v0.62.0 — A1: pool-membership ownership check for the stale-lock reaper

staleLockController.Guests() = ListLXC ∩ GET /pools/felhom members (ownership
PROVEN via the pool registry, never assumed from enumeration scope); pool-read
failure fail-safes the whole recovery through the existing guest-list guard.
New Client.Pool read (needs Pool.Audit — host-install v1.9.0; Pool.Allocate
does NOT satisfy it, spike T2). Composed pve:pool-read capability (non-critical)
+ --selftest pool-read line. Red-proofed negative tests drive the REAL
controller over a broad-token-shaped fake.

Per SPIKE-a1-pool-membership-read-2026-07-03.md; audit A1
(AUDIT-blast-radius-hostroot-localapi-2026-07-02).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

cmd/felhom-agent/main.go

@@ -45,7 +45,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.61.0"
+var version = "0.62.0"
 
 // runGuestHook is the PVE pre-start hook body (`felhom-agent guest-hook <vmid> <phase>`). On the
 // pre-start phase it creates placeholder dirs for any absent bind-mount source so the guest always boots
@@ -274,6 +274,28 @@ func (r *gateRemounter) Remount(ctx context.Context, t storage.KnownTarget) {
 	r.logger.Info("storage: re-mounted returned target", "target", t.Name, "where", t.MountPath)
 }
 
+// poolReadStatus probes the felhom-pool membership read (GET /pools/felhom) the stale-lock reaper's
+// ownership scoping depends on (v0.62.0, audit A1). Needs `Pool.Audit` at `/pool/felhom` — granted
+// by host-install v1.9.0; on an older ACL this reports degraded and the reaper fail-safes (skips).
+func poolReadStatus(ctx context.Context, px *proxmox.Client) capability.Status {
+	s := capability.Status{
+		Name:     "pve:pool-read",
+		Feature:  "stale-lock recovery scoping (pool ownership check)",
+		Critical: false,
+		Status:   capability.StatusOK,
+	}
+	if px == nil {
+		s.Status, s.Reason = capability.StatusDegraded, "not configured"
+		return s
+	}
+	pctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	if _, err := px.Pool(pctx, reconcile.DefaultPool); err != nil {
+		s.Status, s.Reason = capability.StatusDegraded, err.Error()
+	}
+	return s
+}
+
 // logCapabilities logs the privileged-capability self-check at startup: one INFO summary, plus an
 // ERROR per degraded capability naming the gated feature (so a missing grant is loud at cutover,
 // not days later). It never exits — serve-degraded.
@@ -336,8 +358,14 @@ func runDaemon(cfg config.Config, logger *slog.Logger) int {
 	// startup (loud on any denial) and attach the snapshot to every hub report; the hub owns the
 	// ok→degraded alert. Serve-degraded — a missing grant never blocks startup.
 	capProber := capability.Prober{Runner: &proxmox.ExecRunner{Mode: proxmox.RunnerDirect}}
-	logCapabilities(capProber.Probe(context.Background()), logger)
-	collector.SetCapabilityProber(capProber.Probe)
+	// A1 (v0.62.0): compose the PVE pool-read check AROUND the sudo prober (an API read does not
+	// belong inside the sudo-policy probe). Non-critical: a degraded pool read means the stale-lock
+	// reaper fail-safes (locks stay uncleared) — visible on the hub report, no operator page.
+	probeAll := func(ctx context.Context) []capability.Status {
+		return append(capProber.Probe(ctx), poolReadStatus(ctx, px))
+	}
+	logCapabilities(probeAll(context.Background()), logger)
+	collector.SetCapabilityProber(probeAll)
 	loop := hub.NewLoop(collector, client, time.Duration(hcfg.PollSeconds)*time.Second, logger)
 	interval := time.Duration(hcfg.PollSeconds) * time.Second
 
