Night 2026-10-19: register 161 -> 161 (closed R-921, R-953, R-986; opened R-1168..R-1170; R-1001/R-1011/R-1010/R-1070/R-1167 READY, R-893 READY with the measured design note -> D20, R-1083 gap); morning list in STATUS; 03/05/07/11 updated; R-893 evidence

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,14 @@
 
 ---
 
+## 2026-10-19 (evening/night brief) — no stop for a busy host, the scanner on every push, the ArgoCD prune danger gone (full text of each row: `git show f92fa5a8:documentation/backlog/OPEN-ITEMS.md`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-921** | **When the off-site tier answers BUSY, the household still gets a short stop of every app — with no copy.** (P3) | CLOSED 2026-10-19 — **the measured case is now seen before the stop** (operator answer „add one field", 19:2x): the agent serves its host-wide gate as `host_busy` on `GET /backup/status` (agent `56aabc7`, committed, NOT released — it reaches a box with the next agent release, STATUS's morning question), and controller 0.335.0 (the floor since 18:39 UTC) reads it before any stop: held → no app stopped, each due tier recorded as contention (15-minute skip, one „BLOCKED" alarm after 3 h). An agent without the field keeps the old order (proven live: demo-hp's agent answers no `host_busy`). The race (free at the read, busy at the start) keeps the old short stop, resumed at once. Tests red-proved: agent `TestBackupStatus_R921_HostBusy`; controller `TestR921_NoStopWhileTheHostIsBusy` (without the branch: 3 apps stopped), `…SkipsStillAlarmAfterTheCeiling`, `…OtherAnswersKeepTheOldOrder`, `TestHostBusy_ReadsTheAgentsGate`. A live busy state was not made on 9201 (it needs the new agent there). | `audits/night-2026-10-19/P9/` (release), controller `15ea002`, agent `56aabc7` |
+| **R-953** | **A full ArgoCD sync of the `felhom` app with prune would DELETE three live Secrets and so break the hub and Umami.** (P3) | CLOSED 2026-10-19 — **not reproducing: ArgoCD no longer tracks the three Secrets.** Read back 18:21 UTC (read only, no sync): app `felhom` Synced/Healthy at `a28f162c`, 25 tracked resources, none of them a Secret, none `requiresPruning`, `Deployment/umami` Synced; the three Secrets carry no labels and no annotations (no tracking id). A sync with prune touches only tracked resources, so the next deploy does nothing with them. No manifest change was possible or needed (a `Prune=false` annotation would live on the untracked live object). How the tracking marks went after 2026-10-12 is not recorded. The build-deploy skill's „sync only the hub" line stays. | `audits/night-2026-10-19/P4/r953-readback.txt` |
+| **R-986** | **No dependency or secret scanner runs on any push, so a known-vulnerable library or a committed key is found only by a review like this one.** (P3) | CLOSED 2026-10-19 — **the warn-first gate runs on every push in all four repos.** `felhom.eu/scripts/security_scan_gate.py` (shared, never copied) in each runner's FAST set — pre-push hook and CI: govulncheck v1.8.0 (called vulnerabilities only) on each Go module, gitleaks 8.24.3 on the pushed commits with the default rules pinned; hits listed, exit 0. Accepted hits per repo in `.security-accepted` (gitleaks by rule + a hash of the line + file), reason per line. CI fetches the pinned gitleaks with both sha256 checked (seen in CI 2108: 42 hits, all accepted); CI has no Go, so govulncheck is NOT CHECKED there, out loud — the hook runs it. 8 decoys in scratch repos, red-proved. First scan of today's `main`: 0 called vulnerabilities, 0 real secrets, every gitleaks hit with a verdict. The govulncheck pin moved v1.1.4 → v1.8.0 (v1.1.4 cannot read Go 1.27 code). Warn → fail: R-1168. | `audits/night-2026-10-19/P7/triage.md`, `SCANNERS.md` §5 |
+
 ## 2026-10-19 (third day brief) — the passphrase locks once the box uses its own key, every ep0 household gets a prune job, demo-hp's address (full text of each row: `git show 97f27a75:documentation/backlog/OPEN-ITEMS.md`)
 
 | Row | What | Closed | Evidence |