Tailscale endpoint never resumes control session after control-plane outage (restart required)

Operating system

Linux

System version

Ubuntu 22.04

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

$ sing-box version
sing-box version 1.13.15

Description of the problem

A sing-box Tailscale endpoint does not resume its control session after the control plane (headscale in our case) goes away mid-flight and comes back. The endpoint stays offline in headscale nodes list indefinitely (observed 4+ minutes; never recovers) until sing-box itself is restarted. Mesh traffic to/from the node is dead for the whole duration.

Boundaries we verified:

• Fresh-booted endpoints self-connect fine — after the node's own reboot, the sing-box endpoint registers and comes online within seconds. The bug is specifically that an endpoint which survives a control-plane outage never retries.
• Real tailscaled clients (Android, macOS) reconnect to the restarted control plane on their own, as expected.
• systemctl restart sing-box on the affected node restores the session immediately (reconnect + P2P direct path back).

This makes any control-plane restart (headscale upgrade, host reboot) a manual-remediation event for every sing-box endpoint in the mesh, unlike real tailscaled.

Possibly related sibling behavior: sing-box endpoints also cache their netmap and do not pick up headscale-side renames/deletions without a restart.

Reproduction

1. Self-hosted headscale + two sing-box 1.13.15 tailscale endpoints (auth via ephemeral auth key), plus one real tailscaled client.
2. Restart headscale (or reboot the headscale host).
3. Observe: real tailscaled clients come back online on their own; sing-box endpoints stay offline in headscale nodes list forever; mesh pings to them fail.
4. systemctl restart sing-box on an endpoint node → instantly online again.

Expected: sing-box endpoints retry the control connection with backoff, like tailscaled does.

Logs

No response

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of belief in my own intelligence.
• I confirm that I have provided the simplest and most minimal reproduction, rather than a huge and complex setup.

Start by reproducing the outage with headscale and two sing-box Tailscale endpoints, then trace the endpoint's control-session handling and retry behavior. Done means an endpoint that survives a control-plane restart reconnects with backoff, returns online, and restores mesh traffic without restarting sing-box.