REPORT + CONTEXT: v0.170.0 released and vouched; reboot_guest proven on the release builds

CONTEXT.md

@@ -1,5 +1,13 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-29 (evening, attended) — v0.170.0 RELEASED and VOUCHED (18:57:48 CET): `reboot_guest` (D65 = A).**
+> `da8d12a0…`, bundle `03f2ff64…`, tag `v0.170.0`, from a clean clone of `ca15a31`; configs/ changed (one new read-only
+> sudo vector: `cat` of the controller's `data/ctl/busy`), so per box a signed `agent_config_update` + `agent_update`
+> (Tester 1, demo-hp, demo-felhom; capability probe 76/76). The agent's closed list is `restart_controller` +
+> `reboot_guest` (`opreboot.go`; guards in felhom.eu `03`/`04` §6.1). Proven on Tester 1: refused during an off-site run
+> (the controller's busy file), done in 67 s / 79 s, refused a second time inside the hour. `pinned.day0_agent` = 0.170.0.
+> **R-1344 (the stuck-controller restart) is still ALARM ONLY** — the night's health log is read on 2026-10-30.
+
 > **2026-10-29 (afternoon, attended) — v0.169.0 RELEASED and VOUCHED (14:06:09 CET).** `fc066de6…`, bundle `3ca33f9c…`,
 > from `637c92c`; `pinned.day0_agent` 0.169.0 (`db25eb0`). The agent's own closed operator-action list:
 > `restart_controller <vmid>` (host-report reply → result on the next host report; the supervisor's guards; the brake

REPORT.md

@@ -1,29 +1,36 @@
-# REPORT — v0.169.0 released and vouched: „Restart controller" from the hub (2026-10-29, attended)
+# REPORT — v0.170.0 released and vouched: „Reboot guest" from the hub (D65 = A, 2026-10-29 evening, attended)
 
-**Plain words first.** The operator can now restart a box's controller from the hub's host page. The agent does it, so it
-works when the controller is stopped or stuck. It uses the supervisor's own guards and brake: 3 restarts in 15 minutes,
-then presses are refused for 30 minutes. A controller that runs but does not answer now raises an operator alarm
-(`controller_unresponsive`); it is not restarted by itself yet — that waits for the night's measurement (R-1344).
+**Plain words first.** The operator can now reboot a box's guest from the hub's host page, beside „Restart controller".
+The agent does it (`pct reboot` of that guest — never the host). It refuses during a backup, a restore, an update or a
+controller swap, more than once an hour, and under the restart brake. The result says when the guest and the controller
+were back. The controller that starts after the reboot tells the household for a day that Felhom support restarted
+the box.
 
 ## Commits
 
 | Commit | CI (job id) | What |
 |---|---|---|
-| `637c92c` | 2504, 2507 green | The agent's closed list: `restart_controller <vmid>` on the host-report reply (`ControlEnvelope.OperatorActions`), the result on the next host report (`OperatorActionResults`). Guards: provisioned, running, parked, swap, lock, vzdump. The brake counts operator restarts with the supervisor's (`opBrakeUntil`). One audit line, one result per id, re-sent until the hub records it; a report is asked for at once. R-1344: 6 unhealthy sweeps → `unresponsive_since` in the stanza. Tests in `internal/localapi/opactions_test.go`, `supervisor_unresponsive_test.go`, `opactions_wiring_test.go`, each seen failing by its mutation. |
-| `db25eb0` | 2513 green | v0.169.0 CHANGELOG; `pinned.day0_agent` = 0.169.0 (D50 pin), after the vouch. |
+| `ca15a31` | 2520, 2524 green | `reboot_guest` in the closed list (`opreboot.go`): guards (provisioned, running, not locked, not parked; the heavy-operation gate held until the guest is up; `jobBlocker`; the controller's busy file, fresh ≤ 90 s, fail closed on any read error but „no file"; one per hour per guest, persisted; the restart brake counts it); `rebootInFlight` keeps the guest-power watchdog and the supervisor away; the result with both times; `GET /guest/operator-reboot` for the household line; one new read-only sudo vector (`cat` of the controller's busy file) + capability `controller-busy-read`. 19 mutants, each killed (one survivor found and fixed: a duplicate swap check). |
+| `6578a8b` | 2525 green | v0.170.0 CHANGELOG heading; `pinned.day0_agent` = 0.170.0 (D50), after the vouch. |
 
 ## Release
 
-- `release-agent.sh 0.169.0` from a clean clone: sha256 `fc066de640007038ecfaed6a23e4301a27fc486f1d7851c36177acdd26c2df61`,
-  bundle `3ca33f9cbab3bdd4c1b7f8ac90aa21e43b64209f1cb45c77ac72b3405956041b`, tag `v0.169.0`, verified by download.
-- Signed `agent_update` to the three test boxes; each committed.
-- Vouched by the operator 14:06:09 CET (the page answered 504; the save went through — R-1346).
+- `release-agent.sh 0.170.0` from a clean clone of `ca15a31`: sha256 `da8d12a05ef607c338b9ba307e7a81b18253a3188721bbd8421ba36658a22404`,
+  bundle `03f2ff6442fc3ca600b1f25f26767ce4da466a770a258f3e362cf95f6e76b543`, tag `v0.170.0`, verified by download.
+- configs/ changed, so per box a signed `agent_config_update` AND `agent_update` (Tester 1, demo-hp, demo-felhom): all
+  six COMPLETED; each box „config bundle INSTALLED", capability probe 76/76 ok, „update committed".
+- Vouched by the operator 2026-10-29 18:57:48 CET (the save took 38.3 s — felhom.eu R-1346).
 
-## Live proofs (Tester 1, through the hub endpoint the button posts, CC's `cc-hosts` token)
+## Live proofs (Tester 1, through the hub endpoint the button posts, CC's `cc-hosts` token; controller 0.349.0-rc.1)
 
-- 13:01–13:02 CET on rc builds: press 1 → the controller answered after 9 s; press 2 with the controller stopped by hand →
-  restarted 5 s after the stop; press 3 done; press 4 refused („3 restarts in 15 minutes").
-- 14:49 CET on the release builds (agent 0.169.0, controller 0.348.0, hub 0.176.1): one press → „done — restarted; the
-  controller answered after 9 s", on the hub 16 s after the press; the box showed the controller „Up 12 seconds".
+- **Refused during an off-site run:** `offsite_backup_now` pressed 18:03:36 UTC → the controller's busy file 11 s later →
+  „Reboot guest" → „refused: the controller is busy — a backup, a restore or an off-site run is running"; the guest kept
+  its 13 h uptime.
+- **The reboot:** pressed 18:05:08 UTC → „done — rebooted; the guest was up after 67 s, the controller answered after
+  79 s", on the hub 88 s after the press. Box walk after: 10 containers, none unhealthy, 0 errors, login and file manager
+  200. The household dashboard: „A Felhom ügyfélszolgálata 19:05-kor újraindította a dobozt."
+- **A second press inside the hour:** „refused: guest 9201 was rebooted from the hub at 18:05 UTC — at most one reboot
+  per hour (next from 19:05 UTC)".
+- The release-build reboot: see felhom.eu `REPORT-release-2026-10-29c.md`.
 
-Evidence: felhom.eu `documentation/audits/release-2026-10-29b/` (`p1-restart/`, `final/`).
+Evidence: felhom.eu `documentation/audits/release-2026-10-29c/`.