# REPORT — agent v0.161.0 released and delivered (2026-10-20)

**What:** the three fixes committed on 2026-10-19 (`56aabc7`) — R-921 `host_busy` on `GET /backup/status`, R-1070 a
missing tunnel container is `absent`, R-1010 the janitor forces a half-removed vzdump snapshot once — released as
0.161.0 on the operator's yes (2026-10-20 morning answers) and delivered to the three test hosts. **Not vouched** (the
operator's act).

**Release:** `scripts/release-agent.sh 0.161.0` from a clean clone at `5152123`; package published and verified by
download; tag `v0.161.0` pushed.
- binary sha256 `ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5`
- config bundle sha256 `485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47`

**Delivery (signed `agent_update`, one job per box):** demo-hp 06:38 UTC, Tester 1 06:54, demo-felhom 06:55 — each
`signed op COMPLETED`, `capabilities self-check ok=76 total=76`, `selfupdate: update committed`; the hub reports 0.161.0
for all three.

**Live checks on demo-hp** (felhom.eu `documentation/audits/night2-2026-10-20/P1/`):
- R-921: from inside 9201 with its own token (leaf pinned by the bootstrap fingerprint), `host_busy` read every 15 s
  over a „Mentés most" press (`POST /api/guest-backup/trigger`): 3 × `{"busy": false}`, 24 × `{"busy": true, "what":
  "backup:local"}`, 21 × `{"busy": false}`; the backup completed (7.15 GB, 06:42→06:49 UTC).
- R-1070: the agent's own probe in 9202 (no tunnel) answers `error: no such object: cloudflared` (rc 1) — the exact
  `TestClassifyTunnel` fixture row; 9201 answers `running`.
- R-1010: by its tests (`TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone`, `TestDeleteSnapshotForce_R1010`) —
  a half-removed snapshot on `pve/data` was not made (rule 6).
- Gates: `agent_gates.py --fast` green on `5152123` before the release.

**R-1083 left out, and why:** the code would be small (a root-only subcommand that mints the token and adds the
`local_api` block to an existing guest's `bootstrap.json`), but handing 9202 a key is not safe tonight: its controller
would then book the agent's whole-guest backups, and one of those tiers writes to ep0 (a change on ep0 the brief
forbids); 9202 is also outside the `felhom` pool. The R-1083 row holds what it needs.

**Teardown:** the probe script removed from 9201 and `/tmp` on demo-hp. Nothing else provisioned.