felhom-agent/REPORT.md

REPORT — agent, evening/night brief 2026-10-19 (code + tests + commit only, NOT released)

Commit 56aabc7 (CHANGELOG „Unreleased"), scanner wiring 84ef581. No sudoers, wrapper or config-bundle change. The release is the operator's word (STATUS morning list: „Release agent 0.161.0?"), then the vouch.

• R-921 — host_busy on GET /backup/status: whether the host-wide heavy-operation gate is held ({busy, what}), the state in which POST /backup answers 409. Controller 0.335.0 (the floor) reads it before any stop. Test TestBackupStatus_R921_HostBusy, red-proved (assignment removed → free gate: host_busy = <nil>).
• R-1070 — tunnel absent: Docker 29 prints „error: no such object" in lower case; the case-sensitive match read a missing cloudflared container as unknown, which failed the host OS-update rule (Tester4, 2026-10-15). Now a missing container is absent, and the host rule passes it only when the reading from before the step also had no cloudflared container. Tests TestHostHealthVerdict_R1070_NoTunnelSetUp, TestClassifyTunnel (Docker 29's wording, measured on demo-hp), red-proved both ways.
• R-1010 — the janitor's forced snapshot delete: on „Failed to find logical volume …_vzdump" only, one retry with the API's force=1 (DeleteSnapshotForce; pvesh usage … -command delete lists --force). Tests TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone (6 rows), TestDeleteSnapshotForce_R1010, red-proved.
• R-986 — the security-scan gate (tooling): the shared felhom.eu/scripts/security_scan_gate.py in the fast set; .security-accepted holds 15 accepted test constants; decoys in test_gate_decoys.py.

Gates: go build/vet/test ./... green; agent_gates.py --fast OK; decoys 36 cases OK. CI 2103, 2110 success.