controller (unreleased): R-921 check-first pre-check (no stop while another tier's job is in flight); R-922 email_cleared on a household's deliberate clear

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,12 +1,17 @@
-# REPORT — v0.304.0 released, delivered and proven live (2026-10-09)
+# REPORT — 2026-10-09 (afternoon): R-921 pre-check and R-922 `email_cleared` (UNRELEASED)
 
-The 2026-10-08 work (D1 operator actions, D3 dashboard language, D4 sign-ins survive a restart, D8 hold after a failed
-off-site restore, R-899, R-304, three layout fixes) released as v0.304.0 (`d7bfdcc`, CI 1577 success), MinAgent 0.131.0
-unchanged. Floors 0.304.0 for demo-hp, demo-felhom, tester-1 (07:05 local); all three run it, healthy. Scratch 9202 set
-to 0.304.0 by hand.
+Not released, not delivered: both ship with the next controller release, **after** the hub release that decodes
+`email_cleared` (felhom.eu `d55c590c`). MinAgent unchanged (0.131.0).
 
-Live proofs: **D1** on Tester 1 — `run_job fill-watch` and `offsite_backup_now` done (box log: „checked 3
-filesystem(s)", „backup OK: 3 app(s)"); **D3** — 9202's health banners English for `lang=en`, Hungarian for `lang=hu`;
-**D4** on 9202 — the same cookie works after a restart; after a password change both old cookies are refused, also
-after the next restart; password set back. **D8** not measured (needs a scratch off-site repo).
-Evidence: `felhom.eu/documentation/audits/release-2026-10-09/proofs/`.
+- **R-921 — check first, stop second.** Before a window stops apps, the controller asks the agent which tiers have a
+  backup job in flight (`GET /backup/status`, per tier). Another tier's job running or snapshotted → no app stops; the
+  tier stays due. A refusal after the stop still resumes the apps at once (pinned). Red-proof:
+  `TestR921_NoStopWhileAnotherTiersJobIsInFlight` — before: `3 app(s) stopped for a tier the agent refuses`.
+  **Not covered:** the agent's host-wide busy lock (night OS step, restore test, fstrim), the case measured on demo-hp
+  on 2026-10-08 — no agent endpoint serves it; needs an agent field (felhom.eu R-921, LEFT).
+- **R-922 — a household's clear reaches the hub.** Saving an empty address where one was stored marks it cleared
+  (`settings.json`); every preferences push while it stays empty carries `"email_cleared": true` (omitted otherwise);
+  a never-configured box never sends it; a new address drops it. Red-proof: `TestR922_DeliberateClearSendsEmailCleared`
+  — before: `the push after a deliberate clear carries no email_cleared:true`.
+- Suite: `go test ./... -count=1` rc 0 (35 packages); `controller_gates.py` rc 0. No docker used.
+- Built by a helper session under the brief's fences; reviewed and committed by the main session.