lezama single-path fragility: all 5435 probes since May23 are public-dns with zt_whey_visible=0 (ZeroTier fallback never worked); make ZT a real 2nd route + fix phantom ssh_r_active self-report

Sub-tickets

Questions

Activity

• system created · 2026-06-02
  wi cli; parent=#531
• system parentChanged · 2026-06-02
  parent=#608
• system Re-scope forced by the GCABA single-path truth (see #615): the original goal 'add ZeroTier 2nd path lezama->whey' is INFEASIBLE - GCABA blocks ZeroTier AND all public egress on lezama, so there is NO 2nd path to build. DROP the 2nd-path goal. Remaining valid scope: (1) remove/expose the PHANTOM ssh_r_active self-report in host_probes (can report tunnel up when whey has no live listener); (2) fix host_probes transport_path mislabel (lezama rows say 'public-dns' but the real carrier is the -R tunnel over the VPN); (3) document single-path-is-permanent so future agents stop proposing path diversity. Real resilience levers given single-path: tunnel hardening (#588), host-dark detection (#605), out-of-band reset for host-death (#607). · 2026-06-02