R-366 slice 2 (decision 168): the host report carries the archives the restore-test skipped as another key's

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/backup/foreign_key_ledger.go

@@ -0,0 +1,60 @@
+package backup
+
+import (
+	"context"
+	"sort"
+	"sync"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+)
+
+// ForeignKeyLedger (R-366 slice 2, `09` §3 decision 168) holds, per backup tier, the whole-guest archives the
+// restore-test pick skipped because another key wrote them (R-727 — an earlier install of this box). Since R-727 the
+// skip was one INFO log line per archive and nothing else, so after a reinstall the operator was never told that the
+// box's older whole-guest copies are unreadable to it. The host report carries this ledger; the hub raises ONE
+// operator event when it changes.
+//
+// It reports nil until a tier has been evaluated since the agent started, so a restart does not read as "the set
+// changed to empty" (the hub keeps its last state for an absent field).
+type ForeignKeyLedger struct {
+	mu       sync.Mutex
+	byTarget map[string]hub.ForeignKeyArchives
+}
+
+// NewForeignKeyLedger builds an empty ledger.
+func NewForeignKeyLedger() *ForeignKeyLedger {
+	return &ForeignKeyLedger{}
+}
+
+func (l *ForeignKeyLedger) set(target string, n int, oldest, newest int64) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.byTarget == nil {
+		l.byTarget = map[string]hub.ForeignKeyArchives{}
+	}
+	e := hub.ForeignKeyArchives{Target: target, Count: n}
+	if n > 0 {
+		e.Oldest = time.Unix(oldest, 0).UTC().Format(time.RFC3339)
+		e.Newest = time.Unix(newest, 0).UTC().Format(time.RFC3339)
+	}
+	l.byTarget[target] = e
+}
+
+// ForeignKeyArchives implements hub.ForeignKeyArchiveReporter: nil before any evaluation; otherwise the tiers that
+// hold such archives (`Tiers` empty, never nil, when none do), sorted by tier.
+func (l *ForeignKeyLedger) ForeignKeyArchives(context.Context) *hub.ForeignKeyArchivesStanza {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.byTarget == nil {
+		return nil
+	}
+	out := []hub.ForeignKeyArchives{}
+	for _, e := range l.byTarget {
+		if e.Count > 0 {
+			out = append(out, e)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Target < out[j].Target })
+	return &hub.ForeignKeyArchivesStanza{Tiers: out}
+}

internal/backup/r366_foreign_key_ledger_test.go

@@ -0,0 +1,69 @@
+package backup
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
+)
+
+// R-366 slice 2 (`09` §3 decision 168) — the restore-test's skip of an archive written with another key stops being
+// silent: the pick records, per tier, how many it skipped and their time range, and the host report carries it.
+//
+// COMPANION RED-PROOF (observed): remove the `r.foreign.set(...)` call from PickSettledRestoreCandidateOn → this fails
+// with "after one evaluation the ledger must report felhom-pbs: 2 archives …; got []". Restored.
+func TestR366_PickRecordsArchivesWrittenWithAnotherKey(t *testing.T) {
+	api := &fakeBackupAPI{
+		storages: []proxmox.Storage{{Storage: "felhom-pbs", Type: "pbs", EncryptionKey: thisBoxKey}},
+		content: []proxmox.StorageContent{
+			{VolID: "felhom-pbs:backup/ct/9201/2026-09-16T17:27:32Z", Content: "backup", VMID: 9201, Size: 4774114206, CTime: 1789579652, Encrypted: earlierBox2},
+			{VolID: "felhom-pbs:backup/ct/9201/2026-09-16T21:59:54Z", Content: "backup", VMID: 9201, Size: 20811501236, CTime: 1789595994, Encrypted: earlierBox1},
+			{VolID: "felhom-pbs:backup/ct/9201/2026-09-29T19:37:07Z", Content: "backup", VMID: 9201, Size: 3490689830, CTime: 1790710627, Encrypted: thisBoxKey},
+		},
+	}
+	r := NewBackupRunner(api, "local", proxmox.ModeSnapshot, "", "keep-last=1", quiet())
+	l := NewForeignKeyLedger()
+	r.SetForeignKeyLedger(l)
+
+	if got := l.ForeignKeyArchives(context.Background()); got != nil {
+		t.Fatalf("before any evaluation the ledger must be nil (the hub keeps its state); got %v", got)
+	}
+	if _, _, err := r.PickSettledRestoreCandidateOn(context.Background(), "felhom-pbs", time.Time{}); err != nil {
+		t.Fatal(err)
+	}
+	st := l.ForeignKeyArchives(context.Background())
+	want := hub.ForeignKeyArchives{Target: "felhom-pbs", Count: 2, Oldest: "2026-09-16T17:27:32Z", Newest: "2026-09-16T21:59:54Z"}
+	var got []hub.ForeignKeyArchives
+	if st != nil {
+		got = st.Tiers
+	}
+	if len(got) != 1 || got[0] != want {
+		t.Fatalf("after one evaluation the ledger must report felhom-pbs: 2 archives 2026-09-16T17:27:32Z…21:59:54Z; got %v", got)
+	}
+}
+
+// Evaluated and none found → the stanza with `tiers: []`; not evaluated → no stanza at all. Never a null on the wire.
+func TestR366_EvaluatedWithNoneIsAnEmptyList(t *testing.T) {
+	api := &fakeBackupAPI{
+		storages: []proxmox.Storage{{Storage: "felhom-pbs", Type: "pbs", EncryptionKey: thisBoxKey}},
+		content:  []proxmox.StorageContent{{VolID: "felhom-pbs:backup/ct/9201/2026-09-29T19:37:07Z", Content: "backup", VMID: 9201, Size: 3490689830, CTime: 1790710627, Encrypted: thisBoxKey}},
+	}
+	r := NewBackupRunner(api, "local", proxmox.ModeSnapshot, "", "keep-last=1", quiet())
+	l := NewForeignKeyLedger()
+	r.SetForeignKeyLedger(l)
+	b, _ := json.Marshal(hub.HostReport{ForeignKeyArchives: l.ForeignKeyArchives(context.Background())})
+	if strings.Contains(string(b), "foreign_key_archives") {
+		t.Fatalf("not evaluated must omit the stanza; got %s", b)
+	}
+	if _, _, err := r.PickSettledRestoreCandidateOn(context.Background(), "felhom-pbs", time.Time{}); err != nil {
+		t.Fatal(err)
+	}
+	b, _ = json.Marshal(hub.HostReport{ForeignKeyArchives: l.ForeignKeyArchives(context.Background())})
+	if !strings.Contains(string(b), `"foreign_key_archives":{"tiers":[]}`) {
+		t.Fatalf("evaluated with none must report tiers: []; got %s", b)
+	}
+}

