Revert the silent-worker sweep: silence is the normal case, not a fault master
The sweep took production down. Deployed 13:47Z, RSS growth alert 14:21, scrape down 14:52, liveness kill 14:56, then an hour of failed probes with the HTTP server not answering inside 15s. Rolled back to 95b9ec6. The defect is the premise. The sweep treats "delivered no frames" as evidence a connection is broken, but on this network only 113-120 of ~3000 connected hosts deliver anything in a given 30s window. Silence is the normal, healthy state of a small PDS. So the sweep tore down thousands of working connections, and since a rebuilt worker only re-stamps on handshake, every quiet host entered a permanent 15-minute destroy-and-rebuild cycle -- sustained fleet-wide connection churn, which is the same variable the 08-12 soak exists to accelerate. It manufactured the trigger we are hunting. The evidence was already in the incident capture I worked from: 102 of 120 sending hosts out of 3092 connected. I read that as "102 hosts went deaf" and not as "2900 hosts are silent and fine", then built a backstop on the second reading being false. I had also just warned the operator that a bulk reconnect loop over a wrong silent-set would inflict exactly this churn, and then shipped one on a 60s timer. b3ffac4 does not rescue it: stamping spawn, connect attempts and handshakes closed the pre-handshake blind spot, but a connected-and-quiet worker still never re-stamps between frames, so the mass teardown is unchanged. Reverted rather than tuned. No threshold makes silence mean deafness. Kept: `last_progress_ms` and its stamping, which the /admin/hosts/reconnect guard uses, and that endpoint stays manual and guarded. Removed: the sweep fiber, its options, and relay_silent_worker_reconnects_total. A real backstop needs a signal that separates "nothing to say" from "cannot hear" -- a protocol ping with a response, as indigo does with a pinger goroutine and a pong-refreshed read deadline. Whatever replaces this must also have its timeout and an off switch settable at runtime; the operator had no lever short of an image rollback. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>