Show egress/ingress levels in the registry; freeze checks at the verdict

Registry: the "last result" column now also shows, per level (egress,
ingress), how many of the recorded checks of the latest cycle succeeded, split
by check family (tcp-22 and tcp-443 are both "tcp"). One grouped query per
chunk of addresses; new fields last_cycle_id, egress, ingress in
GET /admin/registry; the dashboard renders them under the verdict.

Verdict integrity (migration 0010):
- the prober is handed an address once per site and attempt, not on every
  poll, so results are no longer overwritten by later probe rounds;
- UpsertCheckIfOpen refuses writes once the address is aggregating or has its
  verdict, or for an older attempt; senders get {"ok":true,"ignored":N} and a
  result_dropped event is recorded;
- the checking window counts from checking_started_at, not from assigned_at;
- checks.recorded_at (server clock) and checks.after_verdict (flag for rows
  written after the verdict in existing data);
- the verdict rule is a pure function (computeVerdict) and the aggregated
  event carries the egress/ingress check counts.

Rebuilt bin/control-api and bin/admin-dashboard to match. Plans and summaries
are in docs/changes; README, API, USAGE, DASHBOARD and DIAGRAMS are updated.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/db/queries_ipqueue.go

@@ -180,9 +180,9 @@ func (d *DB) KnownAddresses(ctx context.Context, addresses []string) (map[string
 func (d *DB) SetChecking(ctx context.Context, ipID int64, leaseTTL time.Duration) error {
 	now := Now()
 	_, err := d.ExecContext(ctx, `
-		UPDATE ip_queue SET state=?, lease_expires_at=?, updated_at=?
+		UPDATE ip_queue SET state=?, lease_expires_at=?, checking_started_at=?, updated_at=?
 		WHERE id=?
-	`, IPChecking, timeToDB(now.Add(leaseTTL)), timeToDB(now), ipID)
+	`, IPChecking, timeToDB(now.Add(leaseTTL)), timeToDB(now), timeToDB(now), ipID)
 	return err
 }
 
@@ -295,7 +295,7 @@ func (d *DB) RequeueOrFail(ctx context.Context, ipID int64, validatorID string,
 			UPDATE ip_queue SET
 				state=?, owner_validator_id=NULL, fip_id='', retry_count=?, attempt_number=attempt_number+1,
 				cycle_id=?, lease_expires_at=NULL, egress_complete=0,
-				overall_result='', assigned_at=NULL, fip_associated_at=NULL, updated_at=?
+				overall_result='', assigned_at=NULL, checking_started_at=NULL, fip_associated_at=NULL, updated_at=?
 			WHERE id=?
 		`, nextState, retryCount, cycle, now, ipID)
 	} else {
@@ -394,7 +394,7 @@ func (d *DB) SubmitIPs(ctx context.Context, addresses []string) (SubmitIPsResult
 					state=?, sequence=?, owner_validator_id=NULL, fip_id='', retry_count=0,
 					attempt_number=attempt_number+1, cycle_id=?, lease_expires_at=NULL, egress_complete=0,
 					overall_result='',
-					assigned_at=NULL, fip_associated_at=NULL, aggregated_at=NULL, fip_released_at=NULL, updated_at=?
+					assigned_at=NULL, checking_started_at=NULL, fip_associated_at=NULL, aggregated_at=NULL, fip_released_at=NULL, updated_at=?
 				WHERE ip_address=?
 			`, IPQueued, seq, cycle, now, addr); err != nil {
 				return result, fmt.Errorf("requeue %s: %w", addr, err)
@@ -835,6 +835,24 @@ func (d *DB) ListChecking(ctx context.Context) ([]IPQueueItem, error) {
 	return scanIPQueueItems(rows)
 }
 
+// ListCheckingForSite returns the addresses in the checking state that the
+// given prober site still has to probe: those for which it has not yet
+// reported completion in the current attempt. Without this filter a prober
+// would re-probe every checking address on every poll until the verdict.
+func (d *DB) ListCheckingForSite(ctx context.Context, siteIndex int) ([]IPQueueItem, error) {
+	rows, err := d.QueryContext(ctx, ipQueueSelect+`
+		WHERE state=? AND NOT EXISTS (
+			SELECT 1 FROM ip_site_checks s
+			WHERE s.ip_id=ip_queue.id AND s.attempt_number=ip_queue.attempt_number
+			  AND s.site_idx=? AND s.complete=1)
+		ORDER BY sequence`, IPChecking, siteIndex)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanIPQueueItems(rows)
+}
+
 // ListExpiredLeases returns non-terminal IPs whose lease has expired —
 // candidates for the lease sweep (crash recovery + stuck-validator reclaim).
 func (d *DB) ListExpiredLeases(ctx context.Context, now time.Time) ([]IPQueueItem, error) {
@@ -851,7 +869,7 @@ func (d *DB) ListExpiredLeases(ctx context.Context, now time.Time) ([]IPQueueIte
 const ipQueueSelect = `
 	SELECT id, ip_address, sequence, state, owner_validator_id, fip_id, attempt_number, retry_count,
 		lease_expires_at, egress_complete, overall_result,
-		assigned_at, fip_associated_at, aggregated_at, fip_released_at,
+		assigned_at, checking_started_at, fip_associated_at, aggregated_at, fip_released_at,
 		registry_id, cycle_id, created_at, updated_at
 	FROM ip_queue
 `
@@ -871,14 +889,14 @@ func scanIPQueueItems(rows *sql.Rows) ([]IPQueueItem, error) {
 func scanIPQueueItem(row rowScanner) (*IPQueueItem, error) {
 	var item IPQueueItem
 	var owner sql.NullString
-	var leaseExpires, assignedAt, fipAssociatedAt, aggregatedAt, fipReleasedAt sql.NullString
+	var leaseExpires, assignedAt, checkingStartedAt, fipAssociatedAt, aggregatedAt, fipReleasedAt sql.NullString
 	var registryID sql.NullInt64
 	var createdAt, updatedAt string
 	if err := row.Scan(
 		&item.ID, &item.IPAddress, &item.Sequence, &item.State, &owner, &item.FIPID,
 		&item.AttemptNumber, &item.RetryCount, &leaseExpires,
 		&item.EgressComplete,
-		&item.OverallResult, &assignedAt, &fipAssociatedAt, &aggregatedAt, &fipReleasedAt,
+		&item.OverallResult, &assignedAt, &checkingStartedAt, &fipAssociatedAt, &aggregatedAt, &fipReleasedAt,
 		&registryID, &item.CycleID, &createdAt, &updatedAt,
 	); err != nil {
 		return nil, err
@@ -896,6 +914,9 @@ func scanIPQueueItem(row rowScanner) (*IPQueueItem, error) {
 	if item.AssignedAt, err = nullStringToTimePtr(assignedAt); err != nil {
 		return nil, err
 	}
+	if item.CheckingStartedAt, err = nullStringToTimePtr(checkingStartedAt); err != nil {
+		return nil, err
+	}
 	if item.FIPAssociatedAt, err = nullStringToTimePtr(fipAssociatedAt); err != nil {
 		return nil, err
 	}