
-			userClosed := s.browserLogin == bl
-			if userClosed {
-				s.browserLogin = nil
-				s.restoreHiddenWindowsLocked()
-			}
+			s.browserLogin = nil
+			s.restoreHiddenWindowsLocked()
 			s.mu.Unlock()
-			if userClosed {
-				s.app.Event.Emit(EventBrowserLoginCancel)
-			}
 		})
-		s.centerOnCursorScreen(s.browserLogin)
+		s.centerWhenReady(s.browserLogin)
 		return
 	}
 	if uri != "" {
 		s.browserLogin.SetURL("/#/dialog/browser-login?uri=" + url.QueryEscape(uri))
 	}
-	s.centerOnCursorScreen(s.browserLogin)
 	s.browserLogin.Show()
 	s.browserLogin.Focus()
+	s.centerWhenReady(s.browserLogin)
 }

 // BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
@@ -239,15 +238,6 @@ func (s *WindowManager) CloseBrowserLogin() {
 	s.mu.Lock()
 	w := s.browserLogin
 	s.browserLogin = nil
-	// The WindowClosing hook no-ops on a programmatic close, so restore here —
-	// but only if a popup was actually open. The frontend calls this even when no
-	// popup was ever shown (e.g. resetDialog() after an early RequestExtend failure,
-	// or connection.ts's catch path), and hiddenForLogin is shared with
-	// OpenInstallProgress, so an unconditional restore could re-show windows a
-	// still-running install-progress is hiding.
-	if w != nil {
-		s.restoreHiddenWindowsLocked()
-	}
 	s.mu.Unlock()
 	if w != nil {
 		w.Close()
@@ -289,35 +279,6 @@ func (s *WindowManager) CloseSessionExpiration() {
 	}
 }

-// CloseRenewFlow tears down the SSO session-renewal UI in a single call: it
-// closes the browser-login popup and the session-expiration window together.
-func (s *WindowManager) CloseRenewFlow() {
-	s.mu.Lock()
-	bl := s.browserLogin
-	se := s.sessionExpiration
-	s.browserLogin = nil
-	s.sessionExpiration = nil
-	if se != nil {
-		kept := s.hiddenForLogin[:0]
-		for _, w := range s.hiddenForLogin {
-			if w != se {
-				kept = append(kept, w)
-			}
-		}
-		s.hiddenForLogin = kept
-	}
-	s.restoreHiddenWindowsLocked()
-	s.mu.Unlock()
-
-	// Close after unlock so the re-entrant handlers can take s.mu.
-	if bl != nil {
-		bl.Close()
-	}
-	if se != nil {
-		se.Close()
-	}
-}
-
 // OpenInstallProgress shows the install-progress window and hides the rest for the duration
 // (restored on close). It owns its own result polling since the daemon restarts mid-install.
 func (s *WindowManager) OpenInstallProgress(version string) {
--- a/client/ui/tray.go
+++ b/client/ui/tray.go
@@ -30,8 +30,6 @@ const (

 	statusError = "Error"

-	quitDownTimeout = 5 * time.Second
-
 	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
 	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
 	urlDocs           = "https://docs.netbird.io"
@@ -448,28 +446,11 @@ func (t *Tray) buildMenu() *application.Menu {
 	menu.AddSeparator()
 	menu.Add(t.loc.T("tray.menu.quit")).
 		SetAccelerator("CmdOrCtrl+Q").
-		OnClick(func(*application.Context) { t.handleQuit() })
+		OnClick(func(*application.Context) { t.app.Quit() })

