CHANGELOG + CONTEXT + REPORT: v0.161.0 released (operator yes) and delivered to demo-hp, Tester 1, demo-felhom; not vouched; R-1083 left out

CHANGELOG.md

@@ -1,7 +1,13 @@
-## Unreleased (2026-10-19) — three fixes for the next release (R-921, R-1070, R-1010); two texts made true after 0.160.0
+## v0.161.0 — three fixes (R-921, R-1070, R-1010); two texts made true after 0.160.0 (2026-10-20) — RELEASED on the operator's yes, NOT VOUCHED
 
-Not released (the night brief of 2026-10-19: agent code + tests + commit only; the release is the operator's word). No
+Released 2026-10-20 (operator yes, the morning answers) with `scripts/release-agent.sh` from a clean clone at `5152123`:
-sudoers, wrapper or config-bundle change.
+binary sha256 `ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5`, config bundle sha256
+`485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47`, tag `v0.161.0`. Delivered by one signed
+`agent_update` job per box to demo-hp (06:38 UTC), Tester 1 (06:54) and demo-felhom (06:55): each `signed op COMPLETED`,
+`capabilities self-check ok=76 total=76`, `update committed`. **The vouch is the operator's.** Live on demo-hp: `host_busy`
+answers `{"busy": true, "what": "backup:local"}` during a „Mentés most" whole-guest backup and `{"busy": false}` before
+and after (read from inside 9201 with its own token; felhom.eu `audits/night2-2026-10-20/P1/`). R-1083 (a key for an
+existing guest) is NOT in this release: see the R-1083 row. No sudoers, wrapper or config-bundle change.
 
 - **R-921 — `GET /backup/status` says when the host is busy.** New field `host_busy` (`{busy, what}`): whether the
   host-wide heavy-operation gate is held right now (another guest's backup, the restore test, a night OS step, the

CONTEXT.md

@@ -1,5 +1,10 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-20 — v0.161.0 RELEASED (operator yes), NOT VOUCHED; on demo-hp, Tester 1, demo-felhom** (signed jobs, all
+> committed, 76/76). R-921 `host_busy` (proven live on demo-hp during a press), R-1070 the tunnel `absent` state (9202's
+> real Docker 29 answer is the fixture row), R-1010 the janitor's one `force=1`. Vouch: version 0.161.0, sha256
+> `ff4e6dc5…99d3b5`, bundle `485f36c9…12c47`. R-1083 left out on purpose: an agent key for 9202 would make its
+> controller book whole-guest backups through the agent, one tier writing to ep0 — the R-1083 row says what is needed.
 > **2026-10-19 — v0.160.0 RELEASED (operator yes), NOT VOUCHED; on demo-hp, Tester 1, demo-felhom.** R-1093, R-978,
 > R-973 (below) plus R-1149 (the local tier prunes `keep-daily=N`, `BackupTier.PruneSpec`) and R-1151 (a claim with
 > `{"defer_upload": true}` keeps the package until `POST /escrow/ceremony/confirm` brings the two words at the drawn

REPORT.md

@@ -1,20 +1,32 @@
-# REPORT — agent, evening/night brief 2026-10-19 (code + tests + commit only, NOT released)
+# REPORT — agent v0.161.0 released and delivered (2026-10-20)
 
-Commit `56aabc7` (CHANGELOG „Unreleased"), scanner wiring `84ef581`. No sudoers, wrapper or config-bundle change.
+**What:** the three fixes committed on 2026-10-19 (`56aabc7`) — R-921 `host_busy` on `GET /backup/status`, R-1070 a
-The release is the operator's word (STATUS morning list: „Release agent 0.161.0?"), then the vouch.
+missing tunnel container is `absent`, R-1010 the janitor forces a half-removed vzdump snapshot once — released as
+0.161.0 on the operator's yes (2026-10-20 morning answers) and delivered to the three test hosts. **Not vouched** (the
+operator's act).
 
-- **R-921 — `host_busy` on `GET /backup/status`:** whether the host-wide heavy-operation gate is held (`{busy, what}`),
+**Release:** `scripts/release-agent.sh 0.161.0` from a clean clone at `5152123`; package published and verified by
-  the state in which `POST /backup` answers 409. Controller 0.335.0 (the floor) reads it before any stop. Test
+download; tag `v0.161.0` pushed.
-  `TestBackupStatus_R921_HostBusy`, red-proved (assignment removed → `free gate: host_busy = <nil>`).
+- binary sha256 `ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5`
-- **R-1070 — tunnel `absent`:** Docker 29 prints „error: no such object" in lower case; the case-sensitive match read
+- config bundle sha256 `485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47`
-  a missing cloudflared container as `unknown`, which failed the host OS-update rule (Tester4, 2026-10-15). Now a
-  missing container is `absent`, and the host rule passes it only when the reading from before the step also had no
-  cloudflared container. Tests `TestHostHealthVerdict_R1070_NoTunnelSetUp`, `TestClassifyTunnel` (Docker 29's wording,
-  measured on demo-hp), red-proved both ways.
-- **R-1010 — the janitor's forced snapshot delete:** on „Failed to find logical volume …_vzdump" only, one retry with
-  the API's `force=1` (`DeleteSnapshotForce`; `pvesh usage … -command delete` lists `--force`). Tests
-  `TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone` (6 rows), `TestDeleteSnapshotForce_R1010`, red-proved.
-- **R-986 — the security-scan gate** (tooling): the shared `felhom.eu/scripts/security_scan_gate.py` in the fast set;
-  `.security-accepted` holds 15 accepted test constants; decoys in `test_gate_decoys.py`.
 
-Gates: `go build/vet/test ./...` green; `agent_gates.py --fast` OK; decoys 36 cases OK. CI 2103, 2110 success.
+**Delivery (signed `agent_update`, one job per box):** demo-hp 06:38 UTC, Tester 1 06:54, demo-felhom 06:55 — each
+`signed op COMPLETED`, `capabilities self-check ok=76 total=76`, `selfupdate: update committed`; the hub reports 0.161.0
+for all three.
+
+**Live checks on demo-hp** (felhom.eu `documentation/audits/night2-2026-10-20/P1/`):
+- R-921: from inside 9201 with its own token (leaf pinned by the bootstrap fingerprint), `host_busy` read every 15 s
+  over a „Mentés most" press (`POST /api/guest-backup/trigger`): 3 × `{"busy": false}`, 24 × `{"busy": true, "what":
+  "backup:local"}`, 21 × `{"busy": false}`; the backup completed (7.15 GB, 06:42→06:49 UTC).
+- R-1070: the agent's own probe in 9202 (no tunnel) answers `error: no such object: cloudflared` (rc 1) — the exact
+  `TestClassifyTunnel` fixture row; 9201 answers `running`.
+- R-1010: by its tests (`TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone`, `TestDeleteSnapshotForce_R1010`) —
+  a half-removed snapshot on `pve/data` was not made (rule 6).
+- Gates: `agent_gates.py --fast` green on `5152123` before the release.
+
+**R-1083 left out, and why:** the code would be small (a root-only subcommand that mints the token and adds the
+`local_api` block to an existing guest's `bootstrap.json`), but handing 9202 a key is not safe tonight: its controller
+would then book the agent's whole-guest backups, and one of those tiers writes to ep0 (a change on ep0 the brief
+forbids); 9202 is also outside the `felhom` pool. The R-1083 row holds what it needs.
+
+**Teardown:** the probe script removed from 9201 and `/tmp` on demo-hp. Nothing else provisioned.