REPORT: the three unreleased fixes (R-1093, R-978, R-973) with the R-1093 loop-device check on demo-hp

REPORT.md

@@ -1,12 +1,40 @@
-# REPORT — agent v0.159.2 released (2026-10-18)
+# REPORT — three agent fixes, committed and NOT released (2026-10-18 evening)
 
-**In plain words.** The pool check that names an orphan snapshot now runs only after a whole-box backup has failed — not
-before every backup. Released today; it runs on demo-hp, Tester 1 and demo-felhom. The vouch is the operator's.
+Task: the evening brief of 2026-10-18, Part 4 (felhom.eu `REPORT-evening-2026-10-18.md`). Baseline: `27bbdaa` (v0.159.2
+released). Commits: `f7b7308` + `0963bae` (R-1093), `8561dc8` (R-978), `f17e197` (R-973). CHANGELOG under „Unreleased";
+the release and its vouch are the operator's. Gates green per commit (`go build/vet/test ./...`, `agent_gates.py --fast`);
+CI job 2062 success for `f17e197`.
 
-- sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`, bundle
-  `477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9`, tag `v0.159.2`; no `configs/` change since 0.159.1.
-- Live proof on demo-hp: a whole-guest backup of 9201 (snapshot mode, completed) wrote **0** `felhom-thin-check` sudo
-  lines; the night's backup on 0.159.1 wrote 1. The failure leg is covered by `TestBackup_SnapshotFailure_NamesTheOrphan`.
-- Delivered on the operator's yes by signed jobs (agent_update + agent_config_update): all three hosts `update
-  committed`, capability probe 75/75. Evidence: felhom.eu `documentation/audits/day-2026-10-18/P4/`.
-- The independent review of 2026-10-18 found nothing in this change.
+## R-1093 — an empty partition is blank
+
+lsblk reports the PARENT disk's PTTYPE for a partition. `InspectDevice` now ignores that PTTYPE only when `blkid -p` on the
+partition exited 0, printed `PART_ENTRY_NUMBER`, and its `PART_ENTRY_SCHEME` equals lsblk's PTTYPE. Every error path
+stays data-bearing: blkid exit 2 / I/O error / missing binary keep „device has a partition table"; an lsblk answer that
+exits 0 but does not parse or names no device is „could not be reliably inspected" (an older fail-open, closed here after
+a background security review flagged the probe). No new sudo command, no config bundle.
+Test `TestInspect_R1093_PartitionVerdicts` (14 rows); three red-proofs. **Live on demo-hp** (a 1 GB loop file in `/root`,
+removed after; felhom.eu `audits/agent-fixes-2026-10-18/r1093-loop-check.txt`): the empty GPT partition → lsblk
+`pttype "gpt"` (the bug's input), blkid rc 0 with only `PART_ENTRY_*` (the fix's condition holds); ext4 → `TYPE=ext4`; a
+dos table inside the partition → `PTTYPE=dos`. Not walked: the whole `/api/storage/init` call (the agent refuses loop
+devices; it needs a VM with a spare disk running a build of this commit).
+
+## R-978 — the new escrow package reaches the hub only at the claim
+
+A ceremony started again no longer replaces the hub's package at create time. The package travels with the pending
+ceremony and is uploaded when the code is claimed, before the code is handed out; an upload failure is 502 and the code
+stays claimable; a ceremony abandoned by TTL, a new start or a restart leaves the first code opening the hub's package.
+Ceremony output is version 2 (`PendingUpload`); the sudo argv is unchanged. Tests `TestEscrowCeremony_R978_*` and three
+`cmd` tests; four red-proofs. **Residual (filed):** the typed-back check is the browser's, so a household that opens the
+new code and closes the page without writing it down has still replaced the package.
+
+## R-973 — a cadence cap on `POST /backup`
+
+Per guest and tier, successful runs only: the daily (local) tier at most **3 per rolling 24 h** (the night run, one
+„Mentés most", the next night — `07` §6; since R-899 a press never costs the night); the longer tier at most one per
+max(cadence − 24 h, cadence / 2) = **6 days** for the weekly off-site tier. A refusal is 429 with the next allowed time,
+WARN-logged, kept in `backup-success-state.json` (survives a restart), and for 24 h the host report carries the CRITICAL
+degraded status `localapi:backup-cadence-cap` (the hub's operator-only `agent_capability_degraded`). Tests `TestBackupCap_*`
+and others; three red-proofs. **Limits (filed):** keep-last 3 lets three local points be replaced within one day; the
+off-site namespace's keep-last 2 is a count — a time-bucketed prune on ep0 is the operator's.
+
+*Decided by CC unattended — operator may reverse:* the numbers 3 / 24 h and 6 days, and counting successes only.