hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

Four paper debts and one fact given a reader. Hub-only — nothing to bake. A4 — the entry about "the tester's machine" named a risk correctly and labelled it in a way that invited deleting it. Established from the hub's own store: `peti-felhom` is a REAL machine (482 reports, 2026-02-27 → 2026-07-15, a named person's own box) and the 3.6 GB with no key and no backup is real. `david` → `tester-1` is a DIFFERENT record with no host, no escrow and no report, ever — deleted 07:55:49 and re-created 07:56:47 this morning. The prompt's premise conflated the two; the register now says which is which. A1 — R-312/R-313/R-303 recorded as DECIDED with their re-open triggers, and moved out of STATUS's "Waiting on you", which is now empty. A3 — day0-install §C.1 said pushing the installer publishes it. It has not since R-110. Corrected, with the two manifest pins named and an outside-verification command; the one copy that repeated it (a dated audit, true when written) carries a superseded note. A5 — standing rule 5: evidence comes off the machine at the end of the phase that produced it, before any revert. Earned twice in three days on the same box at the same point (R-320). Four homes, plus what to do when it is already gone. R-295 hub half — „Beállító kód" everywhere; „Visszaállító kód" retired. New `reenroll` mail kind so the mail names the page a REBUILT box actually shows („A szerver beállítása"), not the „Elfelejtett jelszó" page it has no login screen to reach. Naming only; the acceptance pin proves the secret is untouched. R-319 — the hub models `guest_net` after 23 days of receiving and discarding it. The signal is `heals_last_hour`, not `state`: a guest the watchdog keeps repairing reads healthy between repairs. `heal_succeeded` decoded too (R-260's lesson). Unknown is never drawn as healthy — three absences, three sentences. No alarm, deliberately. Three red-proofs, mutations asserted applied. Wire-gate checked tags 182 → 190. B1 — the operator's 2026-08-12 dispositions were NOT in the register; they are now. Third allowlist kind for the five ruled "no reader wanted"; `reporting_disabled` reclassified redundant. 8 read · 5 deliberately unread · 1 redundant · 6 still owed. Also filed: R-321 (a deliberately-silent box still alarms stale/down — the checker is age-only, and decoding the flag would not have fixed it), R-322 (the claim guard has never scanned the hub; a hand scan returns zero, so it is a scope gap, not a defect).
2026-08-13 10:50:12 +02:00
parent 2d05b29b82
commit 4d6ec7c7bb
22 changed files with 1253 additions and 115 deletions
@@ -75,8 +75,13 @@ func TestCustomerPage_ClaimCardStates(t *testing.T) {
 	if !strings.Contains(html, ">Claimed ") {
 		t.Error("missing the Claimed chip")
 	}
-	if !strings.Contains(html, "Visszaállító kód küldése") {
-		t.Error("claimed state should offer the reset-code button")
+	// R-295: the button says „Beállító kód küldése" — ONE name per secret. It used to read
+	// „Visszaállító kód küldése", a near-homograph of the escrow „Helyreállítási kód".
+	if !strings.Contains(html, "Beállító kód küldése") {
+		t.Error("claimed state should offer the reset-code button, named „Beállító kód küldése”")
+	}
+	if strings.Contains(html, "Visszaállító kód") {
+		t.Error("the retired name „Visszaállító kód” is back on the customer page")
 	}
 }

@@ -776,8 +776,9 @@ func (s *Server) handleConfigUpdate(w http.ResponseWriter, r *http.Request, cust
 }

 // handleClaimResend (v0.50.0, customer-claim arc) rotates the claim/reset code and re-sends it to
-// the REGISTERED customer address — the operator "Kód újraküldése" / "Visszaállító kód küldése"
-// button. The old code stops verifying immediately (single active code); the fresh hash reaches
+// the REGISTERED customer address — the operator "Kód újraküldése" / "Beállító kód küldése"
+// button (R-295: the button used to read „Visszaállító kód küldése"; that name is retired).
+// The old code stops verifying immediately (single active code); the fresh hash reaches
 // the box on its next report ACK (no config bump needed). No plaintext is ever rendered or logged.
 func (s *Server) handleClaimResend(w http.ResponseWriter, r *http.Request, customerID string) {
 	if s.claimEngine == nil {
@@ -263,6 +263,175 @@ func (s *Server) hostNetwork(host *store.Host, reportJSON string) hostNetworkVie
 	return v
 }

