REPORT: v0.335.0 is the floor (R-921)

REPORT.md

@@ -1,14 +1,29 @@
-# REPORT — controller v0.334.0 (2026-10-19, third day brief)
+# REPORT — controller v0.335.0 (2026-10-19 evening/night brief, Part 1 + Part 9)
 
-**Shipped and the floor for every box** (14:31 UTC, MinAgent 0.158.1) after Tester 1, demo-hp and demo-felhom took it by
-the normal update path (per-box floors 14:16 UTC) and the box walk was green on all three. Image `0.334.0` digest
-`sha256:deeabe59d932cd60f8939a37bccf94f145555101fc7be64b6c5cc15f3557031a`, built from `546eef3`; rc.1 on demo-hp only.
+## What changed
 
-- **R-1159 (operator decision D19 „box key first, then lock"):** the live config refresh pulls `GET /api/v1/box-config/{id}`
-  with the box's own hub key (`report.PullConfigPreferKey`, wired in `main.go`'s `ConfigRefresher`); the retrieval
-  passphrase only against a hub without the route or before the box has a key; a refused key is never retried with the
-  passphrase. Hub 0.161.0 then refuses passphrase keys for a box on this version that has reported.
-- Tests: `TestR1159_RefreshUsesTheBoxKey` (red-proved: the old pull made 0 key pulls), `TestR1159_MainWiresTheKeyFirstRefresh`.
-- Live on demo-hp: the box's own key → 200 with its config, a wrong key → 401; after its first 0.334.0 report the
-  passphrase → 409 with no key (felhom.eu `audits/day-2026-10-19c/P4/`).
-- Box walk (`P5/`): 0 unhealthy, 0 allow-list refusals, catalog in sync; https-only 28 OK; „Fájlok ↗" unchanged.
+**R-921 — no app stop for an off-site (or any whole-guest) tier the agent will refuse because its host is busy.**
+Before any app is stopped the quiesce loop reads the agent's new `host_busy` answer on `GET /backup/status`
+(felhom-agent, Unreleased `56aabc7`, operator answer „add one field" 2026-10-19). Held → no app stopped, no backup
+asked, each due tier recorded as contention (skip 15 min, one „BLOCKED" alarm after 3 h). Free, an older agent, or a
+failed read → the old order (stop, ask, resume at once on 409). The window's own tier in flight attaches as before.
+The race (free at the read, busy at the start) keeps the old behaviour: one short stop, resumed at once.
+
+## Tests (red-proved)
+
+- `TestR921_NoStopWhileTheHostIsBusy` — without the branch: 3 apps stopped, the start refused.
+- `TestR921_HostBusySkipsStillAlarmAfterTheCeiling` — a gate that never lets go still alarms once.
+- `TestR921_HostBusyOtherAnswersKeepTheOldOrder` — free / older agent / failed read / own tier in flight.
+- `TestHostBusy_ReadsTheAgentsGate` — the wire shape; no field = „not known", never „free".
+
+## Release (decision 250)
+
+- `0.335.0-rc.1` on demo-hp 9201 by hand (18:08 UTC): healthy, 0 `[ERROR]`. The live agent's `GET /backup/status`
+  carries no `host_busy` (read inside 9201) — so until the agent release every box keeps the old order.
+- `0.335.0` image `sha256:262831f97cec39ecc3fad9bd198de5cb4ee59fc398cdf828604df5de84d4daae` (from `15ea002`).
+- Per-box floors 18:22:21 UTC; all three moved by 18:37:36 UTC (demo-hp from rc.1).
+- Box walk 18:38–18:39 UTC: 0 unhealthy, 0 allow-list refusals, catalog in sync on all three; https-only 28 OK,
+  0 FAIL; „Fájlok ↗" with no second sign-in on demo-hp and Tester 1.
+- **Global floor 0.335.0 / MinAgent 0.158.1 at 18:39:26 UTC**, read back from hub.db + WAL; per-box floors cleared.
+- Evidence: `felhom.eu/documentation/audits/night-2026-10-19/P9/`.
+- i18n: no page changed, no fixture changed.