R-366 slice 2 (decision 168): the host report carries the archives the restore-test skipped as another key's

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

cmd/felhom-agent/main.go

@@ -790,6 +790,9 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	pbsTargets := pbsTargetsFromPVE(cfg, px, logger)
 	pbsReporter := pbs.NewLiveSnapshotReporter(pbsTargets, pbsStore, pbs.DefaultLiveSnapshotTimeout, logger)
 	collector := hub.NewCollector(px, newTunnelProber(cfg, px), observer, backupStore, backupStore, pbsReporter, cfg.Hub.HostID, version, logger)
+	// R-366 slice 2: the restore-test's ledger of archives written with another key → the host report.
+	foreignKeys := backup.NewForeignKeyLedger()
+	collector.SetForeignKeyArchiveReporter(foreignKeys)
 	collector.SetBackupTargetResolver(primaryBackupTargetOf(cfg)) // R-109: the recipe names the live target
 	// Privileged-capability self-check (v0.44.0): probe the sudoers grants the non-root agent
 	// depends on. The probe runs `sudo -n -l` LITERALLY (a policy LIST, never executing the
@@ -1015,7 +1018,7 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	// with the local API so a backup and a restore-test can never run together.
 	rtState := backup.NewRestoreTestState(filepath.Join(cfg.OOB.WithDefaults().StateDir, "restore-test-state.json"))
 	heavyOps := &backup.InFlight{}
-	scheduler := buildRestoreTestScheduler(cfg, px, engine, backupStore, rtState, heavyOps, logger)
+	scheduler := buildRestoreTestScheduler(cfg, px, engine, backupStore, rtState, heavyOps, foreignKeys, logger)
 	// R-189: the host report's restore_tests[] must survive an agent restart. The in-memory store
 	// holds only this process's latest run, and under per-archive due-ness the agent will not
 	// re-test an archive it has already proven — so without this the hub can report a tier unproven
@@ -1707,7 +1710,7 @@ func primaryBackupTargetOf(cfg config.Config) func() hub.ConfiguredBackupTarget
 // disables the cadence (returns a scheduler that just waits) when the cadence is off or the
 // scratch band / restore storage is invalid — a misconfig must not crash the daemon, and the
 // machinery still works on-demand via --selftest=restore-test.
-func buildRestoreTestScheduler(cfg config.Config, px *proxmox.Client, engine *reconcile.Engine, store *backup.Store, rtState *backup.RestoreTestState, inFlight *backup.InFlight, logger *slog.Logger) *backup.Scheduler {
+func buildRestoreTestScheduler(cfg config.Config, px *proxmox.Client, engine *reconcile.Engine, store *backup.Store, rtState *backup.RestoreTestState, inFlight *backup.InFlight, foreign *backup.ForeignKeyLedger, logger *slog.Logger) *backup.Scheduler {
 	// R-86: this is the EVALUATION interval, not the trigger. What decides a test happens is the
 	// per-archive due-check in internal/backup/restoretest_due.go.
 	cadence := cfg.Backup.RestoreTestEvalInterval()
@@ -1726,6 +1729,9 @@ func buildRestoreTestScheduler(cfg config.Config, px *proxmox.Client, engine *re
 	min, max := cfg.Backup.ScratchBand()
 	target := cfg.Backup.BackupTarget()
 	runner := backup.NewBackupRunner(px, target, "", "felhom restore-test", "", logger)
+	if foreign != nil {
+		runner.SetForeignKeyLedger(foreign) // R-366 slice 2: the pick records archives written with another key
+	}
 	// Every configured tier is a rotation candidate, not just the primary.
 	cfgTiers, _ := cfg.Backup.BackupTiers() // warnings already logged where the tiers are armed
 	tierIDs := make([]string, 0, len(cfgTiers))
@@ -2271,7 +2277,7 @@ func runSelftestRestoreTestDue(ctx context.Context, cfg config.Config, logger *s
 		return 1
 	}
 	rtState := backup.NewRestoreTestState(filepath.Join(cfg.OOB.WithDefaults().StateDir, "restore-test-state.json"))
-	sched := buildRestoreTestScheduler(cfg, px, nil, backup.NewStore(), rtState, &backup.InFlight{}, logger)
+	sched := buildRestoreTestScheduler(cfg, px, nil, backup.NewStore(), rtState, &backup.InFlight{}, nil, logger)
 
 	fmt.Printf("eval_interval=%s settle=%s\n", cfg.Backup.RestoreTestEvalInterval(), cfg.Backup.RestoreTestSettle())
 	start := time.Now()