fix: address PR review feedback for delete_handle

- Check rows_affected() on DELETE; return 404 if zero (prevents silent
no-op when handle is concurrently removed after DNS deletion)
- Add tracing::warn\! when dns_provider is None so operators know DNS
was not cleaned up
- Add dns_record_name and did to Step 4 error log; add did + clarified
message to Step 5 error log
- Move AlwaysOkDns/AlwaysErrDns/state_with_ok_dns/state_with_err_dns
to routes/test_utils.rs; update create_handle.rs and delete_handle.rs
to import from there
- Fix alphabetical import ordering in app.rs and routes/mod.rs
- Add delete_handle.rs row to relay/CLAUDE.md route table
- Strengthen delete_record doc; update dns.rs module comment

crates/relay/CLAUDE.md

···
 | `get_did.rs` | `GET /v1/dids/:did` |
 | `create_account.rs` | `POST /v1/accounts` |
 | `create_handle.rs` | `POST /v1/handles` |
+| `delete_handle.rs` | `DELETE /v1/handles/:handle` |
 | `create_mobile_account.rs` | `POST /v1/accounts/mobile` |
 | `create_signing_key.rs` | `POST /v1/signing-keys` |
 | `register_device.rs` | `POST /v1/devices` |

crates/relay/src/app.rs

···
 use crate::routes::create_did::create_did_handler;
 use crate::routes::create_handle::create_handle_handler;
 use crate::routes::create_mobile_account::create_mobile_account;
-use crate::routes::delete_handle::delete_handle_handler;
 use crate::routes::create_session::create_session;
 use crate::routes::create_signing_key::create_signing_key;
+use crate::routes::delete_handle::delete_handle_handler;
 use crate::routes::delete_session::delete_session;
 use crate::routes::describe_server::describe_server;
 use crate::routes::get_device_relay::get_device_relay;

crates/relay/src/dns.rs

···
 // DNS abstractions for handle management.
 //
-// DnsProvider — creates DNS records when handles are registered (POST /v1/handles).
+// DnsProvider — manages DNS records for handles:
+//   - create_record: called when handles are registered (POST /v1/handles).
+//   - delete_record: called when handles are removed (DELETE /v1/handles/:handle).
 //   For v0.1, AppState carries `dns_provider: None`; operators manage DNS manually.
 //   Real provider implementations (Cloudflare, Route53) are wired in when configured.
 //
···
     /// Delete the DNS record for `name` (a subdomain label, e.g. `"alice"`).
     ///
     /// Called when a handle is deleted. The provider is responsible for locating
-    /// the record by name within its configured zone.
+    /// and removing the record within its configured zone.
+    ///
+    /// Callers are responsible for extracting the label portion from the full handle
+    /// before invoking this method (e.g. pass `"alice"`, not `"alice.example.com"`).
     fn delete_record<'a>(
         &'a self,
         name: &'a str,

crates/relay/src/routes/create_handle.rs

···
 mod tests {
     use super::*;
     use crate::app::test_state;
+    use crate::routes::test_utils::{state_with_err_dns, state_with_ok_dns};
     use crate::routes::token::generate_token;
     use axum::{
         body::Body,
         http::{Request, StatusCode},
     };
-    use std::future::Future;
-    use std::pin::Pin;
-    use std::sync::Arc;
     use tower::ServiceExt;
     use uuid::Uuid;
 
