v0.292.0: cloudflared readiness health check (R-841) — tunnel --metrics localhost:20241 run + Docker healthcheck on cloudflared's own /ready; the host agent reports running/not_running/unknown from State.Health

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,8 +1,9 @@
-# REPORT — v0.291.0: decision 78 (R-726) and the infrastructure images (R-838) — 2026-10-04
+# REPORT — v0.292.0: cloudflared readiness health check (R-841) — 2026-10-04
 
-Full session report: `felhom.eu/REPORT-os-guest-lane-2026-10-04.md`.
+Full session report: `felhom.eu/REPORT-os-host-lane-2026-10-04.md`.
 
-- **R-726 (decision 78):** a claimed box that never made an off-site copy sets an orphaned old copy aside on its first
-  night and starts a new one; nothing deleted. Red-proved both ways.
-- **R-838:** traefik v3.7.13, cloudflared 2026.9.3, filebrowser 1.5.6-stable; a running file browser is now moved by a
-  release (only its image line changes). `scripts/check-infra-pins.py` for the monthly re-test.
+- The cloudflared compose gains a Docker health check that asks cloudflared itself whether the tunnel is connected
+  (`/ready` on a fixed loopback metrics port). The host agent (v0.141.0) reads it and reports the tunnel as running,
+  not running or unknown; the hub (v0.131.0) alarms after two not-running reports.
+- Tests: render test pins the health check and the command; red-proof recorded in the audit folder.
+- Live: see the session report (both demo boxes, cloudflared recreated once, state `healthy`).