A field report showed a working WireGuard key rejected by the health
gate: launching all three HTTPS probes at once pushed six DNS queries
plus three TCP sessions through a slow tunnel, so the endpoint probes
hit their 4s socket timeout and the 3s in-tunnel resolves failed with
DNS-101 while hijack-dns exchanges were succeeding in ~500ms. Probes
now start with a 1s stagger (happy eyeballs) to avoid the burst, and
when the whole race still fails one sequential rescue probe runs with
doubled timeouts (5s resolve, 8s socket) — a slow-but-alive tunnel
connects with a "recovered=slow_tunnel" stage detail, a dead one still
fails within the 20s health deadline with the rescue outcome recorded.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
e72e3eedf9