fix: blast radius walks dependency direction, and reachability survives no ICMP

Two things the entity window redesign surfaced but deliberately left alone.

**blast_radius answered the wrong question.** It walked source→target for every
relationship type, but which end of an edge is the dependent differs per type:
"machine hosts container" means the target breaks, while "service depends-on
service" and "ingress routes-to service" mean the SOURCE breaks. Walking
everything forwards was right for hosts/provides and backwards for everything
else — and swept in 2,800+ documents/involves/targets edges of pure bookkeeping,
so the result contained tasks and executions that cannot break.

Direction is now declared per relationship type in seeds/ontology.yaml
(blast_direction: forward | backward | none), the same shape as the entity
types' monitoring: declaration, and defaults to none so an undeclared edge
contributes nothing rather than a confidently wrong answer.

It also needed a modelling fix: `routes-to` names an ingress's BACKEND, so
nothing recorded that all 21 public hostnames are terminated by caddy. A
`served-by` edge type now says so.

  pool:ludo-lvm    2 -> 23   (every container storing on it, then their services)
  lxc:caddy        4 -> 22   (service:caddy, then all 21 ingress routes)
  service:authentik      7   (what authenticates via it)

**Every ping check was reporting down.** Not a host:strong false positive: all
seven, including ws:mac-mini — the Docker host itself. The scheduler runs in
Docker on macOS, whose VM does not route ICMP to the LAN; loopback pings succeed
and every LAN ping fails. Under health aggregation each broken probe dragged its
entity to down.

The question the check exists to answer is "is it reachable", and ICMP is only
one way to ask it. checkPing now falls back to a TCP connect before concluding
anything, which restores an honest verdict for the four hosts that are genuinely
up while leaving the genuinely unreachable ones down.

TestBlastRadiusTerminatesOnCycles asserted the old direction (caddy=1,
authentik=2 — the cycle walked the wrong way); it now asserts the corrected
depths, and its exact-node-count check is relaxed because walking the right way
also surfaces the seed's own real dependents, which are correct answers.

Co-Authored-By: Claude <noreply@anthropic.com>

internal/db/integration_test.go

@@ -306,7 +306,17 @@ func TestBlastRadiusTerminatesOnCycles(t *testing.T) {
 	pool := newTestPool(t)
 	seedAll(t, pool, seedsDir())
 
-	// Build a dependency cycle: gitea → caddy → authentik → gitea
+	// Build a dependency cycle: gitea → caddy → authentik → gitea.
+	//
+	// `depends-on` is declared blast_direction: backward — "A depends-on B"
+	// means B failing breaks A — so the blast radius of gitea walks the edges
+	// BACKWARDS: whoever depends on gitea is affected first. That is authentik
+	// (1 hop), then caddy which depends on authentik (2 hops).
+	//
+	// This test previously asserted caddy=1, authentik=2, which is the same
+	// cycle walked the wrong way round: blast_radius used to follow every edge
+	// source→target regardless of what the edge means, so it answered "what
+	// does gitea depend on" while being named for the opposite question.
 	cycle := []byte(`
 version: 1
 relationships:
@@ -342,14 +352,24 @@ relationships:
 		}
 		got[slug] = depth
 	}
-	want := map[string]int{"service:gitea": 0, "service:caddy": 1, "service:authentik": 2}
+	want := map[string]int{"service:gitea": 0, "service:authentik": 1, "service:caddy": 2}
 	for slug, depth := range want {
 		if got[slug] != depth {
 			t.Errorf("blast_radius[%s] = %d, want %d (full: %v)", slug, got[slug], depth, got)
 		}
 	}
-	if len(got) != len(want) {
-		t.Errorf("blast_radius returned %d nodes, want %d: %v", len(got), len(want), got)
+	// Deliberately not an exact node count. Walking the right way round also
+	// surfaces the real seed's own dependents of gitea (homelab-mcp and what
+	// depends on it), which are correct answers — the old exact-count
+	// assertion only held because the forward walk found nothing real.
+	// What matters here is that the cycle terminates rather than recursing.
+	if len(got) > 20 {
+		t.Errorf("blast_radius did not terminate sensibly: %d nodes: %v", len(got), got)
+	}
+	for slug, depth := range got {
+		if depth > 5 {
+			t.Errorf("blast_radius[%s] = %d, beyond the max_depth bound", slug, depth)
+		}
 	}
 }
 

