REPORT: the night's agent fixes (R-921, R-1070, R-1010), not released

REPORT.md

@@ -1,12 +1,20 @@
-# REPORT — agent: gofmt clean-up and gate (2026-10-19, second day brief)
+# REPORT — agent, evening/night brief 2026-10-19 (code + tests + commit only, NOT released)
 
-No release. Agent 0.160.0 stays the newest release; the operator vouched it on 2026-10-19 (08:24).
+Commit `56aabc7` (CHANGELOG „Unreleased"), scanner wiring `84ef581`. No sudoers, wrapper or config-bundle change.
+The release is the operator's word (STATUS morning list: „Release agent 0.161.0?"), then the vouch.
 
-- `1edfd8e` — `gofmt -w` on the 14 files that were not gofmt-clean. Formatting only; `go build`, `go vet` and
-  `go test ./...` green before the commit.
-- `scripts/gofmt_gate.py` — every Go file under `cmd/` and `internal/` is gofmt-clean (R-1160), the controller's
-  `gofmt_gate.py` shape: exit 1 names each file, a missing gofmt is INCONCLUSIVE on a dev machine and NOT CHECKED (out
-  loud) in CI. Registered in `agent_gates.py` (fast set, so the pre-push hook runs it).
-- Decoys (`scripts/test_gate_decoys.py`, `gofmt_cases`): an unformatted file in a scratch copy → rc 1 naming it; the
-  formatted twin → rc 0; no Go + CI → rc 0 "NOT CHECKED in CI"; no Go on a dev machine → rc 2. Red-proof: with the
-  conviction switched off, the FACT case reported `rc=0 expected 1 - LIVE HOLE`. Restored; `agent_gates.py` all OK.
+- **R-921 — `host_busy` on `GET /backup/status`:** whether the host-wide heavy-operation gate is held (`{busy, what}`),
+  the state in which `POST /backup` answers 409. Controller 0.335.0 (the floor) reads it before any stop. Test
+  `TestBackupStatus_R921_HostBusy`, red-proved (assignment removed → `free gate: host_busy = <nil>`).
+- **R-1070 — tunnel `absent`:** Docker 29 prints „error: no such object" in lower case; the case-sensitive match read
+  a missing cloudflared container as `unknown`, which failed the host OS-update rule (Tester4, 2026-10-15). Now a
+  missing container is `absent`, and the host rule passes it only when the reading from before the step also had no
+  cloudflared container. Tests `TestHostHealthVerdict_R1070_NoTunnelSetUp`, `TestClassifyTunnel` (Docker 29's wording,
+  measured on demo-hp), red-proved both ways.
+- **R-1010 — the janitor's forced snapshot delete:** on „Failed to find logical volume …_vzdump" only, one retry with
+  the API's `force=1` (`DeleteSnapshotForce`; `pvesh usage … -command delete` lists `--force`). Tests
+  `TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone` (6 rows), `TestDeleteSnapshotForce_R1010`, red-proved.
+- **R-986 — the security-scan gate** (tooling): the shared `felhom.eu/scripts/security_scan_gate.py` in the fast set;
+  `.security-accepted` holds 15 accepted test constants; decoys in `test_gate_decoys.py`.
+
+Gates: `go build/vet/test ./...` green; `agent_gates.py --fast` OK; decoys 36 cases OK. CI 2103, 2110 success.