netvm-topology.sh: relay check by connectivity, not pidfiles

Pidfiles go stale and lie. Primary verdict now curls the veth IP:port. Also pins registry CDP ports (hash-derived CDP_PORT was wrong).

Session: sidechat/chromebox-ops

bin/netvm-topology.sh

@@ -12,12 +12,25 @@ for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
   printf 'node=%s netns=%s ifaces=%s/%s handshake=%s egress=%s\n' "$NODE" "$ns" "$WG" "$VETH" "$hs" "${egress:-?}"
 done
 iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "(no netvm NAT rules on host)"
-echo "--- CDP relays ---"
+echo "--- CDP relays (connectivity check; pidfile is secondary) ---"
 for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
   netvm_names "${ns#warp-}"
-  if [ -f "/run/netvm-${NODE}-cdp-relay.pid" ] && kill -0 "$(cat "/run/netvm-${NODE}-cdp-relay.pid")" 2>/dev/null; then
-    echo "$NODE: relay up ($PEER_IP:$CDP_PORT -> 127.0.0.1:$CDP_PORT)"
+  # Registry-pinned CDP ports (same mapping as cdp-relay-watchdog.sh).
+  # NOTE: $CDP_PORT from netvm_names() is hash-derived and WRONG here unless
+  # CDP_PORT_OVERRIDE was set at provision time — the pinned mapping is truth.
+  case "$NODE" in
+    muse) port=9410 ;; pip) port=9420 ;; 646) port=9430 ;; opm) port=9440 ;;
+    *) port="$CDP_PORT" ;;
+  esac
+  target="$PEER_IP:$port"
+  pidfile="/run/netvm-${NODE}-cdp-relay.pid"
+  # PRIMARY verdict: actual connectivity to the relay on the veth IP.
+  # pidfiles go stale (dead/recycled PIDs) and lied about status — 2026-10-04.
+  if curl -s -m 5 "http://$target/json/version" 2>/dev/null | grep -q '"Browser"'; then
+    echo "$NODE: relay UP ($target -> 127.0.0.1:$port)"
+  elif [ -f "$pidfile" ] && kill -0 "$(cat "$pidfile" 2>/dev/null)" 2>/dev/null; then
+    echo "$NODE: relay DOWN on $target (process alive per pidfile but not responding — stale/misrouted?)"
   else
-    echo "$NODE: relay DOWN"
+    echo "$NODE: relay DOWN on $target (no relay process; pidfile missing or stale)"
   fi
 done