 	return menu
 }

-func (t *Tray) handleQuit() {
-	t.profileMu.Lock()
-	if t.switchCancel != nil {
-		t.switchCancel()
-		t.switchCancel = nil
-	}
-	t.profileMu.Unlock()
-	t.svc.DaemonFeed.CancelProfileSwitch()
-
-	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-	defer cancel()
-	if err := t.svc.Connection.Down(ctx); err != nil {
-		log.Errorf("disconnect on quit: %v", err)
-	}
-	t.app.Quit()
-}
-
 // handleConnect receives the clicked item from the buildMenu closure —
 // t.upItem is menuMu-guarded and must not be read here.
 func (t *Tray) handleConnect(upItem *application.MenuItem) {
--- a/proxy/Dockerfile.multistage
+++ b/proxy/Dockerfile.multistage
@@ -14,7 +14,6 @@ COPY proxy ./proxy
 COPY route ./route
 COPY shared ./shared
 COPY sharedsock ./sharedsock
-COPY trustedproxy ./trustedproxy
 COPY upload-server ./upload-server
 COPY util ./util
 COPY version ./version
--- a/shared/relay/client/fallback_opener.go
+++ b/shared/relay/client/fallback_opener.go
@@ -0,0 +1,176 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	raceTotalTimeout  = 40 * time.Second
+	raceFallbackDelay = 10 * time.Second
+)
+
+type raceAttempt struct {
+	conn net.Conn
+	err  error
+}
+
+type raceOutcome struct {
+	conn net.Conn
+	err  error
+	done bool
+}
+
+type connRace struct {
+	opener            *FallbackOpener
+	peerKey           string
+	remoteRelayServer RelayServer
+	preferForeign     bool
+
+	raceCtx         context.Context
+	otherCtx        context.Context
+	cancelPreferred context.CancelFunc
+	cancelOther     context.CancelFunc
+	results         chan raceAttempt
+	fallbackTimer   *time.Timer
+
+	otherStarted bool
+	settled      int
+	lastErr      error
+}
+
+type FallbackOpener struct {
+	home         *Client
+	foreignStore *ForeignRelaysStore
+
+	fallbackDelay time.Duration
+	totalTimeout  time.Duration
+	// openFn performs a single attempt. It is overridable in tests; when nil the
+	// real home/foreign dispatch in open is used.
+	openFn func(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt
+}
+
+func NewFallbackOpener(home *Client, foreignStore *ForeignRelaysStore) *FallbackOpener {
+	return &FallbackOpener{
+		home:          home,
+		foreignStore:  foreignStore,
+		fallbackDelay: raceFallbackDelay,
+		totalTimeout:  raceTotalTimeout,
+	}
+}
+
+func (r *FallbackOpener) Run(ctx context.Context, peerKey string, remoteRelayServer RelayServer, preferForeign bool) (net.Conn, error) {
+	raceCtx, cancel := context.WithTimeout(ctx, r.totalTimeout)
+	defer cancel()
+
+	preferredCtx, cancelPreferred := context.WithCancel(raceCtx)
+	otherCtx, cancelOther := context.WithCancel(raceCtx)
+
+	race := &connRace{
+		opener:            r,
+		peerKey:           peerKey,
+		remoteRelayServer: remoteRelayServer,
+		preferForeign:     preferForeign,
+		raceCtx:           raceCtx,
+		otherCtx:          otherCtx,
+		cancelPreferred:   cancelPreferred,
+		cancelOther:       cancelOther,
+		results:           make(chan raceAttempt, 2),
+		fallbackTimer:     time.NewTimer(r.fallbackDelay),
+	}
+	defer race.fallbackTimer.Stop()
+
+	go func() {
+		race.results <- r.open(preferredCtx, peerKey, remoteRelayServer, preferForeign)
+	}()
+
+	for {
+		select {
+		case <-race.fallbackTimer.C:
+			race.startOther()
+		case res := <-race.results:
+			if o := race.handleResult(res); o.done {
+				return o.conn, o.err
+			}
+		case <-raceCtx.Done():
+			return race.onTimeout()
+		}
+	}
+}
+
+func (c *connRace) startOther() {
+	if c.otherStarted {
+		return
+	}
+	c.otherStarted = true
+	c.fallbackTimer.Stop()
+	go func() {
+		c.results <- c.opener.open(c.otherCtx, c.peerKey, c.remoteRelayServer, !c.preferForeign)
+	}()
+}
+
+func (c *connRace) handleResult(res raceAttempt) raceOutcome {
+	if (res.err == nil && res.conn != nil) || errors.Is(res.err, ErrConnAlreadyExists) {
+		c.settled++
+		c.stop()
+		return raceOutcome{conn: res.conn, err: res.err, done: true}
+	}
+
+	c.lastErr = res.err
+	c.settled++
+	if !c.otherStarted {
+		c.startOther()
+		return raceOutcome{}
+	}
+	if c.settled == 2 {
+		c.cancelPreferred()
+		c.cancelOther()
+		return raceOutcome{err: c.lastErr, done: true}
+	}
+	return raceOutcome{}
+}
+
+func (c *connRace) onTimeout() (net.Conn, error) {
+	c.stop()
+	if c.lastErr != nil {
+		return nil, c.lastErr
+	}
+	return nil, c.raceCtx.Err()
+}
+
+func (c *connRace) stop() {
+	c.cancelPreferred()
+	c.cancelOther()
+	go c.opener.drainLoser(c.results, c.settled, c.otherStarted)
+}
+
+func (r *FallbackOpener) open(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt {
+	if r.openFn != nil {
+		return r.openFn(ctx, peerKey, remoteRelayServer, foreign)
+	}
+	if foreign {
+		conn, err := r.foreignStore.OpenConn(ctx, peerKey, remoteRelayServer)
+		return raceAttempt{conn: conn, err: err}
+	}
+	conn, err := r.home.OpenConn(ctx, peerKey)
+	return raceAttempt{conn: conn, err: err}
+}
+
+func (r *FallbackOpener) drainLoser(results chan raceAttempt, settled int, otherStarted bool) {
+	started := 1
+	if otherStarted {
+		started = 2
+	}
+	for i := settled; i < started; i++ {
+		res := <-results
+		if res.conn != nil {
+			if err := res.conn.Close(); err != nil {
+				log.Debugf("failed to close losing relay connection: %v", err)
+			}
+		}
+	}
+}
--- a/shared/relay/client/fallback_opener_test.go
+++ b/shared/relay/client/fallback_opener_test.go
@@ -0,0 +1,450 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The FallbackOpener race is driven by a single goroutine (Run's select loop)
+// with worker goroutines that communicate only through the buffered results
+// channel and the two cancel contexts. These tests exercise that state machine
+// in isolation via an injected openFn, so no relay server or network is needed.
+// Timing is scaled down through the fallbackDelay/totalTimeout fields.
+
+// raceFakeConn tracks whether Close was called. Only Close is exercised by the
+// race logic (drainLoser closes losers; Run returns the winner untouched).
+type raceFakeConn struct {
+	net.Conn
+	label  string
+	closed atomic.Bool
+}
+
+func (c *raceFakeConn) Close() error {
+	c.closed.Store(true)
+	return nil
+}
+
+// raceAttemptScript describes how a single scripted attempt behaves.
+type raceAttemptScript struct {
+	delay time.Duration
+	conn  *raceFakeConn // non-nil => the attempt succeeds and returns this conn
+	err   error         // returned when conn is nil
+	// ignoreCtx makes the attempt complete after delay even if its context is
+	// cancelled. It models an OpenConn that produced a real connection right as
+	// the race cancelled it - exactly the case drainLoser must clean up.
+	ignoreCtx bool
+}
+
+// fakeOpener replaces FallbackOpener.open. Scripts are keyed by the foreign
+// flag, so which script is "preferred" depends on the preferForeign argument
+// passed to Run.
+type fakeOpener struct {
+	mu      sync.Mutex
+	scripts map[bool]raceAttemptScript
+	calls   []bool // foreign flag of each open() invocation, in order
+}
+
+func (f *fakeOpener) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
+	f.mu.Lock()
+	f.calls = append(f.calls, foreign)
+	s, ok := f.scripts[foreign]
+	f.mu.Unlock()
+	if !ok {
+		return raceAttempt{err: fmt.Errorf("no script for foreign=%v", foreign)}
+	}
+
+	if s.delay > 0 {
+		timer := time.NewTimer(s.delay)
+		defer timer.Stop()
+		if s.ignoreCtx {
+			<-timer.C
+		} else {
+			select {
+			case <-timer.C:
+			case <-ctx.Done():
+				return raceAttempt{err: ctx.Err()}
+			}
+		}
+	}
+
+	if s.conn != nil {
+		return raceAttempt{conn: s.conn}
+	}
+	return raceAttempt{err: s.err}
+}
+
+func (f *fakeOpener) callCount() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.calls)
+}
+
+func (f *fakeOpener) firstCallForeign(t *testing.T) bool {
+	t.Helper()
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	require.NotEmpty(t, f.calls, "expected at least one open attempt")
+	return f.calls[0]
+}
+
+func newTestOpener(f *fakeOpener, fallbackDelay, totalTimeout time.Duration) *FallbackOpener {
+	o := NewFallbackOpener(nil, nil)
+	o.openFn = f.open
+	o.fallbackDelay = fallbackDelay
+	o.totalTimeout = totalTimeout
+	return o
+}
+
+const (
+	// controller prefers the home relay, i.e. preferForeign == false.
+	preferHome    = false
+	preferForeign = true
+)
+
+var errAttempt = errors.New("attempt failed")