internal/backup/runner.go

@@ -66,8 +66,13 @@ type BackupRunner struct {
 	// due-check is served from the local-API handler goroutines.
 	rejectedMu sync.Mutex
 	rejected   map[string]struct{}
+	// foreign (R-366 slice 2) records, per tier, the archives the pick skipped as another key's. nil = not wired.
+	foreign *ForeignKeyLedger
 }
 
+// SetForeignKeyLedger wires the R-366 slice-2 ledger the host report reads.
+func (r *BackupRunner) SetForeignKeyLedger(l *ForeignKeyLedger) { r.foreign = l }
+
 // NewBackupRunner builds a runner. mode defaults to snapshot (works for a stopped guest and
 // for lvm-thin); the caller may pass ModeStop for storages without snapshot support. retention is the
 // per-run prune spec ("keep-last=N", or "" to never prune) — only the periodic local backup sets it.
@@ -370,6 +375,8 @@ func (r *BackupRunner) PickSettledRestoreCandidateOn(ctx context.Context, target
 	var best string
 	var bestCTime int64 = -1
 	known := map[int]bool{} // vmid → the guest exists on this node (asked once per vmid per pick)
+	var foreignN int        // R-366 slice 2: archives skipped as another key's, and their time range
+	var foreignMin, foreignMax int64
 	for _, e := range contents {
 		if e.Content != "backup" {
 			continue
@@ -384,6 +391,13 @@ func (r *BackupRunner) PickSettledRestoreCandidateOn(ctx context.Context, target
 		}
 		if ownKey != "" && !strings.EqualFold(e.Encrypted, ownKey) {
 			r.noteNotAGuestBackupOnce(e, fmt.Sprintf("written by another box (key %s, this box's key %s) — not this box's proof", shortFP(e.Encrypted), shortFP(ownKey)))
+			foreignN++
+			if foreignMin == 0 || e.CTime < foreignMin {
+				foreignMin = e.CTime
+			}
+			if e.CTime > foreignMax {
+				foreignMax = e.CTime
+			}
 			continue
 		}
 		// R-689 (v0.136.0): … OF A GUEST THAT STILL EXISTS here. Measured on demo-hp 2026-09-27 right after
@@ -420,6 +434,9 @@ func (r *BackupRunner) PickSettledRestoreCandidateOn(ctx context.Context, target
 			bestCTime, best = e.CTime, e.VolID
 		}
 	}
+	if r.foreign != nil {
+		r.foreign.set(target, foreignN, foreignMin, foreignMax)
+	}
 	if best == "" {
 		return "", time.Time{}, nil
 	}