@@ -61,8 +61,8 @@ impl AdminRpcHandler {
             .kv_store()
             .get_best_zt_domain()
             .unwrap_or_default();
-        // Snapshot routing fields only. KV readers can wait behind a sync merge;
-        // neither those waits nor a cold wg query may hold the routing mutex.
+        // KV reads can wait behind a sync merge, so do them after releasing
+        // the routing lock.
         let mut hosts = {
             let state = self.state.lock();
             state
@@ -97,6 +97,8 @@ impl AdminRpcHandler {
             nodes: self.state.get_all_nodes(),
             hosts,
             num_connections: NUM_CONNECTIONS.load(Ordering::Relaxed),
+            // Reads the post-probe config, so this is what the data path is
+            // running rather than what the file asked for.
             accel: Some(accel_status(&config.proxy)),
             health_gating: config.proxy.health_check.enabled,
         })
 
@@ -291,13 +291,6 @@ impl ProxyInner {
         self.state.lock().or_panic("Failed to lock AppState")
     }
 
-    /// For tests that assert a handler does its slow work off this lock: the
-    /// only way to observe how long it is held is to compete for it.
-    #[cfg(test)]
-    pub(crate) fn routing_lock_is_free(&self) -> bool {
-        self.state.try_lock().is_ok()
-    }
-
     /// WireGuard handshake ages, without taking the routing lock.
     ///
     /// The cache is its own synchronization, so a caller that only needs
@@ -317,13 +310,8 @@ impl ProxyInner {
 
     /// Publish this node's WireGuard observations to the KV store.
     ///
-    /// The routing lock is taken only to copy the public-key-to-instance-id
-    /// map, never to write. Each write takes the KV store's own write lock,
-    /// which a sync round holds for as long as it takes to merge an inbound
-    /// envelope; composing the two would let one peer's merge stall every
-    /// proxied connection for the length of it. `Admin.Status` calls this, and
-    /// `web_routes::route_index` calls `Admin.Status`, so the composition is
-    /// reachable from a dashboard page load.
+    /// The KV writes wait on the store's write lock, which a sync merge holds,
+    /// so they must not run under the routing lock.
     pub(crate) fn refresh_state(&self) -> Result<()> {
         let handshakes = self.latest_handshakes(None)?;
         let instance_ids: Vec<(String, u64)> = {
@@ -2570,11 +2558,8 @@ impl ProxyState {
         Ok(())
     }
 
-    /// Drop instances the cluster has stopped seeing.
-    ///
-    /// Reads the handshake observations `ProxyInner::refresh_state` publishes,
-    /// so the caller refreshes first -- off this lock, because the refresh
-    /// writes to the KV store.
+    /// Drop instances the cluster has stopped seeing. The caller runs
+    /// `ProxyInner::refresh_state` first, off this lock.
     fn recycle(&mut self) -> Result<()> {
         // Note: Gateway nodes are not removed from KvStore, only marked offline/retired
 
@@ -2804,4 +2789,4 @@ impl RpcCall<Proxy> for RpcHandler {
 }
 
 #[cfg(test)]
-pub(crate) mod tests;
+mod tests;
@@ -51,24 +51,9 @@ impl LatestHandshakesCache {
         self.cell.set(timestamps);
     }
 
-    /// The cached snapshot, never a freshly produced one.
-    ///
-    /// The routing path reaches this from `select_top_n_hosts` once per
-    /// proxied connection, holding the `ProxyState` mutex every tenant's
-    /// traffic takes. Producing a value here means forking `wg show` under
-    /// that lock -- and the cell only ever fills on success, so a host where
-    /// `wg show` cannot work (wrong `core.wg.interface`, no WireGuard module,
-    /// a container without `CAP_NET_ADMIN`) would fork once per inbound
-    /// connection, for as long as the traffic lasts. The producer runs in
-    /// [`Self::refresh`] and in the periodic task instead, both off the
-    /// routing path and on the blocking pool.
-    ///
-    /// Serving an expired snapshot rather than nothing is deliberate: every
-    /// consumer compares handshake *age* against its own threshold, so a stale
-    /// snapshot ages the whole fleet uniformly, while an empty map reads as
-    /// "no instance has ever handshaked" and would drain routing on the first
-    /// refresh that fails. Empty is only what a node that has never had a
-    /// snapshot actually knows.
+    /// The cached snapshot, stale if need be; never runs `wg show`. Callers
+    /// hold the routing lock, and a host where `wg show` always fails would
+    /// otherwise fork once per connection.
     pub(crate) fn latest(&self, stale_timeout: Option<Duration>) -> Result<HandshakesWithAge> {
         let timestamps = match self.cell.get_allow_stale() {
             Ok(snapshot) => snapshot.into_value(),
@@ -146,14 +131,6 @@ fn add_elapsed_time(
 mod tests {
     use super::*;
 