···
         let domains = vec!["example.com".to_string()];
         let name = "a".repeat(63);
         assert!(validate_handle(&format!("{name}.example.com"), &domains).is_ok());
-    }
-
-    // ── DNS provider test doubles ──────────────────────────────────────────────
-
-    struct AlwaysOkDns;
-    struct AlwaysErrDns;
-
-    impl crate::dns::DnsProvider for AlwaysOkDns {
-        fn create_record<'a>(
-            &'a self,
-            _name: &'a str,
-            _target: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Ok(()) })
-        }
-
-        fn delete_record<'a>(
-            &'a self,
-            _name: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Ok(()) })
-        }
-    }
-
-    impl crate::dns::DnsProvider for AlwaysErrDns {
-        fn create_record<'a>(
-            &'a self,
-            _name: &'a str,
-            _target: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
-        }
-
-        fn delete_record<'a>(
-            &'a self,
-            _name: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
-        }
-    }
-
-    async fn state_with_ok_dns() -> crate::app::AppState {
-        let base = test_state().await;
-        crate::app::AppState {
-            dns_provider: Some(Arc::new(AlwaysOkDns)),
-            ..base
-        }
-    }
-
-    async fn state_with_err_dns() -> crate::app::AppState {
-        let base = test_state().await;
-        crate::app::AppState {
-            dns_provider: Some(Arc::new(AlwaysErrDns)),
-            ..base
-        }
     }
 
     // ── Integration test helpers ───────────────────────────────────────────────

crates/relay/src/routes/delete_handle.rs

···
 //      (DNS deletion precedes DB deletion: a DB row without a DNS record is operator-fixable;
 //       a DNS record without a DB row is an invisible orphan that can corrupt future
 //       registrations for the same subdomain)
-//   5. DELETE FROM handles WHERE handle = ?
+//      If state.dns_provider is None: emit tracing::warn! (no DNS cleanup performed)
+//   5. DELETE FROM handles WHERE handle = ?; check rows_affected() → 404 HANDLE_NOT_FOUND if zero
 //   6. Return 204 No Content
 //
 // Outputs (success):  204 No Content
···
     // DNS deletion precedes DB deletion: a DB row without a DNS record is operator-fixable
     // (admin can retry), whereas a DNS record without a DB row is an invisible orphan that
     // could corrupt a future handle registration for the same subdomain.
+    let name = handle.split_once('.').map(|(n, _)| n).unwrap_or(&handle);
     if let Some(provider) = &state.dns_provider {
-        let name = handle.split_once('.').map(|(n, _)| n).unwrap_or(&handle);
         provider.delete_record(name).await.map_err(|e| {
             tracing::error!(
                 error = %e,
                 handle = %handle,
+                dns_record_name = %name,
                 did = %session.did,
                 "DNS record deletion failed"
             );
             ApiError::new(ErrorCode::DnsError, "failed to delete DNS record")
         })?;
+    } else {
+        tracing::warn!(
+            handle = %handle,
+            did = %session.did,
+            "no DNS provider configured; DNS record for handle was not cleaned up"
+        );
     }
 
-    // Step 5: Delete the handle row.
-    sqlx::query("DELETE FROM handles WHERE handle = ?")
+    // Step 5: Delete the handle row; 404 if the row was concurrently removed.
+    let result = sqlx::query("DELETE FROM handles WHERE handle = ?")
         .bind(&handle)
         .execute(&state.db)
         .await
         .map_err(|e| {
-            tracing::error!(error = %e, handle = %handle, "failed to delete handle row");
+            tracing::error!(
+                error = %e,
+                handle = %handle,
+                did = %session.did,
+                "failed to delete handle row after DNS deletion; manual DB cleanup required"
+            );
             ApiError::new(ErrorCode::InternalError, "failed to delete handle")
         })?;
+
+    if result.rows_affected() == 0 {
+        return Err(ApiError::new(ErrorCode::HandleNotFound, "handle not found"));
+    }
 
