REPORT + CONTEXT: R-528 and R-1254 on main, not released (night 2026-10-28)

CONTEXT.md

@@ -1,5 +1,11 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-28 night (unattended) — R-528 + R-1254 on `main` (`6f933d6`, `5ddd124`), NOT released (the next agent
+> release, the operator's vouch).** `GET /guest/oom-kills` (`internal/localapi/guest_oom.go`): the host-side `oom_kill`
+> of each Docker container of the token's guest (`Server.cgroupRoot` is the test seam); proven on Tester 1 with a test
+> build (felhom.eu `audits/night-2026-10-28/r528-oom/`). Escrow ceremony: after a failed upload `HubHolds` compares the
+> hub's identity blob with the new package (`hubHoldsEscrowPackage`, cmd) — stored / not stored / unknown (504).
+
 > **2026-10-26 — R-1285 on `main` (`b1bc63d`), NOT released (operator: „not today").** The new agent runs the bundle
 > policy pass once after its self-update commits (`selfupdate.Manager.SetOnCommitted` → `PolicyPassAfterUpdate`). Live
 > proof needs a BYO box coming from 0.164.0. Tuesday 2026-10-27: the weekly line test's first run against a seeding box

REPORT.md

@@ -1,22 +1,30 @@
-# REPORT — agent v0.167.0 RELEASED, not vouched yet (2026-10-27, attended)
+# REPORT — two agent fixes on main, NOT released (night 2026-10-28 → 29, unattended)
 
-**Plain words first.** Agent 0.167.0 is published and runs on all three test boxes. It carries: a reinstalled box's
-first whole-box copy is no longer a week late (R-1232); the BYO SSH clean-up runs in the same update (R-1285); Go
-1.27.3 (R-972). The operator still has to vouch it for new installs.
+**Plain words first.** Two changes are on main and tested. Neither is released: an agent release needs the operator's
+vouch, and the night brief allowed no release. Both go on the morning list.
 
-## Release
+## What changed
 
-- `scripts/release-agent.sh 0.167.0` from a clean clone of `54d3a10` (CI 2400 and 2420 green): built, tagged `v0.167.0`,
-  published, verified by an independent download. Agent sha256
-  `28bdd2826f45f3767880fcff4d3105afb7247c09c0ced99d78b3a978d8d826f0`; bundle
-  `9d0344164b22634159984bfbcdaf77c53e6d2423812973ed8b4f2135a7ed1268`.
-- Signed `agent_update` per box (configs/ unchanged since 0.166.0, so no bundle job): demo-felhom committed 10:26 CET,
-  Tester 1 10:32, demo-hp 13:49 (held back until its line test had run). On all three the R-1285 pass ran right after
-  the commit in the NORMAL delivery (`BUNDLE POLICY DONE install_mode=appliance removed=0`) — yesterday it did not.
-  Not proven: the removal itself on a BYO box coming from 0.164.0 (none in the fleet); R-1285 stays VERIFY.
-- Tester 1's weekly line test ran on 0.167.0 (13:33 CET, 94.0 Mbit/s); demo-hp's ran through the controller's hold
-  (94.5 Mbit/s; felhom.eu `audits/linetest-2026-10-27/`).
-- **Waiting:** the operator's vouch (hub → Configs → Day-0 artifacts). After it: `pinned.day0_agent` = 0.167.0 in
-  `scripts/retention-policy.json` (D50, `09` §3 decision 262).
+- **R-528 — the OOM counter (`6f933d6`, CI run id 2473 / #284 green).** New local-API route `GET /guest/oom-kills`. It
+  reads the kernel's `oom_kill` count of each Docker container of the token's own guest, on the host, from
+  `/sys/fs/cgroup/lxc/<vmid>/ns/system.slice/docker-<id>.scope/memory.events` (mode 0444, readable by the non-root
+  agent user). Docker inside an LXC guest does not see these kills (`OOMKilled` stays false). The controller reads the
+  route every 30 s (controller `eed23e7`). Tests `TestR528_*`, red first by mutation (another guest's container served;
+  `oom` parsed for `oom_kill`).
+- **R-1254 — the escrow ceremony half (`5ddd124`, CI run id 2471 / #283 green).** After an escrow upload that fails, the
+  agent asks the hub which package it holds (the identity blob compared): the new one → success; another one → 502 and
+  „the previous code still works"; no answer → 504, which promises nothing. Tests `TestR1254_*`, red first.
 
-Evidence: felhom.eu `documentation/audits/release-2026-10-27/` (`agent-rel-0167.txt`, `agent-0167-tester1-demofelhom.txt`).
+## Live proof
+
+- R-528, 2026-10-28 23:27 UTC on Tester 1 with a test build of this agent (put back after: 0.167.0, sha256 `28bdd282…`).
+  A Radicale capped at 128 MB, a memory hog inside it killed: the host counter 0 → 1, one `app_oom` „seen by
+  docker,cgroup", one mail to the operator with `"source":"docker,cgroup"`. Evidence: felhom.eu
+  `documentation/audits/night-2026-10-28/r528-oom/`.
+- R-1254: no live proof. It needs a hub answer lost on purpose; that is a hub change, and no hub deploy runs at night.
+
+## Next
+
+The agent release (the operator's vouch), then `pinned.day0_agent` in `scripts/retention-policy.json` (D50).
+The controller needs no MinAgent change for R-528: an old agent answers 404, and the controller then waits 10 minutes
+before it asks again.