-    /// A cold cache must not fork a process on the routing path.
-    ///
-    /// `latest` is reached from `select_top_n_hosts` while `ProxyState`'s mutex
-    /// is held, once per proxied connection. A host where `wg show` can never
-    /// succeed -- a misconfigured `core.wg.interface`, no WireGuard module, a
-    /// container without `CAP_NET_ADMIN` -- never fills the cell, so a `latest`
-    /// that produces its own value forks once per inbound connection while
-    /// holding the lock every tenant's traffic takes.
     #[test]
     fn a_cold_cache_does_not_shell_out_on_the_routing_path() {
         const CONNECTIONS: usize = 500;
@@ -181,23 +158,6 @@ mod tests {
         );
     }
 
-    /// An expired snapshot still routes.
-    ///
-    /// Consumers threshold on handshake *age*, so serving a stale map ages the
-    /// whole fleet uniformly. Returning nothing instead would read as "no
-    /// instance has ever handshaked" and drain routing on the first refresh
-    /// that fails.
-    #[test]
-    fn an_expired_snapshot_is_still_served() {
-        let cache = LatestHandshakesCache::new("dstack-no-such-iface0".to_string(), Duration::ZERO);
-        cache.set_for_test(BTreeMap::from([("pubkey-a".to_string(), 1730190589)]));
-
-        assert!(cache
-            .latest(None)
-            .expect("an expired snapshot still answers")
-            .contains_key("pubkey-a"));
-    }
-
     #[test]
     fn parses_latest_handshake_timestamps() {
         let handshakes = parse_latest_handshake_timestamps(
 
@@ -12,8 +12,8 @@ use base64::Engine as _;
 use std::sync::atomic::Ordering;
 use tempfile::TempDir;
 
-pub(crate) struct TestState {
-    pub(crate) proxy: Proxy,
+struct TestState {
+    proxy: Proxy,
     _temp_dir: TempDir,
 }
 
@@ -24,7 +24,7 @@ impl std::ops::Deref for TestState {
     }
 }
 
-pub(crate) async fn create_test_state() -> TestState {
+async fn create_test_state() -> TestState {
     create_test_state_with(|_| {}).await
 }
 
@@ -2680,23 +2680,14 @@ fn tombstone_collection_triggers_on_write_count_boundaries_not_on_time() {
     assert!(!tombstone_collection_due(Some(w(100, 0)), w(90, 0), 100));
 }
 
-/// `Admin.Status` must not park the data plane on the KV store's write lock.
-///
-/// `refresh_state` publishes this node's handshake observations: one ephemeral
-/// write per instance plus one for the node itself. Those take the KV store's
-/// own write lock, which a sync round holds for as long as it takes to merge
-/// an inbound envelope -- megabytes, from a peer. Running the writes under
-/// `ProxyState` composes the two locks, so one slow merge stalls every proxied
-/// connection, and `web_routes::route_index` reaches this on a dashboard page
-/// load.
+/// A sync merge holding the KV store must not stall routing via `refresh_state`.
 #[tokio::test]
 async fn refreshing_state_leaves_the_routing_lock_free_while_it_writes_to_the_kv_store() {
     use std::sync::atomic::AtomicBool;
 
     let state = create_test_state().await;
 
-    // Stand in for a sync round holding the store: every write in
-    // `refresh_state` now blocks.
+    // Stand in for a sync merge holding the store.
     let _store_held = state.kv_store().ephemeral().write();
 
     let finished = std::sync::Arc::new(AtomicBool::new(false));