diff --git a/scripts/amanita-probe/README.md b/scripts/amanita-probe/README.md
index c825d93..333ff57 100644
--- a/scripts/amanita-probe/README.md
+++ b/scripts/amanita-probe/README.md
@@ -60,6 +60,7 @@ koopa-amanita-probe show
 ssh amanita-probe   # should print one HB line, no shell
 
 # gaps after a freeze: look for icmp=fail/ssh=fail with large gap_s=
+# also: ref= (rabbithole ICMP) and edge= on icmp/ssh pair change
 ```
 
 ## Uninstall
diff --git a/scripts/amanita-probe/koopa-amanita-probe.sh b/scripts/amanita-probe/koopa-amanita-probe.sh
index 7156036..1f5a840 100644
--- a/scripts/amanita-probe/koopa-amanita-probe.sh
+++ b/scripts/amanita-probe/koopa-amanita-probe.sh
@@ -14,6 +14,7 @@
 #   AMANITA_PROBE_USER   default vx
 #   AMANITA_PROBE_KEY    default ~/.ssh/id_ed25519_amanita_probe
 #   AMANITA_PROBE_STATE  default ~/.local/state/amanita-probe
+#   AMANITA_PROBE_REF    second ICMP target (default 192.168.100.3, rabbithole)
 set +e
 set +u
 
@@ -27,6 +28,7 @@ LAST="${STATE}/amanita-probe.last"
 META="${STATE}/amanita-probe.meta"
 SSH_TO="${AMANITA_PROBE_SSH_TIMEOUT:-5}"
 PING_TO="${AMANITA_PROBE_PING_TIMEOUT:-2}"
+REF="${AMANITA_PROBE_REF:-192.168.100.3}"
 
 mkdir -p "${STATE}" 2>/dev/null || true
 
@@ -54,11 +56,22 @@ do_status() {
 
 do_once() {
   local ts icmp ssh hb gap prev_ts prev_epoch now_epoch
+  local old_icmp old_ssh old_pair new_pair edge ref
   ts="$(date -Iseconds)"
   now_epoch="$(date +%s)"
   icmp=fail
   ssh=fail
   hb="-"
+  old_icmp=""
+  old_ssh=""
+  old_pair=""
+  if [ -f "${LAST}" ]; then
+    old_icmp="$(awk '{for(i=1;i<=NF;i++) if($i ~ /^icmp=/){sub(/^icmp=/,"",$i); print $i; exit}}' "${LAST}" 2>/dev/null)"
+    old_ssh="$(awk '{for(i=1;i<=NF;i++) if($i ~ /^ssh=/){sub(/^ssh=/,"",$i); print $i; exit}}' "${LAST}" 2>/dev/null)"
+    if [ -n "${old_icmp}" ] && [ -n "${old_ssh}" ]; then
+      old_pair="${old_icmp}/${old_ssh}"
+    fi
+  fi
 
   if ping -c1 -W "${PING_TO}" "${HOST}" >/dev/null 2>&1; then
     icmp=ok
@@ -74,7 +87,7 @@ do_once() {
         -o ConnectTimeout="${SSH_TO}" -o ConnectionAttempts=1 \
         -o PreferredAuthentications=publickey \
         "${USER_R}@${HOST}" true 2>/dev/null \
-        | tr '\n' ' ' | tr -s ' ' | head -c 400
+        | tr '\n' ' ' | tr -s ' ' | head -c 800
     )"
     if [ -n "${hb}" ]; then
       ssh=ok
@@ -97,9 +110,19 @@ do_once() {
     fi
   fi
 
+  ref=fail
+  if ping -c1 -W "${PING_TO}" "${REF}" >/dev/null 2>&1; then
+    ref=ok
+  fi
+  new_pair="${icmp}/${ssh}"
+  edge=""
+  if [ -n "${old_pair}" ] && [ "${old_pair}" != "${new_pair}" ]; then
+    edge=" edge=${old_pair}>${new_pair}"
+  fi
+
   local line
-  line="$(printf '%s icmp=%s ssh=%s gap_s=%s host=%s user=%s hb=%s' \
-    "${ts}" "${icmp}" "${ssh}" "${gap}" "${HOST}" "${USER_R}" "${hb}")"
+  line="$(printf '%s icmp=%s ssh=%s gap_s=%s host=%s user=%s ref=%s%s hb=%s' \
+    "${ts}" "${icmp}" "${ssh}" "${gap}" "${HOST}" "${USER_R}" "${ref}" "${edge}" "${hb}")"
 
   printf '%s\n' "${line}" >>"${LOG}"
   printf '%s\n' "${line}" >"${LAST}"
@@ -109,6 +132,7 @@ do_once() {
     echo "icmp=${icmp}"
     echo "ssh=${ssh}"
     echo "gap_s=${gap}"
+    echo "ref=${ref}"
   } >"${META}"
 
   # Keep log bounded (~14d at 15s ≈ 80k lines; rotate soft at 200k lines)