# REPORT — two agent fixes on main, NOT released (night 2026-10-28 → 29, unattended)

**Plain words first.** Two changes are on main and tested. Neither is released: an agent release needs the operator's
vouch, and the night brief allowed no release. Both go on the morning list.

## What changed

- **R-528 — the OOM counter (`6f933d6`, CI run id 2473 / #284 green).** New local-API route `GET /guest/oom-kills`. It
  reads the kernel's `oom_kill` count of each Docker container of the token's own guest, on the host, from
  `/sys/fs/cgroup/lxc/<vmid>/ns/system.slice/docker-<id>.scope/memory.events` (mode 0444, readable by the non-root
  agent user). Docker inside an LXC guest does not see these kills (`OOMKilled` stays false). The controller reads the
  route every 30 s (controller `eed23e7`). Tests `TestR528_*`, red first by mutation (another guest's container served;
  `oom` parsed for `oom_kill`).
- **R-1254 — the escrow ceremony half (`5ddd124`, CI run id 2471 / #283 green).** After an escrow upload that fails, the
  agent asks the hub which package it holds (the identity blob compared): the new one → success; another one → 502 and
  „the previous code still works"; no answer → 504, which promises nothing. Tests `TestR1254_*`, red first.

## Live proof

- R-528, 2026-10-28 23:27 UTC on Tester 1 with a test build of this agent (put back after: 0.167.0, sha256 `28bdd282…`).
  A Radicale capped at 128 MB, a memory hog inside it killed: the host counter 0 → 1, one `app_oom` „seen by
  docker,cgroup", one mail to the operator with `"source":"docker,cgroup"`. Evidence: felhom.eu
  `documentation/audits/night-2026-10-28/r528-oom/`.
- R-1254: no live proof. It needs a hub answer lost on purpose; that is a hub change, and no hub deploy runs at night.

## Next

The agent release (the operator's vouch), then `pinned.day0_agent` in `scripts/retention-policy.json` (D50).
The controller needs no MinAgent change for R-528: an old agent answers 404, and the controller then waits 10 minutes
before it asks again.