+
+// The preferred attempt wins before the fallback timer fires, so the other
+// attempt is never started.
+func TestFallbackOpener_PreferredWinsImmediately(t *testing.T) {
+	homeConn := &raceFakeConn{label: "home"}
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {conn: homeConn},                            // preferred (home): instant success
+		true:  {delay: 5 * time.Second, conn: foreignConn}, // would never finish in time
+	}}
+	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.NoError(t, err)
+	require.Same(t, homeConn, conn)
+	assert.Equal(t, 1, f.callCount(), "other attempt must not start when preferred wins first")
+	assert.False(t, f.firstCallForeign(t), "home must be tried first when preferring home")
+	assert.False(t, foreignConn.closed.Load())
+}
+
+// preferForeign flips which relay is tried first.
+func TestFallbackOpener_PreferForeignRoutesForeignFirst(t *testing.T) {
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		true:  {conn: foreignConn}, // preferred (foreign): instant success
+		false: {delay: 5 * time.Second, conn: &raceFakeConn{}},
+	}}
+	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferForeign)
+
+	require.NoError(t, err)
+	require.Same(t, foreignConn, conn)
+	assert.Equal(t, 1, f.callCount())
+	assert.True(t, f.firstCallForeign(t), "foreign must be tried first when preferring foreign")
+}
+
+// ErrConnAlreadyExists counts as success: Run returns it and does not start the
+// other attempt.
+func TestFallbackOpener_ErrConnAlreadyExistsIsSuccess(t *testing.T) {
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {err: ErrConnAlreadyExists},
+		true:  {delay: 5 * time.Second, conn: &raceFakeConn{}},
+	}}
+	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.ErrorIs(t, err, ErrConnAlreadyExists)
+	assert.Nil(t, conn)
+	assert.Equal(t, 1, f.callCount(), "other attempt must not start on ErrConnAlreadyExists")
+}
+
+// A preferred failure starts the other attempt immediately, without waiting for
+// the fallback timer.
+func TestFallbackOpener_PreferredFailsStartsOtherBeforeTimer(t *testing.T) {
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {err: errAttempt}, // preferred fails instantly
+		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
+	}}
+	fallbackDelay := 500 * time.Millisecond
+	o := newTestOpener(f, fallbackDelay, 2*time.Second)
+
+	start := time.Now()
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+	elapsed := time.Since(start)
+
+	require.NoError(t, err)
+	require.Same(t, foreignConn, conn)
+	assert.Equal(t, 2, f.callCount())
+	assert.Less(t, elapsed, fallbackDelay/2, "fallback must not wait for the timer after a preferred failure")
+}
+
+// When the preferred attempt is slow, the fallback timer starts the other
+// attempt and its success wins.
+func TestFallbackOpener_TimerStartsOtherWhenPreferredSlow(t *testing.T) {
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {delay: 5 * time.Second}, // preferred hangs until cancelled
+		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
+	}}
+	fallbackDelay := 40 * time.Millisecond
+	o := newTestOpener(f, fallbackDelay, 2*time.Second)
+
+	start := time.Now()
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+	elapsed := time.Since(start)
+
+	require.NoError(t, err)
+	require.Same(t, foreignConn, conn)
+	assert.Equal(t, 2, f.callCount())
+	assert.GreaterOrEqual(t, elapsed, fallbackDelay, "other must not start before the fallback timer fires")
+}
+
+// Both attempts fail: Run returns the last error and tries both relays.
+func TestFallbackOpener_BothFail(t *testing.T) {
+	errOther := errors.New("other failed")
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {err: errAttempt},
+		true:  {err: errOther},
+	}}
+	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.Error(t, err)
+	assert.Nil(t, conn)
+	assert.ErrorIs(t, err, errOther, "the most recent error should be surfaced")
+	assert.Equal(t, 2, f.callCount())
+}
+
+// When both attempts succeed, drainLoser must close the losing connection so it
+// is not leaked. Here the preferred attempt wins and the foreign loser - which
+// produced a real conn despite being cancelled - is closed.
+func TestFallbackOpener_DoubleSuccessClosesLoser(t *testing.T) {
+	homeConn := &raceFakeConn{label: "home"}
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {delay: 30 * time.Millisecond, conn: homeConn},                     // preferred wins
+		true:  {delay: 80 * time.Millisecond, conn: foreignConn, ignoreCtx: true}, // loser yields a conn after cancel
+	}}
+	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.NoError(t, err)
+	require.Same(t, homeConn, conn)
+	assert.Equal(t, 2, f.callCount())
+	assert.False(t, homeConn.closed.Load(), "the winning connection must not be closed")
+	require.Eventually(t, foreignConn.closed.Load, time.Second, 5*time.Millisecond,
+		"the losing connection must be closed by drainLoser")
+}
+
+// Winner selection is purely by result arrival order, not by preference: when
+// the non-preferred attempt returns first it wins even though home was
+// preferred. This is the mechanism behind the split-relay concern - two peers
+// racing independently have no shared tie-break, so under adversarial timing
+// they can settle on different relays. Documented here as current behavior.
+func TestFallbackOpener_FasterOtherWinsDespitePreference(t *testing.T) {
+	homeConn := &raceFakeConn{label: "home"}
+	foreignConn := &raceFakeConn{label: "foreign"}
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {delay: 60 * time.Millisecond, conn: homeConn, ignoreCtx: true}, // preferred but slower
+		true:  {delay: 5 * time.Millisecond, conn: foreignConn},                // other is faster
+	}}
+	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.NoError(t, err)
+	require.Same(t, foreignConn, conn, "the first successful attempt wins regardless of preference")
+	require.Eventually(t, homeConn.closed.Load, time.Second, 5*time.Millisecond,
+		"the slower preferred attempt becomes the loser and is closed")
+}
+
+// The whole race is bounded by totalTimeout. With no attempt succeeding or
+// failing, Run returns the deadline error.
+func TestFallbackOpener_TotalTimeout(t *testing.T) {
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {delay: 5 * time.Second},
+		true:  {delay: 5 * time.Second},
+	}}
+	o := newTestOpener(f, 20*time.Millisecond, 80*time.Millisecond)
+
+	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.Error(t, err)
+	assert.Nil(t, conn)
+	assert.ErrorIs(t, err, context.DeadlineExceeded)
+}
+
+// Cancelling the caller's context aborts the race promptly with the cancel
+// error, even before the fallback timer would fire.
+func TestFallbackOpener_ParentContextCanceled(t *testing.T) {
+	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
+		false: {delay: 5 * time.Second},
+		true:  {delay: 5 * time.Second},
+	}}
+	// fallbackDelay large so the timer never fires; only the parent cancel ends the race.
+	o := newTestOpener(f, 5*time.Second, 5*time.Second)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(20 * time.Millisecond)
+		cancel()
+	}()
+
+	start := time.Now()
+	conn, err := o.Run(ctx, "peer", RelayServer{Addr: "srv"}, preferHome)
+
+	require.Error(t, err)
+	assert.Nil(t, conn)
+	assert.ErrorIs(t, err, context.Canceled)
+	assert.Less(t, time.Since(start), time.Second, "must return shortly after the parent context is cancelled")
+	assert.Equal(t, 1, f.callCount(), "the other attempt must not start")
+}
+
+// rendezvous models the relay-level requirement that a relayed connection is
+// established only once BOTH peers subscribe to the same relay server. arrive
+// records a peer's presence on a relay and returns a channel that closes when
+// the second peer arrives, so an attempt can only complete after a real
+// rendezvous - the same coupling the production code depends on.
+type rendezvous struct {
+	mu       sync.Mutex
+	arrivals map[string]int
+	gates    map[string]chan struct{}
+}
+
+func newRendezvous() *rendezvous {
+	return &rendezvous{arrivals: map[string]int{}, gates: map[string]chan struct{}{}}
+}
+
+func (r *rendezvous) arrive(relay string) <-chan struct{} {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	g, ok := r.gates[relay]
+	if !ok {
