kvm2: an unreadable address is not a missing one (H3)

address() tried the guest agent then the host's ARP table and skipped any
error that was not a context error, returning ("", nil) after both. An
active domain with no IP maps to StateProvisioning; the controller clears
status.IP on that, and the health engine prunes the proxy's counters and
calls ForgetProxy in one tick once EffectiveHost() goes empty.

The damaging trigger was not the guest. The libvirt connection is pooled
per host, so when another reconcile's cancel or budget overrun killed it,
call returned "connection is closed" -- carrying no context sentinel, so
the check did not recognise it -- and Get returned a *successful*
instance in Provisioning with an empty IP. An unrelated proxy's timeout
dropped a healthy proxy out of rotation.

The discriminator was already in the spec without the conclusion being
drawn: during a normal boot on beelink exactly one source fails. The
agent errors because it is not up yet, while ARP answers without error
and with nothing, since the host never sees the guest's traffic. So one
source failing stays "no address yet"; every source failing, or a
connection already dead, is ErrTransient.

The explicit provider.ErrTransient wrap is load-bearing, not decoration.
Without it classify picks the first libvirt code out of the joined error,
and ErrInvalidArg, ErrAccessDenied and ErrNoSupport are Permanent -- an
address read failing would latch a running proxy as Failed, a worse
version of the harm being fixed.

Half of the finding is deliberately still open, and it is the half that
fires more often: a guest agent restarting inside a running VM still
demotes it, because that is indistinguishable from a VM still booting.
The discriminator is the previous IP, which the provider does not hold by
design and the controller already has. Follow-up finding to file against
proxy_controller.go:208-211 -- on StateProvisioning, keep an existing IP
and Provisioned condition for a few polls instead of clearing on the
first. The kvm2-local alternative (use the mark's createdAt as a
provisioning window) was rejected: createdAt is creation, not boot, and
it invents a deadline that belongs to the controller.

TestGet_addressErrorIsProvisioning failed against the new rule, correctly
-- it fails both sources with ErrAgentUnresponsive, and code 86 is
agent-specific, so the ARP source cannot produce it. Re-pointed as
TestGet_agentFailsAndARPEmptyIsProvisioning, the beelink boot it was
reaching for, which nothing covered before.
TestGet_everyAddressSourceFailingIsTransient covers the other side, both
sources erroring and the pooled link dying under the read; against the
unfixed code both return a Provisioning instance instead of an error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/kvm2-provider-spec.md

@@ -146,8 +146,12 @@ cluster can route to. The address comes from `DomainInterfaceAddresses`, guest
 agent source first, then the ARP table (on beelink the agent answered about
 20 s after start where ARP never did, because the host itself does not talk to
 the guest). The first IPv4 that is not loopback, link-local or unspecified is
-reported; errors from either source mean "no address yet" and `Get` returns
-`StateProvisioning`. The guest needs the agent: it is installed by the
+reported. One source failing means "no address yet" and `Get` returns
+`StateProvisioning`, which is the ordinary boot on beelink: the agent is not up
+while ARP answers with nothing. A connection already gone, or every source
+failing, is `ErrTransient` instead — a running VM whose address cannot be read
+is not a VM without an address, and reporting it as one would make the
+reconciler clear its IP and the health engine drop its counters. The guest needs the agent: it is installed by the
 vendor-data script (entry 5) unless `installGuestAgent: false`, which needs an
 image that ships it or a network where ARP sees guest traffic. `Port` is not
 used by the provider; nothing on the host filters it. Reachability is a