Show egress/ingress levels in the registry; freeze checks at the verdict

Registry: the "last result" column now also shows, per level (egress,
ingress), how many of the recorded checks of the latest cycle succeeded, split
by check family (tcp-22 and tcp-443 are both "tcp"). One grouped query per
chunk of addresses; new fields last_cycle_id, egress, ingress in
GET /admin/registry; the dashboard renders them under the verdict.

Verdict integrity (migration 0010):
- the prober is handed an address once per site and attempt, not on every
  poll, so results are no longer overwritten by later probe rounds;
- UpsertCheckIfOpen refuses writes once the address is aggregating or has its
  verdict, or for an older attempt; senders get {"ok":true,"ignored":N} and a
  result_dropped event is recorded;
- the checking window counts from checking_started_at, not from assigned_at;
- checks.recorded_at (server clock) and checks.after_verdict (flag for rows
  written after the verdict in existing data);
- the verdict rule is a pure function (computeVerdict) and the aggregated
  event carries the egress/ingress check counts.

Rebuilt bin/control-api and bin/admin-dashboard to match. Plans and summaries
are in docs/changes; README, API, USAGE, DASHBOARD and DIAGRAMS are updated.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/httpapi/handlers_registry_test.go

@@ -1,9 +1,11 @@
 package httpapi
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"net/http"
+	"reflect"
 	"testing"
 	"time"
 
@@ -149,3 +151,71 @@ func TestRegistryHistoryOutlivesIPDeletion(t *testing.T) {
 		t.Fatalf("expected a single registry entry for the address, got %+v", all)
 	}
 }
+
+// TestAdminRegistryLevels proves the registry endpoints report the last
+// cycle's recorded checks as "ok of total" per level (egress / ingress) and
+// per check family, and that by_type is an empty list, not null, when a
+// level has no checks.
+func TestAdminRegistryLevels(t *testing.T) {
+	fc, d, _, _ := newConfigTestHarness(t)
+	ctx := context.Background()
+	if _, err := d.SubmitIPs(ctx, []string{"7.7.7.7", "8.8.8.8"}); err != nil {
+		t.Fatal(err)
+	}
+	ip, err := d.GetIPByAddress(ctx, "7.7.7.7")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range []struct {
+		source, typ, target string
+		ok                  bool
+	}{
+		{db.SourceEgress, "https", "https://a.test", true},
+		{db.SourceEgress, "https", "https://b.test", false},
+		{db.SourceEgress, "icmp", "a.test", true},
+		{db.InboundSource(1), "tcp-22", "7.7.7.7", true},
+		{db.InboundSource(1), "tcp-443", "7.7.7.7", true},
+		{db.InboundSource(2), "tcp-22", "7.7.7.7", false},
+	} {
+		if err := d.UpsertCheck(ctx, db.Check{
+			IPID: ip.ID, IPAddress: "7.7.7.7", AttemptNumber: ip.AttemptNumber,
+			Source: c.source, CheckType: c.typ, Target: c.target, Success: c.ok, CheckedAt: db.Now(),
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	resp, body := fc.do(http.MethodGet, "/api/v1/admin/registry/7.7.7.7", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("detail: %d %s", resp.StatusCode, body)
+	}
+	var detail struct {
+		Registry registryDTO `json:"registry"`
+	}
+	if err := json.Unmarshal(body, &detail); err != nil {
+		t.Fatal(err)
+	}
+	r := detail.Registry
+	if r.LastCycleID != 1 {
+		t.Errorf("last_cycle_id = %d", r.LastCycleID)
+	}
+	wantEgress := levelResultDTO{Total: 3, OK: 2, ByType: []typeStatDTO{{"https", 2, 1}, {"icmp", 1, 1}}}
+	wantIngress := levelResultDTO{Total: 3, OK: 2, ByType: []typeStatDTO{{"tcp", 3, 2}}}
+	if !reflect.DeepEqual(r.Egress, wantEgress) || !reflect.DeepEqual(r.Ingress, wantIngress) {
+		t.Errorf("egress=%+v ingress=%+v", r.Egress, r.Ingress)
+	}
+
+	// The paginated list carries the same fields; an address without checks
+	// serialises empty levels as {"total":0,"ok":0,"by_type":[]}.
+	_, body = fc.do(http.MethodGet, "/api/v1/admin/registry?limit=10", nil)
+	var page registryPageResponse
+	if err := json.Unmarshal(body, &page); err != nil || len(page.Items) != 2 {
+		t.Fatalf("list: %v %s", err, body)
+	}
+	if !reflect.DeepEqual(page.Items[0].Egress, wantEgress) {
+		t.Errorf("list egress = %+v", page.Items[0].Egress)
+	}
+	if !bytes.Contains(body, []byte(`"egress":{"total":0,"ok":0,"by_type":[]}`)) {
+		t.Errorf("empty level must serialise by_type as [], got %s", body)
+	}
+}