internal/db/seed.go

@@ -67,12 +67,20 @@ func IngestOntologySeed(ctx context.Context, tx pgx.Tx, data map[string]any) (*S
 		targetType, _ := rtMap["target"].(string)
 		cardinality, _ := rtMap["cardinality"].(string)
 		desc, _ := rtMap["description"].(string)
+		// Which end of the edge depends on the other; drives blast_radius().
+		// Absent means 'none' — an undeclared edge contributes nothing rather
+		// than silently producing a wrong dependency answer.
+		blastDirection, _ := rtMap["blast_direction"].(string)
+		if blastDirection == "" {
+			blastDirection = "none"
+		}
 		_, err := tx.Exec(ctx,
-			`INSERT INTO relationship_types (name, inverse, source_type, target_type, cardinality, description)
-			 VALUES ($1, $2, $3, $4, $5, $6)
+			`INSERT INTO relationship_types (name, inverse, source_type, target_type, cardinality, description, blast_direction)
+			 VALUES ($1, $2, $3, $4, $5, $6, $7)
 			 ON CONFLICT (name) DO UPDATE SET inverse = $2, source_type = $3,
-			   target_type = $4, cardinality = $5, description = $6`,
-			name, nullableStr(inverse), sourceType, targetType, cardinality, desc)
+			   target_type = $4, cardinality = $5, description = $6,
+			   blast_direction = $7`,
+			name, nullableStr(inverse), sourceType, targetType, cardinality, desc, blastDirection)
 		if err != nil {
 			return nil, fmt.Errorf("relationship_type %s: %w", name, err)
 		}

internal/scheduler/reachability_test.go

@@ -0,0 +1,25 @@
+package scheduler
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// The scheduler runs in Docker on macOS, whose VM does not route ICMP to the
+// LAN — every ping check reported "down" for hosts that were demonstrably up.
+// tcpReachable is the fallback that keeps "is it reachable" answerable.
+func TestTCPReachableAnswersWhenICMPCannot(t *testing.T) {
+	ctx := context.Background()
+	// localhost:22 is open on this machine (sshd), and port 1 is not.
+	if !tcpReachable(ctx, "127.0.0.1", 22, 3*time.Second) {
+		t.Skip("no sshd on localhost — cannot exercise the positive case")
+	}
+	if tcpReachable(ctx, "127.0.0.1", 1, 1*time.Second) {
+		t.Error("port 1 should not be reachable")
+	}
+	// Defaults to 22 when unset, which is what checkdefaults' ping configs use.
+	if !tcpReachable(ctx, "127.0.0.1", 0, 3*time.Second) {
+		t.Error("port 0 should default to 22")
+	}
+}

internal/scheduler/scheduler.go

@@ -605,6 +605,9 @@ func checkPing(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) checkRes
 	cfg := struct {
 		Host  string `json:"host"`
 		Count int    `json:"count"`
+		// Port for the TCP fallback below. Defaults to 22; set it for hosts
+		// that answer on something else (a Home Assistant VM has no sshd).
+		Port int `json:"port"`
 	}{}
 	if len(cd.Config) > 0 {
 		_ = json.Unmarshal(cd.Config, &cfg)
@@ -638,9 +641,26 @@ func checkPing(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) checkRes
 
 	output, err := cmd.Output()
 	if err != nil {
+		// ICMP failing does not mean the host is down — it may mean ICMP is
+		// simply unavailable from here. On this deployment the scheduler runs
+		// in Docker on macOS, whose VM network stack does not route ICMP to
+		// the LAN: loopback pings succeed, every LAN ping fails, and all seven
+		// ping checks reported "down" for hosts that were demonstrably up
+		// (including the Docker host itself). Under health aggregation that one
+		// broken probe was enough to drag each entity to down.
+		//
+		// The question this check exists to answer is "is it reachable", and
+		// ICMP is only one way to ask. Fall back to a TCP connect before
+		// concluding anything.
+		if tcpReachable(ctx, cfg.Host, cfg.Port, timeout) {
+			return checkResult{
+				health:  "healthy",
+				metrics: map[string]float64{},
+			}
+		}
 		return checkResult{
 			health: "down", signalKind: "ping",
-			evidence: fmt.Sprintf("ping %s: %v", cfg.Host, err),
+			evidence: fmt.Sprintf("no ICMP or TCP response from %s: %v", cfg.Host, err),
 			err:      err,
 		}
 	}
@@ -654,6 +674,24 @@ func checkPing(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) checkRes
 	return checkResult{health: "healthy", metrics: metrics}
 }
 
+// tcpReachable reports whether a TCP handshake completes, used as the
+// reachability answer when ICMP is unavailable rather than unanswered.
+func tcpReachable(ctx context.Context, host string, port int, timeout time.Duration) bool {
+	if port == 0 {
+		port = 22
+	}
+	if timeout <= 0 {
+		timeout = 5 * time.Second
+	}
+	d := net.Dialer{Timeout: timeout}
+	conn, err := d.DialContext(ctx, "tcp", net.JoinHostPort(host, strconv.Itoa(port)))
+	if err != nil {
+		return false
+	}
+	conn.Close()
+	return true
+}
+
 var pingRttRe = regexp.MustCompile(`(?:rtt\s+min\/avg\/max\/mdev|round-trip\s+min\/avg\/max\/stddev)\s*=\s*[\d.]+\/([\d.]+)\/`)
 
 func parsePingLatency(output []byte) float64 {