agent (unreleased): the hub is told what the kernel clean-up did and what the profile refresh did (R-1383)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

cmd/felhom-agent/main.go

@@ -1318,6 +1318,8 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 		}}
 	// R-1388 / R-1301 (`11` §5.12): after a start, load the security profiles from a fresh compile when the box runs
 	// another kernel than at the last refresh (the wrapper keeps that record and answers "not needed" otherwise).
+	// R-1383 (release 3): the last refresh, and how this process's last ask ended, ride the host report.
+	collector.SetProfileRefreshSource(osLeg.ProfileRefreshStanza)
 	go osLeg.ProfileRefresh(daemonCtx, "agent start", profileGate, 12, 5*time.Minute)
 	// R-1285: the NEW agent runs the bundle policy pass once after its self-update commits — in the normal two-job
 	// delivery the bundle was installed by the OLD process, which has no such pass (measured 2026-10-26).

cmd/felhom-agent/pvetrust_wiring_test.go

@@ -31,6 +31,10 @@ func TestMainWiresPVETrust(t *testing.T) {
 				seen["ensure"]++
 			case sel.Sel.Name == "SetProxmoxTrustSource":
 				seen["stanza"]++
+			case sel.Sel.Name == "SetProfileRefreshSource" && len(node.Args) == 1:
+				if a, ok := node.Args[0].(*ast.SelectorExpr); ok && a.Sel.Name == "ProfileRefreshStanza" {
+					seen["profile refresh → report"]++ // R-1383
+				}
 			case sel.Sel.Name == "SetGuestPowerGaveUpSource" && len(node.Args) == 1:
 				if a, ok := node.Args[0].(*ast.SelectorExpr); ok && a.Sel.Name == "GuestPowerGaveUpStanza" {
 					seen["guest-power give-up → report"]++ // R-1383
@@ -58,7 +62,7 @@ func TestMainWiresPVETrust(t *testing.T) {
 		return true
 	})
 	want := map[string]int{"ensure": 2, "stanza": 1, "hook": 1, "timer": 1, "apply=SetTLS": 1, "profile-refresh": 2,
-		"guest-power give-up → report": 1}
+		"guest-power give-up → report": 1, "profile refresh → report": 1}
 	for k, n := range want {
 		if seen[k] < n {
 			t.Errorf("main.go wires %q %d time(s), want at least %d (the two-call ones: at start and after a bundle install)", k, seen[k], n)