# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released

**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read:
`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`.

- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the
  last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the
  clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is
  hub 0.166.0 (felhom.eu, built, not deployed).
- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it
  out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`),
  checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed):
  password SSH refused, key works, the console and the PVE web login keep the password. Patches:
  felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship
  with the next agent release (the operator's vouch) and the next installer tag.
- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from
  the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons.
- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`.
- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.