Count half-open inbound connections as auto-standby activity

[sjmiller609]

Summary

Fixes a race where auto-standby pauses a VM while a client is connecting to it. Since wake-on-traffic does not exist, that connection then hangs until the client gives up.

SYN_SENT now counts as inbound activity (TCPState.Active()). A freshly restored guest can take several seconds to answer the SYN it was woken for; previously the mid-handshake flow was invisible to the idle tracker, so the idle timer could fire during the handshake and put the VM straight back into standby with the request in flight.

Trade-off

A half-open inbound flow that never completes (e.g. the client vanishes without RST) now keeps the VM awake until conntrack expires the entry (nf_conntrack_tcp_timeout_syn_sent, default 120s). ignore_source_cidrs/ignore_destination_ports still apply.

Testing

• Unit tests: SYN_SENT counted via both the event path and snapshot classification. go test ./lib/autostandby/ passes.
• New e2e test TestAutoStandbyCloudHypervisorHalfOpenInboundTCP (adapted from the existing auto-standby e2e): boots nginx in a cloud-hypervisor VM, drops the guest's replies in the raw table so the host-side flow stays in SYN_SENT while the client retransmits, and asserts the VM stays running past the idle timeout; then lifts the drop, completes the handshake, and confirms the normal idle→standby path still works. Verified on a Linux/KVM host: both this test and the pre-existing TestAutoStandbyCloudHypervisorActiveInboundTCP pass (HYPEMAN_RUN_AUTO_STANDBY_E2E=1). Without the fix the half-open flow never counts as activity and the VM standbys mid-handshake.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes when VMs enter standby (lifecycle-critical); stuck half-open inbound TCP can delay standby for up to conntrack’s SYN_SENT timeout.

Overview
Fixes a race where auto-standby could pause a VM while a client was still connecting—problematic because there is no wake-on-traffic, so the in-flight request would hang.

TCPState.Active() now treats SYN_SENT like other live inbound states, so host-side conntrack flows for clients mid-handshake (including a freshly restored guest that has not answered the SYN yet) keep the VM running through both event handling and snapshot classification. Docs note this behavior and the trade-off that a stuck half-open flow can hold the VM awake until conntrack expires the entry.

Tests add classifier/controller coverage for SYN_SENT, refactor shared auto-standby e2e setup, and add TestAutoStandbyCloudHypervisorHalfOpenInboundTCP, which drops guest replies with iptables so the flow stays half-open past the idle timeout and asserts the VM stays up until the handshake completes and the normal idle→standby path still works.

^{Reviewed by Cursor Bugbot for commit 0fa9fd6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9b90d2b. Configure here.}