+		g = make(chan struct{})
+		r.gates[relay] = g
+	}
+	r.arrivals[relay]++
+	if r.arrivals[relay] == 2 {
+		close(g)
+	}
+	return g
+}
+
+// splitPeer is one peer's view of the two relays. relayFor maps the foreign
+// flag to a relay name; postDelay is how long after the rendezvous that peer's
+// OpenConn takes to return (its per-relay subscribe latency). Different values
+// per peer model the asymmetric timing that triggers finding #1.
+type splitPeer struct {
+	rv        *rendezvous
+	relayFor  map[bool]string
+	postDelay map[string]time.Duration
+}
+
+func (p *splitPeer) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
+	relay := p.relayFor[foreign]
+
+	select {
+	case <-p.rv.arrive(relay):
+	case <-ctx.Done():
+		return raceAttempt{err: ctx.Err()}
+	}
+
+	timer := time.NewTimer(p.postDelay[relay])
+	defer timer.Stop()
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		return raceAttempt{err: ctx.Err()}
+	}
+	return raceAttempt{conn: &raceFakeConn{label: relay}}
+}
+
+// TestFallbackOpener_SplitRelaySelection reproduces finding #1: the two peers
+// run FallbackOpener.Run independently with no shared tie-break, so the winner
+// is chosen purely by local result-arrival order. Under an adversarial - but
+// self-consistent - timing profile they settle on DIFFERENT relays.
+//
+// Both peers prefer relayA (the controller's home). The split needs each peer's
+// preferred relayA to be slow enough that both start their fallback (so both
+// relays actually rendezvous), and then each peer's fast path to be a different
+// relay:
+//   - peerA: relayA slow (abandoned), relayB fast  -> peerA wins relayB
+//   - peerB: relayA fast (wins),      relayB slow  -> peerB wins relayA
+//
+// Each winner then cancels its attempt on the relay the OTHER peer actually
+// kept, leaving two half-open relayed connections that were both reported as
+// successful. When a deterministic cross-peer tie-break is added to fix this,
+// invert the assertion below to require convergence.
+func TestFallbackOpener_SplitRelaySelection(t *testing.T) {
+	const (
+		relayA = "relayA" // controller's home relay; both peers prefer it
+		relayB = "relayB" // non-controller's home relay
+	)
+	rv := newRendezvous()
+
+	peerA := &splitPeer{
+		rv:       rv,
+		relayFor: map[bool]string{false: relayA, true: relayB}, // home=relayA
+		postDelay: map[string]time.Duration{
+			relayA: 500 * time.Millisecond, // preferred but slow -> abandoned
+			relayB: 10 * time.Millisecond,  // fallback is fast -> peerA wins relayB
+		},
+	}
+	peerB := &splitPeer{
+		rv:       rv,
+		relayFor: map[bool]string{false: relayB, true: relayA}, // home=relayB
+		postDelay: map[string]time.Duration{
+			relayA: 80 * time.Millisecond,  // preferred, wins - but only after starting fallback
+			relayB: 500 * time.Millisecond, // fallback (home) is slow -> abandoned
+		},
+	}
+
+	fallbackDelay := 30 * time.Millisecond
+	newPeerOpener := func(p *splitPeer) *FallbackOpener {
+		o := NewFallbackOpener(nil, nil)
+		o.openFn = p.open
+		o.fallbackDelay = fallbackDelay
+		o.totalTimeout = 5 * time.Second
+		return o
+	}
+	oA := newPeerOpener(peerA)
+	oB := newPeerOpener(peerB)
+
+	type result struct {
+		conn net.Conn
+		err  error
+	}
+	var ra, rb result
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		ra.conn, ra.err = oA.Run(context.Background(), "peerB", RelayServer{Addr: relayB}, preferHome)
+	}()
+	go func() {
+		defer wg.Done()
+		rb.conn, rb.err = oB.Run(context.Background(), "peerA", RelayServer{Addr: relayA}, preferForeign)
+	}()
+	wg.Wait()
+
+	require.NoError(t, ra.err)
+	require.NoError(t, rb.err)
+	aRelay := ra.conn.(*raceFakeConn).label
+	bRelay := rb.conn.(*raceFakeConn).label
+	t.Logf("peerA settled on %s, peerB settled on %s", aRelay, bRelay)
+
+	assert.Equal(t, aRelay, bRelay,
+		"peers selected different relays with no cross-peer tie-break")
+	assert.Equal(t, relayB, aRelay, "peerA abandoned its slow preferred relay and won the fallback")
+	assert.Equal(t, relayA, bRelay, "peerB won its preferred relay after starting the fallback")
+}
--- a/shared/relay/client/foreign_relays_store.go
+++ b/shared/relay/client/foreign_relays_store.go
@@ -0,0 +1,155 @@
+package client
+
+import (
+	"context"
+	"net"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/singleflight"
+
+	relayAuth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
+)
+
+type foreignRelay struct {
+	client  *Client
+	created time.Time
+	inUse   int
+}
+
+type ForeignRelaysStore struct {
+	mu      sync.RWMutex
+	clients map[string]*foreignRelay
+
+	group singleflight.Group
+
+	ctx                  context.Context
+	tokenStore           *relayAuth.TokenStore
+	peerID               string
+	mtu                  uint16
+	transportFallback    *transportFallback
+	onDisconnect         func(string)
+	keepUnusedServerTime time.Duration
+}
+
+func NewForeignRelaysStore(ctx context.Context, tokenStore *relayAuth.TokenStore, peerID string, mtu uint16, transportFallback *transportFallback, onDisconnect func(string), keepUnusedServerTime time.Duration) *ForeignRelaysStore {
+	return &ForeignRelaysStore{
+		clients:              make(map[string]*foreignRelay),
+		ctx:                  ctx,
+		tokenStore:           tokenStore,
+		peerID:               peerID,
+		mtu:                  mtu,
+		transportFallback:    transportFallback,
+		onDisconnect:         onDisconnect,
+		keepUnusedServerTime: keepUnusedServerTime,
+	}
+}
+
+func (f *ForeignRelaysStore) OpenConn(ctx context.Context, peerKey string, remoteRelayServer RelayServer) (net.Conn, error) {
+	fr, err := f.acquire(remoteRelayServer)
+	if err != nil {
+		return nil, err
+	}
+	defer f.release(fr)
+
+	return fr.client.OpenConn(ctx, peerKey)
+}
+
+func (f *ForeignRelaysStore) acquire(remoteRelayServer RelayServer) (*foreignRelay, error) {
+	f.mu.Lock()
+	if fr, ok := f.clients[remoteRelayServer.Addr]; ok {
+		fr.inUse++
+		f.mu.Unlock()
+		return fr, nil
+	}
+	f.mu.Unlock()
+
+	v, err, _ := f.group.Do(remoteRelayServer.Addr, func() (any, error) {
+		f.mu.RLock()
+		fr, ok := f.clients[remoteRelayServer.Addr]
+		f.mu.RUnlock()
+		if ok {
+			return fr, nil
+		}
+
+		relayClient := NewClientWithServerIP(remoteRelayServer.Addr, remoteRelayServer.IP, f.tokenStore, f.peerID, f.mtu)
+		relayClient.SetTransportFallback(f.transportFallback)
+		if err := relayClient.Connect(f.ctx); err != nil {
+			return nil, err
+		}
+		relayClient.SetOnDisconnectListener(f.onDisconnect)
+
+		f.mu.Lock()
+		fr = &foreignRelay{client: relayClient, created: time.Now()}
+		f.clients[remoteRelayServer.Addr] = fr
+		f.mu.Unlock()
+		return fr, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	fr := v.(*foreignRelay)
+	f.mu.Lock()
+	if cur, ok := f.clients[remoteRelayServer.Addr]; !ok || cur != fr {
+		f.mu.Unlock()
+		return f.acquire(remoteRelayServer)
+	}
+	fr.inUse++
+	f.mu.Unlock()
+	return fr, nil
+}
+
+func (f *ForeignRelaysStore) release(fr *foreignRelay) {
+	f.mu.Lock()
+	fr.inUse--
+	f.mu.Unlock()
+}
+
+func (f *ForeignRelaysStore) evict(serverAddress string) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.clients[serverAddress]; ok {
+		delete(f.clients, serverAddress)
+		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
+	}
+}
+
+func (f *ForeignRelaysStore) cleanupUnused() {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	for addr, fr := range f.clients {
+		if time.Since(fr.created) <= f.keepUnusedServerTime {
+			continue
+		}
+		if fr.inUse > 0 {
+			continue
+		}
+		if fr.client.HasConns() {
+			continue
+		}
+		fr.client.SetOnDisconnectListener(nil)
+		go func() {
+			_ = fr.client.Close()
+		}()
+		log.Debugf("clean up unused relay server connection: %s", addr)
+		delete(f.clients, addr)
+	}
+}
+
+func (f *ForeignRelaysStore) states() []RelayConnState {
+	f.mu.RLock()
+	clients := make([]*Client, 0, len(f.clients))
+	for _, fr := range f.clients {
+		clients = append(clients, fr.client)
+	}
+	f.mu.RUnlock()
+
+	states := make([]RelayConnState, 0, len(clients))
+	for _, c := range clients {
+		states = append(states, relayConnState(c))
+	}
+	return states
+}
--- a/shared/relay/client/manager.go
+++ b/shared/relay/client/manager.go
@@ -22,27 +22,6 @@ var (
 	ErrRelayClientNotConnected = fmt.Errorf("relay client not connected")
 )

