resolver: surface timeout-recheck stats and keep timeout-only domains suspect

selective-vpn-api/app/resolver.go

@@ -1813,8 +1813,18 @@ func (s *domainCacheState) setErrorWithStats(domain string, source domainCacheSo
 	if entry == nil {
 		entry = &domainCacheEntry{}
 	}
+	prevKind, _ := normalizeCacheErrorKind(entry.LastErrorKind)
 	entry.Score = clampDomainScore(entry.Score + penalty)
 	entry.State = domainStateFromScore(entry.Score)
+
+	// Timeout-only failures are treated as transient transport noise by default.
+	// Keep them in suspect bucket (no quarantine) unless we have NX signal.
+	if normKind == dnsErrorTimeout && prevKind != dnsErrorNXDomain {
+		if entry.Score < -10 {
+			entry.Score = -10
+		}
+		entry.State = domainStateSuspect
+	}
 	entry.LastErrorKind = string(normKind)
 	entry.LastErrorAt = now
 	switch entry.State {