fix: Fixes to running on kubernetes

server/internal/proxy/session.go

@@ -37,10 +37,24 @@ type Session struct {
 	reason  string
 	conn    net.Conn
 	closing bool
+	onEnd   func(string)
 
 	rendezvous *time.Timer
 }
 
+// OnEnd registers a callback invoked exactly once, when the session finishes
+// tearing down, with the recorded reason (empty if it ended cleanly).
+//
+// It exists because the process that observes a relay failing is not
+// necessarily the process that has to record it: with several replicas the
+// listener lives on the pod holding the agent's stream, while the audit event
+// belongs to the pod serving the browser's WebSocket.
+func (s *Session) OnEnd(fn func(string)) {
+	s.mu.Lock()
+	s.onEnd = fn
+	s.mu.Unlock()
+}
+
 // NewSession binds an ephemeral port on listenHost. allowed is the set of IPs
 // permitted to connect; an empty set allows any, which is the degraded case
 // when guacd's host could not be resolved.
@@ -112,6 +126,16 @@ func (s *Session) Close(reason string) {
 		if conn != nil {
 			_ = conn.Close()
 		}
+
+		// Read after teardown, not before: relay()'s goroutines set the reason
+		// as they unwind, and reporting one recorded earlier than that would
+		// name the symptom rather than the cause.
+		s.mu.Lock()
+		fn, final := s.onEnd, s.reason
+		s.mu.Unlock()
+		if fn != nil {
+			fn(final)
+		}
 	})
 }