@@ -766,25 +794,26 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 		Backups:       runner,
 		Store:         store,
 		Storage:       observer,
-		DriveTargets:  driveTargets, // Impl-2a: registry+units drives for the /disks view (union w/ Observe storages)
+		DriveTargets:  driveTargets,                // Impl-2a: registry+units drives for the /disks view (union w/ Observe storages)
 		HostReader:    storage.NewProcHostReader(), // Impl-2b: durableIDForMount raw-mount fallback + role gate
 		Tokens:        tokens,
 		BackupCadence: cfg.Backup.BackupCadence(),
 		// Disk management (slice 8C): the privileged host surface + the data-bearing wipe gate.
-		Disks:          hostOps,
-		DiskGate:       storageGateAdapter{gate: gate, hostID: cfg.Hub.HostID},
-		Guests2:        px,
-		GuestAttach:    guestBinder, // slice 10 P2: bind enrolled data drives into the guest
+		Disks:       hostOps,
+		DiskGate:    storageGateAdapter{gate: gate, hostID: cfg.Hub.HostID},
+		Guests2:     px,
+		GuestAttach: guestBinder, // slice 10 P2: bind enrolled data drives into the guest
 		// Network storage (NAS) — Part A1: the privileged host network-mount surface (NFS/SMB automount).
-		NetStorage:  hostOps,
-		SmbCredsDir: cfg.Privileged.SmbCredsDir,
+		NetStorage:     hostOps,
+		SmbCredsDir:    cfg.Privileged.SmbCredsDir,
 		ControllerSwap: guestBinder, // Phase 1: agentic controller update — in-guest image swap
 		// F2-b: recover a guest left with a stale vzdump lock by a reboot-during-backup. Reads + start
 		// go through the API client; the `pct unlock` is the one fenced root-CLI op (no API equivalent).
-		StaleLock: localapi.NewStaleLockController(px, &proxmox.ExecRunner{Mode: gaMode, SudoPath: cfg.Privileged.SudoPath}),
-		Intent:         intent,      // slice 10 P3: record enroll/eject intent for self-heal
-		GuestBinds:     guestBinds,  // F9: per-guest bind record for the startup re-assert
-		FormatJobs:     formatJobs,  // F20-BUG3: detached-format job record + restart recovery
+		// A1 (v0.62.0): the scan is restricted to felhom-pool members (ownership proven, not assumed).
+		StaleLock:  localapi.NewStaleLockController(px, &proxmox.ExecRunner{Mode: gaMode, SudoPath: cfg.Privileged.SudoPath}, reconcile.DefaultPool, logger),
+		Intent:     intent,     // slice 10 P3: record enroll/eject intent for self-heal
+		GuestBinds: guestBinds, // F9: per-guest bind record for the startup re-assert
+		FormatJobs: formatJobs, // F20-BUG3: detached-format job record + restart recovery
 
 		// Host metrics (slice 9): the shared collector serves GET /host/metrics — a fresh host +
 		// per-storage view to the customer's monitoring page (reuses the slice-4 collector).
@@ -1756,6 +1785,15 @@ func runSelftestRead(ctx context.Context, cfg config.Config, logger *slog.Logger
 			fmt.Printf("           - %d %q status=%s\n", g.VMID, g.Name, g.Status)
 		}
 	}
+	// A1 (v0.62.0): the stale-lock reaper's ownership registry — needs Pool.Audit (host-install v1.9.0+).
+	if p, err := client.Pool(ctx, reconcile.DefaultPool); report("pool read", err) {
+		fmt.Printf("  [ ok ] %-14s pool %q, %d member(s)\n", "pool read", p.PoolID, len(p.Members))
+		for _, m := range p.Members {
+			if m.VMID != 0 && m.Type != "storage" {
+				fmt.Printf("           - %d type=%s\n", m.VMID, m.Type)
+			}
+		}
+	}
 	if ss, err := client.NodeStorage(ctx); report("storage", err) {
 		fmt.Printf("  [ ok ] %-14s %d store(s)\n", "storage", len(ss))
 		for _, s := range ss {