# REPORT — the orphan thin check runs only after a failed backup (unreleased) (2026-10-17, night)

Written in ASD-STE100 Simplified Technical English. Architecture read: felhom.eu `documentation/architecture/03-host-agent.md`
(the `FELHOM_THINCHECK` row), `runbooks/whole-guest-backup-orphan-thin.md`, R-1012's closing note.

## In plain words

- Before tonight the agent looked for an orphan thin device before **every** whole-guest backup. To look, it takes a
  short metadata snapshot of the live disk pool. Now it looks **only when the backup's snapshot step has failed** — the
  only moment somebody needs the answer. The operator's failure mail still names the orphan, in the same words.
- **Not released. Not vouched.** The next agent release that the operator vouches carries it. Nothing was copied to a
  box.

## What changed

- `internal/backup/runner.go`: the pre-run check (and its WARN line) is gone; `explainFailure` (after a vzdump start
  failure or a task failure, snapshot mode only) is now the only caller. Comments say so.
- `internal/capability/manifest.go`: the `thin-orphan-check` text says „after a failed whole-guest backup".
- `internal/backup/r1012_thincheck_test.go`: failure → exactly ONE call and the finding in the error; success → ZERO
  calls and a clean record; stop mode → zero calls; unwired → error unchanged.

## Red-proof

The new tests, run against the v0.159.1 `runner.go` (`git show HEAD:…`), then the fix restored:

| test | failed with |
|---|---|
| `TestBackup_SnapshotFailure_NamesTheOrphan/{task_fails,start_fails}` | `thin check ran 2 times, want 1 (after the failure only)` |
| `TestBackup_ThinCheck_SilentWhenNotApplicable` | `success: … Success:true … calls=1 (want no check on a successful backup, clean record)` |

Restored → both PASS; `git diff` on `runner.go` = the fix only.

## Gates

`go build ./... && go vet ./... && go test ./...` and `python3 scripts/agent_gates.py` — results in the session report.

## Not live-validated

No agent was built or delivered (no release tonight). The changed path is the failure path; the next release's live
proof should make one snapshot backup succeed (helper NOT called: no `felhom-thin-check` line in the agent journal
and none in the sudo log for that run) and one fail (the finding in the failure text).