-// RelayTrack hold the relay clients for the foreign relay servers.
-// With the mutex can ensure we can open new connection in case the relay connection has been established with
-// the relay server.
-type RelayTrack struct {
-	sync.RWMutex
-	relayClient *Client
-	err         error
-	created     time.Time
-	// ready is closed once the dial started by openConnVia finishes (relayClient
-	// or err is set). Callers reusing a track wait on this instead of the track
-	// lock, so the dial never runs under rt.Lock.
-	ready chan struct{}
-}
-
-func NewRelayTrack() *RelayTrack {
-	return &RelayTrack{
-		created: time.Now(),
-		ready:   make(chan struct{}),
-	}
-}
-
 type OnServerCloseListener func()

 // ManagerOption configures a Manager at construction time.
@@ -59,6 +38,11 @@ type RelayConnState struct {
 	Err error
 }

+type RelayServer struct {
+	Addr string
+	IP   netip.Addr
+}
+
 // WithMaxBackoffInterval caps the exponential backoff between reconnect
 // attempts to the home relay. A non-positive value keeps the default.
 func WithMaxBackoffInterval(d time.Duration) ManagerOption {
@@ -83,8 +67,7 @@ type Manager struct {
 	relayClientMu  sync.RWMutex
 	reconnectGuard *Guard

-	relayClients      map[string]*RelayTrack
-	relayClientsMutex sync.RWMutex
+	foreign *ForeignRelaysStore

 	onDisconnectedListeners map[string]*list.List
 	onReconnectedListenerFn func()
@@ -120,7 +103,6 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 			ConnectionTimeout: defaultConnectionTimeout,
 			TransportFallback: tf,
 		},
-		relayClients:            make(map[string]*RelayTrack),
 		onDisconnectedListeners: make(map[string]*list.List),
 		cleanupInterval:         relayCleanupInterval,
 		keepUnusedServerTime:    keepUnusedServerTime,
@@ -128,6 +110,7 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 	for _, opt := range opts {
 		opt(m)
 	}
+	m.foreign = NewForeignRelaysStore(ctx, tokenStore, peerID, mtu, tf, m.onServerDisconnected, m.keepUnusedServerTime)
 	m.serverPicker.ServerURLs.Store(serverURLs)
 	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval)
 	return m
@@ -159,40 +142,26 @@ func (m *Manager) Serve() error {
 	return err
 }

-// OpenConn opens a connection to the given peer key. If the peer is on the same relay server, the connection will be
-// established via the relay server. If the peer is on a different relay server, the manager will establish a new
-// connection to the relay server. It returns back with a net.Conn what represent the remote peer connection.
-//
-// serverIP, when valid and serverAddress is foreign, is used as a dial target if the FQDN-based dial fails.
-// Ignored for the local home-server path. TLS verification still uses the FQDN via SNI.
-func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
+func (m *Manager) OpenConn(ctx context.Context, remoteRelayServer RelayServer, peerKey string, preferForeign bool) (net.Conn, error) {
 	m.relayClientMu.RLock()
-	defer m.relayClientMu.RUnlock()
+	relayClient := m.relayClient
+	m.relayClientMu.RUnlock()

