REPORT/CHANGELOG: agent 0.159.2 delivered and proven on demo-hp

CHANGELOG.md

@@ -1,6 +1,6 @@
-## Unreleased — the orphan thin check runs only after a failed backup (R-1012 follow-up) (2026-10-17)
+## v0.159.2 — the orphan thin check runs only after a failed backup (R-1012 follow-up) (2026-10-18)
 
-**Not released, not vouched; the next vouched agent release carries it.** v0.159.0/v0.159.1 ran the R-1012 orphan check
+**Released 2026-10-18 (committed 2026-10-17): sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`, bundle `477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9`; the vouch is the operator's.** No `configs/` change since v0.159.1. The independent review of 2026-10-18 found nothing in it. v0.159.0/v0.159.1 ran the R-1012 orphan check
 before EVERY snapshot-mode whole-guest backup, and that check takes a short metadata snapshot of the live thin pool.
 Now `BackupRunner` runs it only when the snapshot step has failed (the vzdump start or its task) — the moment the
 answer is needed. The finding is still appended in plain words to the failed backup's error, exactly as before; a
@@ -10,8 +10,8 @@ successful backup never runs the check and keeps a clean record; stop mode and a
 `TestBackup_ThinCheck_SilentWhenNotApplicable` (now: 0 calls on a successful backup), red-proved against the v0.159.1
 `runner.go`: failure legs „thin check ran 2 times, want 1", success leg `calls=1`. No root file, sudoers or bundle
 change. (Installer side, felhom.eu, same night: `felhom-host-install.sh --rotate-recovery-only`, R-1141.)
-**Owed by the release that carries it (not yet proven live):** one green snapshot backup with NO `felhom-thin-check`
-call in the journal, and one failed snapshot backup whose error carries the finding.
+**Proven live 2026-10-18 (demo-hp):** a green snapshot backup with 0 `felhom-thin-check` calls (the 0.159.1 night backup
+had 1). The failed leg stays covered by the fixture test.
 
 ## v0.159.1 — the signed decommission prunes the guest-bind record (found by v0.159.0's own live proof) (2026-10-17)
 

REPORT.md

@@ -1,41 +1,12 @@
-# REPORT — the orphan thin check runs only after a failed backup (unreleased) (2026-10-17, night)
+# REPORT — agent v0.159.2 released (2026-10-18)
 
-Written in ASD-STE100 Simplified Technical English. Architecture read: felhom.eu `documentation/architecture/03-host-agent.md`
-(the `FELHOM_THINCHECK` row), `runbooks/whole-guest-backup-orphan-thin.md`, R-1012's closing note.
+**In plain words.** The pool check that names an orphan snapshot now runs only after a whole-box backup has failed — not
+before every backup. Released today; it runs on demo-hp, Tester 1 and demo-felhom. The vouch is the operator's.
 
-## In plain words
-
-- Before tonight the agent looked for an orphan thin device before **every** whole-guest backup. To look, it takes a
-  short metadata snapshot of the live disk pool. Now it looks **only when the backup's snapshot step has failed** — the
-  only moment somebody needs the answer. The operator's failure mail still names the orphan, in the same words.
-- **Not released. Not vouched.** The next agent release that the operator vouches carries it. Nothing was copied to a
-  box.
-
-## What changed
-
-- `internal/backup/runner.go`: the pre-run check (and its WARN line) is gone; `explainFailure` (after a vzdump start
-  failure or a task failure, snapshot mode only) is now the only caller. Comments say so.
-- `internal/capability/manifest.go`: the `thin-orphan-check` text says „after a failed whole-guest backup".
-- `internal/backup/r1012_thincheck_test.go`: failure → exactly ONE call and the finding in the error; success → ZERO
-  calls and a clean record; stop mode → zero calls; unwired → error unchanged.
-
-## Red-proof
-
-The new tests, run against the v0.159.1 `runner.go` (`git show HEAD:…`), then the fix restored:
-
-| test | failed with |
-|---|---|
-| `TestBackup_SnapshotFailure_NamesTheOrphan/{task_fails,start_fails}` | `thin check ran 2 times, want 1 (after the failure only)` |
-| `TestBackup_ThinCheck_SilentWhenNotApplicable` | `success: … Success:true … calls=1 (want no check on a successful backup, clean record)` |
-
-Restored → both PASS; `git diff` on `runner.go` = the fix only.
-
-## Gates
-
-`go build ./... && go vet ./... && go test ./...` and `python3 scripts/agent_gates.py` — results in the session report.
-
-## Not live-validated
-
-No agent was built or delivered (no release tonight). The changed path is the failure path; the next release's live
-proof should make one snapshot backup succeed (helper NOT called: no `felhom-thin-check` line in the agent journal
-and none in the sudo log for that run) and one fail (the finding in the failure text).
+- sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`, bundle
+  `477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9`, tag `v0.159.2`; no `configs/` change since 0.159.1.
+- Live proof on demo-hp: a whole-guest backup of 9201 (snapshot mode, completed) wrote **0** `felhom-thin-check` sudo
+  lines; the night's backup on 0.159.1 wrote 1. The failure leg is covered by `TestBackup_SnapshotFailure_NamesTheOrphan`.
+- Delivered on the operator's yes by signed jobs (agent_update + agent_config_update): all three hosts `update
+  committed`, capability probe 75/75. Evidence: felhom.eu `documentation/audits/day-2026-10-18/P4/`.
+- The independent review of 2026-10-18 found nothing in this change.