fix(relay): T3 Connect repairs tunnel ingress that drifted from a matching origin - #27961

Eligibility
Tunnel reconciliation now checks live ingress and repairs drift even when the recorded origin already matches. Repairs remain scoped to the validated managed allocation and use the existing guarded configuration-update path.

Additional Thinking

Your Custom Policy

Default approvability criteria apply. The change repairs routing to the already configured origin rather than changing product defaults, and adds no static-analysis suppression directives; neither mandatory-human-review condition is triggered.

Code

Reconciliation now reads live Cloudflare ingress even when the recorded origin matches, and uses the existing claimed-tunnel rewrite to restore the allocated hostname's loopback origin when routing has drifted. Existing allocation, endpoint, tunnel-existence and generation checks bound writes to the managed environment; missing remote configuration is treated as empty ingress.

Review Context

The author is a repository admin and ping-devs member; this is supporting context, not an approval exemption. Four threads were resolved and no unresolved comments or correctness findings were supplied. No check results or blocking-severity configuration were supplied. Two test files were designated ignored.

Verdict

The external configuration write is a bounded restoration through an existing per-allocation reconciliation path, not a broad infrastructure rollout. It preserves the intended endpoint and loopback origin, retains ownership and generation safeguards, and introduces no deletion, permission change or new exposure requiring human judgment.

Notes:
No code owners found in target merge base f6503f0

Agent Credits: 30 credits
Approvability runs at a flat rate of 30 credits whenever the agent is asked for a verdict.