-	if m.relayClient == nil {
+	if relayClient == nil {
 		return nil, ErrRelayClientNotConnected
 	}

-	foreign, err := m.isForeignServer(serverAddress)
+	foreign, err := m.isForeignServer(relayClient, remoteRelayServer.Addr)
 	if err != nil {
 		return nil, err
 	}

-	var (
-		netConn net.Conn
-	)
 	if !foreign {
-		log.Debugf("open peer connection via permanent server: %s", peerKey)
-		netConn, err = m.relayClient.OpenConn(ctx, peerKey)
-	} else {
-		log.Debugf("open peer connection via foreign server: %s", serverAddress)
-		netConn, err = m.openConnVia(ctx, serverAddress, peerKey, serverIP)
-	}
-	if err != nil {
-		return nil, err
+		return relayClient.OpenConn(ctx, peerKey)
 	}

-	return netConn, err
+	opener := NewFallbackOpener(relayClient, m.foreign)
+	return opener.Run(ctx, peerKey, remoteRelayServer, preferForeign)
 }

 // Ready returns true if the home Relay client is connected to the relay server.
@@ -223,7 +192,7 @@ func (m *Manager) AddCloseListener(serverAddress string, onClosedListener OnServ
 		return ErrRelayClientNotConnected
 	}

-	foreign, err := m.isForeignServer(serverAddress)
+	foreign, err := m.isForeignServer(m.relayClient, serverAddress)
 	if err != nil {
 		return err
 	}
@@ -287,26 +256,7 @@ func (m *Manager) RelayStates() []RelayConnState {
 		states = append(states, st)
 	}

-	// Snapshot the tracks, then query each outside the map lock: a track can be
-	// held by an in-progress Connect, and blocking on it must not stall other
-	// relay operations.
-	m.relayClientsMutex.RLock()
-	tracks := make([]*RelayTrack, 0, len(m.relayClients))
-	for _, rt := range m.relayClients {
-		tracks = append(tracks, rt)
-	}
-	m.relayClientsMutex.RUnlock()
-
-	// Only connected foreign relays carry state; a failed connect is evicted
-	// immediately (openConnVia), so there is no error state to surface.
-	for _, rt := range tracks {
-		rt.RLock()
-		rc := rt.relayClient
-		rt.RUnlock()
-		if rc != nil {
-			states = append(states, relayConnState(rc))
-		}
-	}
+	states = append(states, m.foreign.states()...)

 	return states
 }
@@ -327,76 +277,6 @@ func (m *Manager) UpdateToken(token *relayAuth.Token) error {
 	return m.tokenStore.UpdateToken(token)
 }

-func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
-	// check if already has a connection to the desired relay server
-	m.relayClientsMutex.RLock()
-	rt, ok := m.relayClients[serverAddress]
-	m.relayClientsMutex.RUnlock()
-	if ok {
-		return m.openConnOnTrack(ctx, rt, peerKey)
-	}
-
-	// if not, establish a new connection but check it again (because changed the lock type) before starting the
-	// connection
-	m.relayClientsMutex.Lock()
-	rt, ok = m.relayClients[serverAddress]
-	if ok {
-		m.relayClientsMutex.Unlock()
-		return m.openConnOnTrack(ctx, rt, peerKey)
-	}
-
-	// Publish the track and release the map lock BEFORE dialing, so the dial does
-	// not run under rt.Lock (which would block RelayStates and the cleanup loop
-	// for the full dial). Concurrent callers find this track and wait on rt.ready.
-	rt = NewRelayTrack()
-	m.relayClients[serverAddress] = rt
-	m.relayClientsMutex.Unlock()
-
-	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
-	relayClient.SetTransportFallback(m.transportFallback)
-	err := relayClient.Connect(m.ctx)
-	if err != nil {
-		rt.Lock()
-		rt.err = err
-		rt.Unlock()
-		close(rt.ready)
-		m.relayClientsMutex.Lock()
-		delete(m.relayClients, serverAddress)
-		m.relayClientsMutex.Unlock()
-		return nil, err
-	}
-	// if connection closed then delete the relay client from the list
-	relayClient.SetOnDisconnectListener(m.onServerDisconnected)
-	rt.Lock()
-	rt.relayClient = relayClient
-	rt.Unlock()
-	close(rt.ready)
-
-	return relayClient.OpenConn(ctx, peerKey)
-}
-
-// openConnOnTrack opens a peer connection through an existing relay track,
-// waiting for the dial started by another openConnVia call to finish. It waits
-// on rt.ready rather than the track lock, so it neither holds nor contends the
-// track lock across the dial.
-func (m *Manager) openConnOnTrack(ctx context.Context, rt *RelayTrack, peerKey string) (net.Conn, error) {
-	select {
-	case <-rt.ready:
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-
-	rt.RLock()
-	defer rt.RUnlock()
-	if rt.err != nil {
-		return nil, rt.err
-	}
-	if rt.relayClient == nil {
-		return nil, ErrRelayClientNotConnected
-	}
-	return rt.relayClient.OpenConn(ctx, peerKey)
-}
-
 func (m *Manager) onServerConnected() {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()
@@ -422,21 +302,12 @@ func (m *Manager) onServerDisconnected(serverAddress string) {
 	m.relayClientMu.Unlock()

 	if !isHome {
-		m.evictForeignRelay(serverAddress)
+		m.foreign.evict(serverAddress)
 	}

 	m.notifyOnDisconnectListeners(serverAddress)
 }

-func (m *Manager) evictForeignRelay(serverAddress string) {
-	m.relayClientsMutex.Lock()
-	defer m.relayClientsMutex.Unlock()
-	if _, ok := m.relayClients[serverAddress]; ok {
-		delete(m.relayClients, serverAddress)
-		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
-	}
-}
-
 func (m *Manager) listenGuardEvent(ctx context.Context) {
 	for {
 		select {
@@ -459,8 +330,8 @@ func (m *Manager) storeClient(client *Client) {
 	m.relayClient.SetOnDisconnectListener(m.onServerDisconnected)
 }

-func (m *Manager) isForeignServer(address string) (bool, error) {
-	rAddr, err := m.relayClient.ServerInstanceURL()
+func (m *Manager) isForeignServer(relayClient *Client, address string) (bool, error) {
+	rAddr, err := relayClient.ServerInstanceURL()
 	if err != nil {
 		return false, fmt.Errorf("relay client not connected")
 	}
@@ -475,50 +346,11 @@ func (m *Manager) startCleanupLoop() {
 		case <-m.ctx.Done():
 			return
 		case <-ticker.C:
-			m.cleanUpUnusedRelays()
+			m.foreign.cleanupUnused()
 		}
 	}
 }

