[ToddHebebrand]

Closes #9372

What changed

• services/system/connections/turnPreflight.ts: pure RFC 5766 Allocate builder (type 0x0003, no MESSAGE-INTEGRITY) and response classifier (401 / Allocate Success / other error / invalid), plus a UDP dgram transport behind an injectable seam. No new dependency.
• Runs once at API startup, detached after serve() (never rejects, never delays boot). warn logs [turn-preflight] with the text that clients will never get a relay candidate; timeout/socket error is info, not a failure; no TURN_HOST is skipped.
• Exposed on the existing platform-admin System → Connections routes: GET /admin/system/connections/turn (cached startup result) and POST /admin/system/connections/turn/probe (re-probe). Host and raw error text are never echoed.
• Docs (deploy/turn-server.mdx): image runs as nobody (uid 65534) so a bind-mounted config must be world-readable or owned by 65534; WARNING: Cannot find config file means defaults; troubleshooting entry for the no-relay-candidate symptom.

Gates

• Red first (module missing / routes 404), then green: vitest run turnPreflight (16), systemConnectionsTurn (4), existing systemConnections + Probe suites: 4 files, 37 tests pass.
• tsc --noEmit -p tsconfig.src.json: exit 0. (The full tsconfig.json, which includes tests, OOMs at 12 GB on this host; not caused by this change.)
• Real coturn (brew), UDP loopback: default-config server → warn; --use-auth-secret server → ok (401); closed port → info (timeout).

Merge Danger

Door: two-way; revert removes a diagnostic.
Blast radius: one outbound UDP packet to the operator-configured TURN host at boot; no session behaviour change.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	040fb85
Status:	✅  Deploy successful!
Preview URL:	https://03457d8f.breeze-9te.pages.dev
Branch Preview URL:	https://fix-9372-turn-unauth-allocat.breeze-9te.pages.dev

View logs

[ToddHebebrand]

Review run: /pr-review-toolkit:review-pr (code-reviewer, silent-failure-hunter, pr-test-analyzer)
Findings: code-reviewer 0 high-confidence. silent-failure-hunter 3 minor (DNS failure indistinguishable from socket error, unguarded socket.close(), no .catch on the fire-and-forget call): all fixed in 040fb85, plus an info log line. pr-test-analyzer 6 gaps (no real-transport test, unrealistic fixture lengths, padded-attribute walk, wrong-txid success, port parsing, cache replace): fixed in 040fb85. Deferred: refreshing (lifetime 0) the allocation a warn probe creates (expires on coturn's default ~10 min), and IPv6-only TURN_HOST (reports info, never a false warn/ok).
Tests: turnPreflight + systemConnectionsTurn: 40 passed (2 files); tsc --noEmit -p tsconfig.src.json exit 0. Real coturn: default config → warn, secret-enforcing → ok, closed port → info.
Status: review-clean, awaiting maintainer merge.