     // Step 6: Return 204 No Content.
     Ok(StatusCode::NO_CONTENT)
···
 #[cfg(test)]
 mod tests {
     use crate::app::test_state;
-    use crate::routes::test_utils::seed_handle;
+    use crate::routes::test_utils::{seed_handle, state_with_err_dns, state_with_ok_dns};
     use crate::routes::token::generate_token;
     use axum::{
         body::Body,
         http::{Request, StatusCode},
     };
-    use std::future::Future;
-    use std::pin::Pin;
-    use std::sync::Arc;
     use tower::ServiceExt;
     use uuid::Uuid;
-
-    // ── DNS provider test doubles ──────────────────────────────────────────────
-
-    struct AlwaysOkDns;
-    struct AlwaysErrDns;
-
-    impl crate::dns::DnsProvider for AlwaysOkDns {
-        fn create_record<'a>(
-            &'a self,
-            _name: &'a str,
-            _target: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Ok(()) })
-        }
-
-        fn delete_record<'a>(
-            &'a self,
-            _name: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Ok(()) })
-        }
-    }
-
-    impl crate::dns::DnsProvider for AlwaysErrDns {
-        fn create_record<'a>(
-            &'a self,
-            _name: &'a str,
-            _target: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
-        }
-
-        fn delete_record<'a>(
-            &'a self,
-            _name: &'a str,
-        ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
-            Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
-        }
-    }
-
-    async fn state_with_ok_dns() -> crate::app::AppState {
-        let base = test_state().await;
-        crate::app::AppState {
-            dns_provider: Some(Arc::new(AlwaysOkDns)),
-            ..base
-        }
-    }
-
-    async fn state_with_err_dns() -> crate::app::AppState {
-        let base = test_state().await;
-        crate::app::AppState {
-            dns_provider: Some(Arc::new(AlwaysErrDns)),
-            ..base
-        }
-    }
 
     // ── Test session helpers ───────────────────────────────────────────────────
 

crates/relay/src/routes/mod.rs

···
 pub mod create_did;
 pub mod create_handle;
 pub mod create_mobile_account;
-pub mod delete_handle;
 pub mod create_session;
 pub mod create_signing_key;
+pub mod delete_handle;
 pub mod delete_session;
 pub mod describe_server;
 pub mod get_device_relay;

crates/relay/src/routes/test_utils.rs

···
+use std::future::Future;
+use std::pin::Pin;
 use std::sync::Arc;
 
 use argon2::{
···
 };
 
 use crate::app::{test_state, AppState};
+
+// ── DNS provider test doubles ──────────────────────────────────────────────
+
+/// DNS provider that succeeds on every `create_record` and `delete_record` call.
+pub struct AlwaysOkDns;
+
+/// DNS provider that fails on every `create_record` and `delete_record` call.
+pub struct AlwaysErrDns;
+
+impl crate::dns::DnsProvider for AlwaysOkDns {
+    fn create_record<'a>(
+        &'a self,
+        _name: &'a str,
+        _target: &'a str,
+    ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
+        Box::pin(async { Ok(()) })
+    }
+
+    fn delete_record<'a>(
+        &'a self,
+        _name: &'a str,
+    ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
+        Box::pin(async { Ok(()) })
+    }
+}
+
+impl crate::dns::DnsProvider for AlwaysErrDns {
+    fn create_record<'a>(
+        &'a self,
+        _name: &'a str,
+        _target: &'a str,
+    ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
+        Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
+    }
+
+    fn delete_record<'a>(
+        &'a self,
+        _name: &'a str,
+    ) -> Pin<Box<dyn Future<Output = Result<(), crate::dns::DnsError>> + Send + 'a>> {
+        Box::pin(async { Err(crate::dns::DnsError("simulated provider error".to_string())) })
+    }
+}
+
+/// `test_state()` with an `AlwaysOkDns` provider wired in.
+pub async fn state_with_ok_dns() -> AppState {
+    let base = test_state().await;
+    AppState {
+        dns_provider: Some(Arc::new(AlwaysOkDns)),
+        ..base
+    }
+}
+
+/// `test_state()` with an `AlwaysErrDns` provider wired in.
+pub async fn state_with_err_dns() -> AppState {
+    let base = test_state().await;
+    AppState {
+        dns_provider: Some(Arc::new(AlwaysErrDns)),
+        ..base
+    }
+}
+
+// ── Admin state helper ────────────────────────────────────────────────────────
 
 /// Minimal test state with admin_token set to `"test-admin-token"`.
 ///