Prove a repair before writing it, and gate writing separately from looking

A model can be confident a port should be 8686; a probe can report that 8686 answered, and
only the second is a fact. Detecting and repairing are also separate things to trust, so
the feature runs read-only until the write switch is turned on under it.

Deployment/master.conf.template

@@ -1764,6 +1764,20 @@
     AI_ASSIST_CLEANUP=false         # tier 2 — orphan and stuck-import triage
     AI_ASSIST_ONBOARD=false         # tier 3 — onboarding / settings assistance
 
+# ━━━ AI Repair ━━━
+# Reads the log of a job that has finished, turns known error shapes into findings, and offers
+# or applies a repair. Two switches, because detecting and repairing are separate things to
+# trust.
+#
+# AI_REPAIR_ENABLED on its own reads, files findings and offers fixes, and writes nothing. Run
+# it there first — long enough to read what it finds and disagree with some of it.
+#
+# AI_REPAIR_AUTOFIX_ENABLED is what allows a value to be written unattended, and only ever a
+# value a probe has answered on. Never a toggle: whether something should be switched on is a
+# decision about intent, and a probe cannot prove intent the way it can prove a port answers.
+    AI_REPAIR_ENABLED=false
+    AI_REPAIR_AUTOFIX_ENABLED=false
+
 # ━━━ AI Repair Findings ━━━
 # Misconfigurations found in this installation, as opposed to defects in Varaverk — those go to
 # ai_bugs. A finding is open until the configuration is right, and closes itself when the probe
@@ -1771,6 +1785,10 @@
 # before and here is what fixed it" is worth more than the disk. Open findings are never pruned:
 # an unresolved problem does not stop mattering because it is old.
     AI_FINDING_RETAIN_DAYS=90
+# Seconds a single probe may take. Nothing is written to conf that has not answered a probe, so
+# this is the budget for proving a candidate — kept short because a sweep may try several, and
+# an address worth switching to answers quickly or is not worth switching to.
+    AI_PROBE_TIMEOUT=4
 
 # ━━━ AI Conf Write Access ━━━
 # Separate switch from AI_ENABLED, off by default, and an explicit key whitelist. Never paths,