#606 lezama single-path fragility: all 5435 probes since May23 are public-dns with zt_whey_visible=0 (ZeroTier fallback never worked); make ZT a real 2nd route + fix phantom ssh_r_active self-report

#606 · llmmsg-srv · child of #608

lezama single-path fragility: all 5435 probes since May23 are public-dns with zt_whey_visible=0 (ZeroTier fallback never worked); make ZT a real 2nd route + fix phantom ssh_r_active self-report

Ref: #606 (#606)
Project: llmmsg-srv
Parent: backlog #608 lezama host-dark recurrence: root-cause + harden against full-dark (2nd occurrence; died 2026-06-01 18:03 ART, clean cliff)
Status: backlog
Priority: normal
Type: task
Assigned: nw-whey-cc
Created by: —
Created: 2026-06-02T00:42:52.811Z
Updated: 2026-06-02T05:00:03.216Z

No sub-items.

No questions.

2026-06-02T00:42:52.812Z · created

wi cli; parent=#531
2026-06-02T00:45:59.271Z · parentChanged

parent=#608
2026-06-02T05:00:03.216Z · Re-scope forced by the GCABA single-path truth (see #615): the original goal 'add ZeroTier 2nd path lezama->whey' is INFEASIBLE - GCABA blocks ZeroTier AND all public egress on lezama, so there is NO 2nd path to build. DROP the 2nd-path goal. Remaining valid scope: (1) remove/expose the PHANTOM ssh_r_active self-report in host_probes (can report tunnel up when whey has no live listener); (2) fix host_probes transport_path mislabel (lezama rows say 'public-dns' but the real carrier is the -R tunnel over the VPN); (3) document single-path-is-permanent so future agents stop proposing path diversity. Real resilience levers given single-path: tunnel hardening (#588), host-dark detection (#605), out-of-band reset for host-death (#607).