-func (m *Manager) cleanUpUnusedRelays() {
-	m.relayClientsMutex.Lock()
-	defer m.relayClientsMutex.Unlock()
-
-	for addr, rt := range m.relayClients {
-		rt.Lock()
-		// if the connection failed to the server the relay client will be nil
-		// but the instance will be kept in the relayClients until the next locking
-		if rt.err != nil {
-			rt.Unlock()
-			continue
-		}
-
-		// dial still in progress (openConnVia publishes the track before Connect
-		// completes and no longer holds rt.Lock during it), nothing to clean up.
-		if rt.relayClient == nil {
-			rt.Unlock()
-			continue
-		}
-
-		if time.Since(rt.created) <= m.keepUnusedServerTime {
-			rt.Unlock()
-			continue
-		}
-
-		if rt.relayClient.HasConns() {
-			rt.Unlock()
-			continue
-		}
-		rt.relayClient.SetOnDisconnectListener(nil)
-		go func() {
-			_ = rt.relayClient.Close()
-		}()
-		log.Debugf("clean up unused relay server connection: %s", addr)
-		delete(m.relayClients, addr)
-		rt.Unlock()
-	}
-}
-
 func (m *Manager) addListener(serverAddress string, onClosedListener OnServerCloseListener) {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()
--- a/shared/relay/client/manager_cleanup_test.go
+++ b/shared/relay/client/manager_cleanup_test.go
@@ -2,17 +2,14 @@ package client

 import (
 	"context"
-	"net/netip"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/require"
 )

 // TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial drives a real, hanging foreign
-// relay dial and asserts cleanUpUnusedRelays does not stall behind it.
+// relay dial and asserts the foreign store cleanup does not stall behind it.
 func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr := stallingRelayListener(t)
+	serverAddr, accepted := stallingRelayListener(t)

 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -22,39 +19,32 @@ func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
+		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
 	}()

-	// The track appears in the map once the dial is in flight.
-	require.Eventually(t, func() bool {
-		m.relayClientsMutex.RLock()
-		defer m.relayClientsMutex.RUnlock()
-		_, ok := m.relayClients[serverAddr]
-		return ok
-	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
+	select {
+	case <-accepted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("relay dial did not reach the listener")
+	}

 	cleanupDone := make(chan struct{})
 	go func() {
 		defer close(cleanupDone)
-		m.cleanUpUnusedRelays()
+		m.foreign.cleanupUnused()
 	}()

 	select {
 	case <-cleanupDone:
 	case <-time.After(2 * time.Second):
-		t.Fatal("cleanUpUnusedRelays blocked on an in-progress relay dial while holding the relay map lock")
+		t.Fatal("cleanupUnused blocked on an in-progress relay dial")
 	}

-	m.relayClientsMutex.RLock()
-	_, stillTracked := m.relayClients[serverAddr]
-	m.relayClientsMutex.RUnlock()
-	require.True(t, stillTracked, "an in-progress relay dial must not be evicted by cleanup")
-
 	// Release the hanging dial so the goroutine can exit cleanly.
 	mCancel()
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("openConnVia did not return after context cancellation")
+		t.Fatal("foreign OpenConn did not return after context cancellation")
 	}
 }
--- a/shared/relay/client/manager_relaystates_test.go
+++ b/shared/relay/client/manager_relaystates_test.go
@@ -3,7 +3,6 @@ package client
 import (
 	"context"
 	"net"
-	"net/netip"
 	"sync"
 	"testing"
 	"time"
@@ -13,13 +12,16 @@ import (

 // stallingRelayListener accepts TCP connections and holds them open without ever
 // responding, so a relay handshake dialed against it blocks until its context is
-// cancelled. It returns the "rel://host:port" URL to dial.
-func stallingRelayListener(t *testing.T) string {
+// cancelled. accepted is signalled once per incoming connection so a caller can
+// wait until a dial has actually reached the listener. It returns the
+// "rel://host:port" URL to dial.
+func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
 	t.Helper()

 	ln, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)

+	accepted := make(chan struct{}, 1)
 	var mu sync.Mutex
 	var conns []net.Conn
 	go func() {
@@ -31,6 +33,10 @@ func stallingRelayListener(t *testing.T) string {
 			mu.Lock()
 			conns = append(conns, c)
 			mu.Unlock()
+			select {
+			case accepted <- struct{}{}:
+			default:
+			}
 		}
 	}()
 	t.Cleanup(func() {
@@ -42,14 +48,14 @@ func stallingRelayListener(t *testing.T) string {
 		mu.Unlock()
 	})

-	return "rel://" + ln.Addr().String()
+	return "rel://" + ln.Addr().String(), accepted
 }

 // TestRelayStates_DoesNotBlockOnRealHangingDial is a regression test for
 // RelayStates() called by a "status -d command" hanging behind an in-progress
-// relay dial.
+// foreign relay dial.
 func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr := stallingRelayListener(t)
+	serverAddr, accepted := stallingRelayListener(t)

 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -59,15 +65,14 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
+		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
 	}()

-	require.Eventually(t, func() bool {
-		m.relayClientsMutex.RLock()
-		defer m.relayClientsMutex.RUnlock()
-		_, ok := m.relayClients[serverAddr]
-		return ok
-	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
+	select {
+	case <-accepted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("relay dial did not reach the listener")
+	}

 	done := make(chan []RelayConnState, 1)
 	go func() {
@@ -86,6 +91,6 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("openConnVia did not return after context cancellation")
+		t.Fatal("foreign OpenConn did not return after context cancellation")
 	}
 }
--- a/shared/relay/client/manager_serverip_test.go
+++ b/shared/relay/client/manager_serverip_test.go
@@ -3,7 +3,6 @@ package client
 import (
 	"context"
 	"io"
-	"net/netip"
 	"testing"
 	"time"

@@ -85,7 +84,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 	t.Run("no server IP, dial fails", func(t *testing.T) {
 		dialCtx, dialCancel := context.WithTimeout(ctx, 5*time.Second)
 		defer dialCancel()
-		_, err := mgrAlice.OpenConn(dialCtx, brokenFQDN, "bob", netip.Addr{})
+		_, err := mgrAlice.OpenConn(dialCtx, RelayServer{Addr: brokenFQDN}, "bob", true)
 		if err == nil {
 			t.Fatalf("expected OpenConn to fail without server IP, got success")
 		}
@@ -95,7 +94,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 		// Bob waits for Alice's incoming peer connection on his side.
 		bobSideCh := make(chan error, 1)
 		go func() {
-			conn, err := mgrBob.OpenConn(ctx, bobRealAddr, "alice", netip.Addr{})
+			conn, err := mgrBob.OpenConn(ctx, RelayServer{Addr: bobRealAddr}, "alice", false)
 			if err != nil {
 				bobSideCh <- err
 				return
@@ -113,7 +112,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 			bobSideCh <- nil
 		}()

