review fixes: migration must not feed the recovery tracker

The tracker's entries close on the next provider-originated ingress
for the destination -- and after a migration the OLD exit is alive and
delivering until the server validates the new path, so every entry
closed milliseconds later as a fake ~0s recovery and a fake
rebindsAccepted: the two headline metrics this program is judged by,
corrupted by the mechanism built to improve them. Migration arms
nothing now; the [rel] migrate line is its field signal.

Also: remaining counts flows genuinely still riding the exit (the
pre-sweep subtraction counted stale book entries as stayers), and the
seam wiring is pinned by source anchors -- deleting the two wiring
lines previously failed no test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Ryanmello07

ip_remote_multi_client.go

@@ -2966,10 +2966,15 @@ func (self *RemoteUserNatMultiClient) migrateClientFlows(client *multiClientChan
 		}
 
 		rebindable := []*multiClientChannelUpdate{}
+		// pointing counts entries whose flow genuinely still rides this exit;
+		// stale entries (already re-raced away, or mid-re-race nil) belong to
+		// nobody's remaining count and are cleaned up by the send path
+		pointing := 0
 		for update := range updates {
 			if update.client.Load() != client {
 				continue
 			}
+			pointing += 1
 			// removeClient's partition: established quic moves; everything
 			// else stays -- here, stays ALIVE on the draining exit
 			if 0 < len(candidates) &&
@@ -2979,39 +2984,45 @@ func (self *RemoteUserNatMultiClient) migrateClientFlows(client *multiClientChan
 				rebindable = append(rebindable, update)
 			}
 		}
-		remaining = len(updates) - len(rebindable)
 		if len(rebindable) == 0 || len(candidates) == 0 {
-			remaining = len(updates)
+			remaining = pointing
 			return
 		}
 
-		var unplaced []*multiClientChannelUpdate
-		reboundFlows, replacements, unplaced = self.rebindFlowsWithLock(client, rebindable, candidates)
+		reboundFlows, replacements, _ = self.rebindFlowsWithLock(client, rebindable, candidates)
 		// unlike the removal, unplaced flows are NOT torn down: they stay
 		// registered on the alive exit and keep working
-		remaining += len(unplaced)
 
 		// the moved flows leave the draining exit's book, so the cap, the
 		// flowless check, and the eventual close's teardown all see the
 		// truth. rebindFlowsWithLock stored the replacement into each moved
 		// update's client, so "moved" is exactly "no longer points here" --
 		// the same catch-up bindClientFlow performs on the send path,
-		// inlined because bindClientFlow takes this lock.
+		// inlined because bindClientFlow takes this lock. After the sweep,
+		// the book holds exactly the flows still riding this exit, which is
+		// the honest remaining count (the pre-sweep subtraction counted
+		// stale entries as stayers; review finding, 2026-08-03).
 		for update := range updates {
 			if update.client.Load() != client {
 				delete(updates, update)
 			}
 		}
+		remaining = len(updates)
 		if len(updates) == 0 {
 			delete(self.clientUpdates, client)
 		}
 	}()
 	rebound = len(reboundFlows)
 
-	// recorded outside stateLock, same as the removal path: the tracker
-	// classifies each move by whether the destination keeps answering the
-	// same local port (migration accepted) or a new one (the app re-dialed)
-	self.reliabilityMetrics.exitLostRebound(reboundFlows)
+	// The recovery tracker is deliberately NOT armed here, unlike the
+	// removal path. Its entries close on the next provider-originated
+	// ingress for the destination -- and after a migration the OLD exit is
+	// still alive and still delivering until the server validates the new
+	// path, so every entry would close milliseconds later as a fake ~0s
+	// "recovery" and a fake rebindsAccepted, systematically corrupting the
+	// two headline metrics this program is judged by (review finding,
+	// 2026-08-03 -- the shipped-metric-measures-the-wrong-thing class). The
+	// [rel] migrate line below is this mechanism's field signal.
 
 	if 0 < rebound {
 		loggerOrDefault(self.log).Infof("%s\n", relEvent(

ip_remote_multi_client_rotation_test.go

@@ -312,8 +312,18 @@ func TestDrainBranchWarnsUnconditionally(t *testing.T) {
 	// retirement stays a deadline teardown
 	drainAt := strings.Index(body, `printStats("client drain")`)
 	rest := body[drainAt:]
-	if !strings.Contains(rest[:strings.Index(rest, "} else")], "markDrainMigrateOnce()") {
-		t.Error("the drain branch does not run the once-latched migration: retirement tears down movable flows at the deadline instead of handing them off")
+	drainBranch := rest[:strings.Index(rest, "} else")]
+	if !strings.Contains(drainBranch, "markDrainMigrateOnce()") {
+		t.Error("the drain branch does not latch the migration: retirement would migrate every resize pass, or never")
+	}
+	if !strings.Contains(drainBranch, "self.clientMigrateFunc(client)") {
+		t.Error("the drain branch does not call the migration seam: retirement tears down movable flows at the deadline instead of handing them off")
+	}
+	// and the seam is actually WIRED by the parent for both windows -- a
+	// correct-but-unwired seam is the failure mode this suite pins against,
+	// and deleting the two wiring lines would otherwise fail no test
+	if got := strings.Count(source, "clientMigrateFunc = multiClient.migrateClientFlows"); got < 2 {
+		t.Errorf("the migration seam is wired %d time(s), want 2 (quality and speed windows): an unwired seam makes every drain a deadline teardown again", got)
 	}
 	if got := nextWarningCall(`printStats("client health warning")`); got != "setWarning(remove, warnUnhealthy)" {
 		t.Errorf("the health-warning branch warns with %q, want the rank-derived setWarning(remove, warnUnhealthy)", got)