R-894: after a restart the agent remembers the last backup per tier

An unreadable storage right after an agent restart read the off-site tier
DUE (the in-memory record was empty). The newest success per tier is now
kept on disk and read ONLY when the storage cannot be read: fresh -> not
due, older than the cadence -> due, none -> due (unknown) as before. A
storage that answers stays the ground truth.

Ships with v0.150.0 after the 2026-10-07 read-back; nothing delivered.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

cmd/felhom-agent/main.go

@@ -1901,12 +1901,15 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 		BackupTiers:    apiTiers, // R-82: primary first; untargeted endpoints act on the primary
 		InFlight:       inFlight, // R-85: shared with the restore-test scheduler (Scenario F)
 		Store:          store,
-		Storage:        observer,
-		DriveTargets:   driveTargets,                    // Impl-2a: registry+units drives for the /disks view (union w/ Observe storages)
-		Smart:          storage.NewSmartReader(hostOps), // v0.95.0 Fix B: SMART for the union-path drives
-		HostReader:     storage.NewProcHostReader(),     // Impl-2b: durableIDForMount raw-mount fallback + role gate
-		Tokens:         tokens,
-		BackupCadence:  cfg.Backup.BackupCadence(),
+		// R-894: the newest success per tier on disk — the due-check's fallback when the storage cannot be
+		// read right after a restart. Same state dir as restore-test-state.json.
+		LastKnownBackups: backup.NewBackupSuccessState(filepath.Join(cfg.OOB.WithDefaults().StateDir, "backup-success-state.json")),
+		Storage:          observer,
+		DriveTargets:     driveTargets,                    // Impl-2a: registry+units drives for the /disks view (union w/ Observe storages)
+		Smart:            storage.NewSmartReader(hostOps), // v0.95.0 Fix B: SMART for the union-path drives
+		HostReader:       storage.NewProcHostReader(),     // Impl-2b: durableIDForMount raw-mount fallback + role gate
+		Tokens:           tokens,
+		BackupCadence:    cfg.Backup.BackupCadence(),
 		// Disk management (slice 8C): the privileged host surface + the data-bearing wipe gate.
 		Disks:       hostOps,
 		DiskGate:    storageGateAdapter{gate: gate, hostID: cfg.Hub.HostID},

cmd/felhom-agent/r894_wiring_test.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"go/ast"
+	"testing"
+)
+
+// R-894 — the on-disk backup record is WIRED on the daemon path (the built-but-never-wired class).
+// main → runDaemon → buildLocalAPIServer, and inside it the localapi.Options literal carries
+// LastKnownBackups built by backup.NewBackupSuccessState. An AST walk, not a string match, for the
+// reasons in escrow_recover_wiring_test.go.
+//
+// COMPANION RED-PROOF (observed): delete the `LastKnownBackups:` line from buildLocalAPIServer → this
+// fails with "localapi.Options in buildLocalAPIServer has no LastKnownBackups field". Restored.
+func TestR894_LastKnownBackupsIsWiredIntoTheDaemon(t *testing.T) {
+	_, f := parseMain(t)
+	if !callsWithin(f, "main")["runDaemon"] || !callsWithin(f, "runDaemon")["buildLocalAPIServer"] {
+		t.Fatal("main → runDaemon → buildLocalAPIServer is broken — the path this test asserts is not the live one")
+	}
+	var field, built bool
+	for _, d := range f.Decls {
+		fd, ok := d.(*ast.FuncDecl)
+		if !ok || fd.Name == nil || fd.Name.Name != "buildLocalAPIServer" || fd.Body == nil {
+			continue
+		}
+		ast.Inspect(fd.Body, func(n ast.Node) bool {
+			cl, ok := n.(*ast.CompositeLit)
+			if !ok {
+				return true
+			}
+			sel, ok := cl.Type.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			if pkg, _ := sel.X.(*ast.Ident); pkg == nil || pkg.Name+"."+sel.Sel.Name != "localapi.Options" {
+				return true
+			}
+			for _, el := range cl.Elts {
+				kv, ok := el.(*ast.KeyValueExpr)
+				if !ok {
+					continue
+				}
+				if k, ok := kv.Key.(*ast.Ident); ok && k.Name == "LastKnownBackups" {
+					field = true
+					if callsIn(kv.Value)["backup.NewBackupSuccessState"] {
+						built = true
+					}
+				}
+			}
+			return true
+		})
+	}
+	if !field {
+		t.Fatal("localapi.Options in buildLocalAPIServer has no LastKnownBackups field")
+	}
+	if !built {
+		t.Fatal("LastKnownBackups is not built by backup.NewBackupSuccessState")
+	}
+}
+
+func callsIn(n ast.Node) map[string]bool {
+	out := map[string]bool{}
+	ast.Inspect(n, func(n ast.Node) bool {
+		if ce, ok := n.(*ast.CallExpr); ok {
+			if fn, ok := ce.Fun.(*ast.SelectorExpr); ok {
+				if x, ok := fn.X.(*ast.Ident); ok {
+					out[x.Name+"."+fn.Sel.Name] = true
+				}
+			}
+		}
+		return true
+	})
+	return out
+}