-		aliceConn, err := mgrAlice.OpenConn(ctx, brokenFQDN, "bob", bobAdvertisedIP)
+		aliceConn, err := mgrAlice.OpenConn(ctx, RelayServer{Addr: brokenFQDN, IP: bobAdvertisedIP}, "bob", true)
 		if err != nil {
 			t.Fatalf("alice OpenConn with server IP: %s", err)
 		}
--- a/shared/relay/client/manager_test.go
+++ b/shared/relay/client/manager_test.go
@@ -3,7 +3,6 @@ package client
 import (
 	"context"
 	"fmt"
-	"net/netip"
 	"testing"
 	"time"

@@ -106,11 +105,11 @@ func TestForeignConn(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to get relay address: %s", err)
 	}
-	connAliceToBob, err := clientAlice.OpenConn(ctx, bobsSrvAddr, "bob", netip.Addr{})
+	connAliceToBob, err := clientAlice.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "bob", true)
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
-	connBobToAlice, err := clientBob.OpenConn(ctx, bobsSrvAddr, "alice", netip.Addr{})
+	connBobToAlice, err := clientBob.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "alice", false)
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -210,7 +209,7 @@ func TestForeginConnClose(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
-	conn, err := mgr.OpenConn(ctx, toURL(srvCfg2)[0], "bob", netip.Addr{})
+	conn, err := mgr.OpenConn(ctx, RelayServer{Addr: toURL(srvCfg2)[0]}, "bob", true)
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -302,7 +301,7 @@ func TestForeignAutoClose(t *testing.T) {
 	}

 	t.Log("open connection to another peer")
-	if _, err = mgr.OpenConn(ctx, foreignServerURL, "anotherpeer", netip.Addr{}); err == nil {
+	if _, err = mgr.OpenConn(ctx, RelayServer{Addr: foreignServerURL}, "anotherpeer", true); err == nil {
 		t.Fatalf("should have failed to open connection to another peer")
 	}

@@ -372,7 +371,7 @@ func TestAutoReconnect(t *testing.T) {
 	if err != nil {
 		t.Errorf("failed to get relay address: %s", err)
 	}
-	conn, err := clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
+	conn, err := clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
 	if err != nil {
 		t.Errorf("failed to bind channel: %s", err)
 	}
@@ -392,7 +391,7 @@ func TestAutoReconnect(t *testing.T) {
 	}

 	log.Infof("reopent the connection")
-	_, err = clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
+	_, err = clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
 	if err != nil {
 		t.Errorf("failed to open channel: %s", err)
 	}
@@ -454,7 +453,7 @@ func TestNotifierDoubleAdd(t *testing.T) {
 		t.Fatalf("failed to serve manager: %s", err)
 	}

-	conn1, err := clientAlice.OpenConn(ctx, clientAlice.ServerURLs()[0], "bob", netip.Addr{})
+	conn1, err := clientAlice.OpenConn(ctx, RelayServer{Addr: clientAlice.ServerURLs()[0]}, "bob", false)
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
Author	SHA1	Message	Date
Theodor S. Midtlien	8a46353ae2	Add tests	2026-07-21 15:40:39 +02:00
Zoltán Papp	d663da8f82	Merge branch 'main' into refactor/relay-foreign-cache # Conflicts: # shared/relay/client/manager.go	2026-07-21 11:27:09 +02:00
Zoltan Papp	cf101c44b4	[relay] Count winning attempt before draining losers The success path in handleResult left settled at 0, so drainLoser waited on a result that was already consumed and blocked forever, leaking a goroutine and the results channel on every successful race. Increment settled before stop() so drainLoser only waits for actual started losers.	2026-07-02 12:22:01 +02:00
Zoltan Papp	79b51a79e4	[relay] Release home relay lock before the connection race OpenConn held relayClientMu for the whole call, including the network-bound FallbackOpener.Run, which blocked onServerDisconnected/storeClient from taking the write lock and delayed reconnect by up to the race timeout. Snapshot the home relay client under the read lock, release it, and run the foreign check and the race on the snapshot. isForeignServer now takes the client so it uses the snapshot instead of re-reading the field after the lock is dropped.	2026-07-01 19:22:41 +02:00
Zoltan Papp	a737504ec9	Fix timeout	2026-07-01 17:11:23 +02:00
Zoltan Papp	3b1beb3497	[relay] Return raceOutcome struct from handleResult to avoid nilnil handleResult returned (net.Conn, error, bool) and produced (nil, nil, false) on the non-terminal path, which the nilnil linter rejects. Return a raceOutcome{conn, err, done} struct instead so the not-done case carries no ambiguous nil value / nil error pair.	2026-07-01 17:05:46 +02:00
Zoltan Papp	49c0aeb6ce	[relay] Update relay client tests for the new OpenConn signature Manager.OpenConn now takes a RelayServer struct and a preferForeign flag instead of a server address string and a serverIP. Adjust the manager tests accordingly: bundle addr/IP into RelayServer and set preferForeign=true for foreign-relay dials, false for home-relay dials.	2026-07-01 17:00:20 +02:00
Zoltan Papp	6774a43eae	[relay] Rename ConnRacer to FallbackOpener and align file names with types Rename the ConnRacer type to FallbackOpener and its constructor to NewFallbackOpener. Rename fallback.go to fallback_opener.go and foreign_relays.go to foreign_relays_store.go so file names mirror their primary struct.	2026-07-01 16:53:42 +02:00
Zoltan Papp	50a29c07ce	[relay] Race home and foreign relay for peer connection setup When a peer advertises a relay different from the home relay, open the peer connection by racing the home relay and the remote peer's relay in parallel: start the preferred one (controller prefers home, otherwise the remote relay), fall back to the other after a delay, use whichever connects first and drain the loser. Expose the foreign relay cache as ForeignRelaysStore and the race as ConnRacer. The manager passes the remote relay as a RelayServer{Addr, IP}. OpenConn no longer returns the winning server address; the worker derives it from the returned conn's RemoteAddr to register the close listener, matching the previous main-branch behavior.	2026-06-30 18:26:13 +02:00
Zoltan Papp	7d8e20030b	[relay] Extract foreign relay client cache into a dedicated type Move the foreign-relay client cache out of Manager into a foreignRelays type. Concurrent first-time connects to the same server are deduplicated with singleflight, so the cache mutex is never held during a network connect (removing the previous stall where a slow connect blocked all map operations). A per-entry in-use refcount prevents the cleanup loop from closing a client while a connection is being opened on it. This drops RelayTrack, its per-track lock and the hand-over-hand locking between the map lock and the track lock. The exported API is unchanged.	2026-06-29 00:41:47 +02:00