fix(infra): PR #115 final round — complete F1/C1 + implement TLS detection

F1: Set LAST_KIND on unexpected-status path (was unset, causing empty
     placeholder in 7 failure lines).
F2: Implement TLS detection — capture curl exit code and map TLS
     error codes (35|51|58|59|60|77|83) to kind=tls. Previously
     TLS failures were misdiagnosed as timeout.
F3: Header comment now lists all producible kinds:
     timeout | refused | tls | unexpected:<code>.
F4: Add 2 test assertions: Grafana failure line exists + kind
     is non-empty (proves the gap that shipped in round 2).

Test: 20 passed / 0 failed (bash scripts/test_infra_monitoring.sh)

scripts/infra-monitoring.sh

@@ -20,7 +20,7 @@
 #   ✅ <name>: alive
 #   🔴 <name>: probe-failed: <host>:<port> (expected <pattern>)
 #
-# Failure kinds: timeout | refused | tls (printed in the failure line)
+# Failure kinds: timeout | refused | tls | unexpected:<code> (printed in the failure line)
 
 set -uo pipefail
 
@@ -94,11 +94,25 @@ probe_http() {
 
     code=$(printf '%s' "$code" | tr -d '[:space:]')
 
+    # Capture curl exit code for TLS error detection
+    if [ -n "$ssh_host" ]; then
+        out=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "root@${ssh_host}" \
+            "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} ${url}" 2>/dev/null)
+        code=$(printf '%s' "$out" | tr -d '[:space:]')
+    else
+        out=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 ${use_k:+-k} "$url" 2>/dev/null)
+        code=$(printf '%s' "$out" | tr -d '[:space:]')
+    fi
+    rc=$?
+
     # Classify failure kind and retry if needed
     if [ -z "$code" ] || [ "$code" = "000" ]; then
-        # Distinguish timeout from connection refused
+        # Distinguish timeout from TLS error from refused
+        case "$rc" in
+            35|51|58|59|60|77|83) kind="tls" ;;
+            *) kind="timeout" ;;
+        esac
         if [ -n "$ssh_host" ]; then
-            kind="timeout"
             # FIX C2: SSH retry at longer timeout (25s connect, 30s max)
             code=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "root@${ssh_host}" \
                 "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 25 --max-time 30 ${use_k:+-k} ${url}" 2>/dev/null)
@@ -127,6 +141,7 @@ probe_http() {
                 return 0
             else
                 kind="unexpected:$code"
+                LAST_KIND="$kind"
                 return 1
             fi
         fi

scripts/test_infra_monitoring.sh

@@ -134,6 +134,37 @@ assert "Port 9325 (historical) NOT in script source" \
 assert "Port 9405 (historical) NOT in script source" \
     '! grep -q "9405" "$SCRIPT"'
 
+# ── 7. Failure-line content includes non-empty kind ────────────────────────
+# Stub curl to return 500 (unexpected status) and verify failure line has (<kind>)
+TMP_DIR=$(mktemp -d)
+cat > "$TMP_DIR/curl" << 'EOF'
+#!/bin/bash
+# Stub: return 500 for Grafana port, 200 otherwise
+for arg in "$@"; do
+    if [[ "$arg" == *":3001"* ]]; then
+        echo "500"
+        exit 0
+    fi
+done
+echo "200"
+exit 0
+EOF
+chmod +x "$TMP_DIR/curl"
+# Run script with stubbed curl and capture output
+OUT=$(PATH="$TMP_DIR:$PATH" bash "$SCRIPT" 2>&1)
+# Find the Grafana failure line and verify it has a non-empty kind
+GRAFANA_FAIL=$(echo "$OUT" | grep "Grafana: probe-failed")
+assert "Grafana failure line exists" \
+    '[[ -n "$GRAFANA_FAIL" ]]' 
+
+# Extract the kind from the failure line (should be <unexpected:500>)
+KIND=$(echo "$GRAFANA_FAIL" | grep -oP '\(<[^>]+>\)' | tr -d '()<>')
+assert "Grafana failure kind is non-empty" \
+    '[[ -n "$KIND" ]]' 
+
+# Cleanup
+rm -rf "$TMP_DIR"
+
 # ── Summary ─────────────────────────────────────────────────────────────────
 echo ""
 echo "Results: ${PASS} passed, ${FAIL} failed"