fix(dashboard): a never-reachable Tari can no longer hold worker readmission hostage

[VijitSingh97]

What

Fixes #875 — the appliance that looks healthy while earning nothing. The worker-rejection supervisor stops xmrig-proxy on a debounced node outage and is supposed to readmit once the nodes it rejects on are confirmed healthy. Readmission required a required Tari to be confirmed healthy — but a Tari whose gRPC has never answered this run is neither down nor healthy, so it blocked readmission forever on a node that never caused the stop. A monerod blip during a post-update boot (when Tari's gRPC takes many minutes to start listening) stopped the proxy, and nothing ever started it again. On a shell-less release appliance there is no pithead up to recover with.

Readmission now mirrors the stop side's ever-up guard: a required Tari holds readmission only if it has actually been reachable since the dashboard started. monerod's confirmed-healthy requirement is unchanged — it is the node mining actually needs.

Root cause, re-derived from the live bench

The bench's dashboard log showed workers_rejected (restored from the persisted snapshot) held for ~21 hours by a continuous Tari gRPC connection-refused window — and the readmit fired exactly 60 s (the recovery window) after Tari first answered. The coupling removed here is precisely what held it.

The sibling audit (from the issue)

• p2pool under the same supervisor: stopped only by the Don't start p2pool and xmrig proxy until after monero and tari have synced fully #35 sync gate (one-way release latch — it never re-holds, and a partial start retries every cycle) and the fail-closed gate (re-checks both directions every cycle). Neither has a one-way stop.
• The commit gate distinguishing a rejected proxy from the sync hold: with readmission self-healing, a stopped proxy either restarts within ~60 s of node health or a node is genuinely down — committing during that window is acceptable, so no gate change. Noted here rather than built.
• KVM battery assertion: deliberately not added — in the harness the stack is freshly provisioned and still syncing, so the sync gate legitimately holds xmrig-proxy; asserting it running there would fight Don't start p2pool and xmrig proxy until after monero and tari have synced fully #35. The readmit logic is pinned at unit tier and verified on the live bench instead.

Verification

• Unit tests: the trap case (never-up required Tari + healthy monerod → readmit) and the guard case (was-up-but-unconfirmed Tari → hold) both pinned; the old test encoding the trap as intended behavior is rewritten. Full dashboard suite: 1760 passed. Patch coverage 100%. make lint green.
• Adversarially verified in a fresh context: confirms the deadlock trace, the trade-off (Monero-only mining beats zero revenue when a required Tari has never answered), no other consumers of the changed semantics.

🤖 Generated with Claude Code