installer 1.36.1: http_code prints one status (R-1284, red-proved; committed, not published); R-1285 (BYO drop-in removed one bundle late), R-1286 (demo-hp kimai held since 10-14); release-2026-10-26 evidence: BYO proof, the three boxes on 0.343.0, Homepage gate on the drill

scripts/test_hostinstall.py

@@ -700,6 +700,32 @@ def test_internal_place_runs_after_the_bundle_and_before_provision():
     assert -1 < i_bundle < i_place < i_prov, (i_bundle, i_place, i_prov)
 
 
+# ── http_code prints ONE status (found 2026-10-25, attended release run) ─────────────────────────────────────────────
+# With `-f`, curl prints -w's code AND exits 22 on a 4xx, so the old `curl -f … || curl …` printed the code twice
+# („401401"): the preflight's 401 / 404 / 409 branches never matched and every refusal read „unexpected hub status".
+def _http_code_with(status):
+    sb = Sandbox()
+    try:
+        # a curl stub that answers like the real one: -w prints the status; -f makes a 4xx/5xx exit 22
+        body = ('f=0; for a in "$@"; do case "$a" in --*) ;; -*f*) f=1;; esac; done\n'
+                'printf "%s" STATUS\n[ "$f" = 1 ] && [ STATUS -ge 400 ] && exit 22\nexit 0').replace("STATUS", status)
+        sb.stub("curl", body)
+        rc, out = sb.run(func("http_code") + 'c=$(http_code https://hub.invalid/api/v1/config/x -H "X: y"); printf "[%s]" "$c"')
+        return out
+    finally:
+        sb.close()
+
+
+def test_http_code_prints_one_status_on_a_refusal():
+    for status in ("401", "404", "409"):
+        out = _http_code_with(status)
+        assert out.endswith("[%s]" % status), "http_code printed %r for a %s (the preflight's case never matches)" % (out, status)
+
+
+def test_http_code_prints_the_status_on_success():
+    assert _http_code_with("200").endswith("[200]")
+
+
 def main():
     tests = [(n, f) for n, f in sorted(globals().items()) if n.startswith("test_") and callable(f)]
     fails = 0