R-366 slice 2 (decision 168): the host report carries the archives the restore-test skipped as another key's

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/hub/collect.go

@@ -115,6 +115,7 @@ type Collector struct {
 	ctrlSup          ControllerSupervisorReporter                  // R-523: in-guest controller supervisor (nil → stanza omitted)
 	guestNet         GuestNetReporter                              // R-54: per-guest network watchdog (nil → stanza omitted)
 	diskTrim         GuestDiskTrimReporter                         // R-444: weekly guest disk trim (nil → stanza omitted)
+	foreignKey       ForeignKeyArchiveReporter                     // R-366 slice 2 (nil → omitted)
 	selfUpdate       SelfUpdateReporter                            // D1: agent self-update pending status (nil → false)
 	mgmtPlane        MgmtPlaneReporter                             // G1: management-plane health (nil → stanza omitted)
 	oob              OOBReporter                                   // H1: operator-access health (nil → stanza omitted)
@@ -228,6 +229,18 @@ func (c *Collector) SetGuestNetReporter(g GuestNetReporter) *Collector {
 	return c
 }
 
+// ForeignKeyArchiveReporter is the R-366 slice-2 seam: the restore-test's ledger of archives written with another
+// key. nil = not evaluated yet (the stanza is omitted and the hub keeps its state).
+type ForeignKeyArchiveReporter interface {
+	ForeignKeyArchives(ctx context.Context) *ForeignKeyArchivesStanza
+}
+
+// SetForeignKeyArchiveReporter wires the restore-test's foreign-key ledger (R-366 slice 2; nil-safe → omitted).
+func (c *Collector) SetForeignKeyArchiveReporter(r ForeignKeyArchiveReporter) *Collector {
+	c.foreignKey = r
+	return c
+}
+
 // SetGuestDiskTrimReporter wires the R-444 weekly trim job as a report source (nil-safe → stanza omitted).
 func (c *Collector) SetGuestDiskTrimReporter(r GuestDiskTrimReporter) *Collector {
 	c.diskTrim = r
@@ -394,6 +407,10 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 	if c.diskTrim != nil {
 		report.GuestDiskTrim = c.diskTrim.GuestDiskTrimStatus(ctx)
 	}
+	// R-366 slice 2: archives the restore-test skipped as another key's (nil → not evaluated yet → omitted).
+	if c.foreignKey != nil {
+		report.ForeignKeyArchives = c.foreignKey.ForeignKeyArchives(ctx)
+	}
 	// D1: agent self-update pending status (nil reporter → pending=false, the steady state).
 	if c.selfUpdate != nil {
 		report.SelfUpdatePending, report.SelfUpdatePendingVersion = c.selfUpdate.SelfUpdatePending()

internal/hub/report.go

@@ -129,6 +129,12 @@ type HostReport struct {
 	// wired; an empty `guests` list means the job runs and no guest has been trimmed yet. No secret.
 	GuestDiskTrim *GuestDiskTrimStatus `json:"guest_disk_trim,omitempty"`
 
+	// ForeignKeyArchives (R-366 slice 2, `09` §3 decision 168): per backup tier, the whole-guest archives the
+	// restore-test SKIPPED because they were written with another key (an earlier install of this box). This box
+	// cannot open them; the hub turns a CHANGE of this list into one operator event. Absent = not evaluated yet since
+	// the agent started (the hub keeps its last state); `tiers: []` = evaluated, none found.
+	ForeignKeyArchives *ForeignKeyArchivesStanza `json:"foreign_key_archives,omitempty"`
+
 	// LogTail is the agent's on-demand debug-ring tail (v0.83.0 observability) — the agent
 	// mirror of the controller's report log_tails channel. Present ONLY on the heartbeat
 	// right after the control envelope requested it (log_tail_requested); consume-once on
@@ -726,3 +732,18 @@ type WireRestoreDirective struct {
 	Archive string `json:"archive,omitempty"` // source archive/snapshot to restore from
 	VMID    int    `json:"vmid,omitempty"`
 }
+
+// ForeignKeyArchivesStanza wraps the per-tier list so "evaluated, none" (`tiers: []`) differs from "not evaluated"
+// (the stanza absent) without a null on the wire.
+type ForeignKeyArchivesStanza struct {
+	Tiers []ForeignKeyArchives `json:"tiers"`
+}
+
+// ForeignKeyArchives is one tier's count of archives written with another key (R-366 slice 2): the count and the
+// newest/oldest archive time (RFC3339, UTC). No key material — the fingerprints stay on the box.
+type ForeignKeyArchives struct {
+	Target string `json:"target"`
+	Count  int    `json:"count"`
+	Oldest string `json:"oldest"`
+	Newest string `json:"newest"`
+}