Description
Every node-metrics scrape failure classifies uniformly as transient_failure (internal/collector/nodemetrics/nodemetrics.go:121-133). An operator debugging fleet-wide node.up=0 cannot tell “ACL blocks port 5252” from “node down” from “tailscaled too old, no metrics endpoint”. Classify connection-refused / timeout / 404 / non-200 distinctly in the failure-reason attribute and surface a diagnostic hint on the admin status page.
Acceptance Criteria
- #1 Distinct failure classes are emitted for refused, timeout, missing-endpoint and other HTTP errors
- #2 Status page shows per-class counts or a hint for the dominant failure class
Definition of Done
- #1 just check passes (the full gate; it is what CI enforces)
- #2 just gen leaves no diff (only if a generated artifact’s inputs changed)
- #3 just –fmt –check passes and every new recipe has a # doc comment and a [group(…)]
Implementation Plan
Lane D implements bounded nodemetrics failure classification and telemetry in its owned packages, with a real panel in its assigned security tab modules.
Lane D also implements and tests the admin status-page dominant failure hint required by AC2; the dashboard panel and admin surface are separate deliverables.
Final Summary
Classified node scrape failures into refused, timeout, missing-endpoint, HTTP-error and other classes, retained concurrent counters, and exposed the deterministic dominant class on the status page. Implementation SHA f35b6ab. Final integrated just check passed at 5b55617; exact-head CI run 33354208183 completed success.