Symptom
Bare tracebloc/tb home screen shows a false-negative:
⚠ Secure environment "…" · running — couldn't confirm it's connected to tracebloc — run tb doctor
…while tb doctor is fully green (Backend auth ✔, egress ✔, active client resolved). So the backend IS reachable; the home probe just can't confirm it in time.
Root cause
realHeartbeat (internal/cli/home.go) → lookupClientStatus → api.Client.ListClients, which does GET /edge-device/ and paginates through every client in the account (up to maxListPages=100), then filters client-side for the active ID — all under homeProbeTimeout=1200ms / homeDetectBudget=1500ms. On accounts with enough clients to need multiple pages (or with slow prod round-trips), the list can't finish in 1.2s → context deadline → err → beatUnknown → "couldn't confirm". tb doctor is green because its Backend-auth check is a single GET /userinfo/ with no tight timeout.
Fix
Add api.Client.GetClient(ctx, id) → GET /edge-device/{id}/ (single O(1) call; the detail route already exists — PatchClientClusterID uses it) and switch lookupClientStatus to it instead of ListClients+client-side find. Remove the now-dead findClientByID (blocking deadcode gate). One fast round-trip fits comfortably in the budget → honest Online/not-online instead of spurious "couldn't confirm".
Found while diagnosing a live prod home screen (account client id 1070).
Symptom
Bare
tracebloc/tbhome screen shows a false-negative:…while
tb doctoris fully green (Backend auth ✔, egress ✔, active client resolved). So the backend IS reachable; the home probe just can't confirm it in time.Root cause
realHeartbeat(internal/cli/home.go) →lookupClientStatus→api.Client.ListClients, which doesGET /edge-device/and paginates through every client in the account (up tomaxListPages=100), then filters client-side for the active ID — all underhomeProbeTimeout=1200ms/homeDetectBudget=1500ms. On accounts with enough clients to need multiple pages (or with slow prod round-trips), the list can't finish in 1.2s → context deadline → err →beatUnknown→ "couldn't confirm".tb doctoris green because its Backend-auth check is a singleGET /userinfo/with no tight timeout.Fix
Add
api.Client.GetClient(ctx, id) → GET /edge-device/{id}/(single O(1) call; the detail route already exists —PatchClientClusterIDuses it) and switchlookupClientStatusto it instead ofListClients+client-side find. Remove the now-deadfindClientByID(blocking deadcode gate). One fast round-trip fits comfortably in the budget → honest Online/not-online instead of spurious "couldn't confirm".Found while diagnosing a live prod home screen (account client id 1070).