+// ── R-319 — the guest-network watchdog gets a reader ────────────────────────────────────────────
+//
+// FIRST OF THE R-264 READERS. The agent has reported `guest_net` on every heartbeat since v0.92.0
+// (R-54, 2026-07-21) and the hub — the component that emails the operator — modelled NONE of it: the
+// string `guest_net` occurred nowhere in this repository. It was stored as raw text inside
+// `report_json` and read by nothing.
+//
+// WHY THIS ONE FIRST. It has a live incident behind it: a killed `dhclient` in a guest took a tunnel
+// down for 1 h 15 m with nobody told (`audits/INCIDENT-guest-dhclient-killed-2026-07-20.md`), and the
+// watchdog built afterwards has been reporting exactly that condition ever since — to a hub that
+// modelled none of it. R-264 named it "the strongest candidate of the twenty-one".
+//
+// WHAT IS ACTUALLY BEING READ, and it is NOT just the current state. The signal is
+// `heals_last_hour`: a guest whose network the watchdog keeps REPAIRING is healthy at every instant
+// anyone looks and is nevertheless failing. Rendering only `state` would give that machine a green
+// tick — which is the exact shape of the defect that drew a failed disk as a healthy empty disk.
+// RepairCount is therefore surfaced beside the state, not behind it.
+//
+// AN UNKNOWN IS NEVER DRAWN AS HEALTHY. Three distinct absences are kept apart, following the
+// companion-flag convention this project settled in August (`hostNetworkView` above is the sibling):
+//   - AgentTooOld  — the agent predates v0.92.0, so absence is EXPECTED but still tells us nothing;
+//   - Reported=false — a new-enough agent sent no stanza (watchdog disabled, or a report that
+//     predates the feature on this box);
+//   - a guest whose `state` is empty or unrecognised → rendered "unknown", never healthy.
+// A malformed stanza degrades to Reported=false and must never 500 the page.
+
+// minAgentForGuestNet is the agent release that first reported `guest_net` (v0.92.0, R-54). Below it
+// the stanza is absent BY CONSTRUCTION, so its absence is unknown-and-expected rather than a finding.
+const minAgentForGuestNet = "0.92.0"
+
+// guestNetGuestView is one owned guest's network health as the watchdog last saw it.
+type guestNetGuestView struct {
+	VMID          int
+	State         string // healthy | unhealthy | static_fault | unknown ("" → unknown)
+	Mode          string // dhcp | static | unknown
+	IP            string
+	HasRoute      bool
+	DHClientAlive bool
+	// RepairCount is `heals_last_hour` — THE SIGNAL. A machine repairing itself over and over is
+	// telling you something that its current state cannot.
+	RepairCount int
+	LastHealAt  string
+	Damped      bool
+	Message     string
+	// Healed / HealSucceeded are carried DELIBERATELY, and together. R-260 is this project's
+	// warning: the OOB decoder mirrored five of the agent's eight fields, and the three it dropped
+	// included the one that decided the question the checker existed to answer. A repair that FAILED
+	// is a different fact from a repair that worked, and the count alone cannot express it — six
+	// successful repairs is a nuisance, six FAILED ones is a guest that is down right now.
+	Healed        bool
+	HealSucceeded bool
+}
+
+// HealFailed reports that the watchdog TRIED to repair this guest and did not succeed. Kept separate
+// from State because the two can disagree: the sweep that failed to heal is not necessarily the sweep
+// that set the state.
+func (g guestNetGuestView) HealFailed() bool { return g.Healed && !g.HealSucceeded }
+
+// Unknown reports whether this guest's state is one the watchdog did not positively assert. An empty
+// or unrecognised state is drawn as unknown; it is never allowed to fall through to the healthy
+// branch. Value receiver — a pointer receiver compiles, vets, passes the suite and 500s at render.
+func (g guestNetGuestView) Unknown() bool {
+	switch g.State {
+	case "healthy", "unhealthy", "static_fault":
+		return false
+	default:
+		return true
+	}
+}
+
+// Repairing reports whether the watchdog has had to repair this guest inside the last hour. This is
+// deliberately independent of State: the whole point is that a REPAIRED guest reads healthy.
+func (g guestNetGuestView) Repairing() bool { return g.RepairCount > 0 }
+
+// guestNetView is the Guest network card's whole view-model.
+type guestNetView struct {
+	// Reported is the ONLY thing that licenses drawing any health at all. False → unknown.
+	Reported bool
+	// AgentTooOld distinguishes "this agent cannot report it" from "a capable agent said nothing".
+	// Both render as unknown; they need different words, and conflating them is how an operator
+	// starts ignoring the card.
+	AgentTooOld bool
+	CheckedAt   string
+	Guests      []guestNetGuestView
+	// RepairingCount / UnhealthyCount drive the card's summary badge. Counted rather than derived in
+	// the template: template logic that computes a verdict is logic nobody tests.
+	RepairingCount int
+	UnhealthyCount int
+	UnknownCount   int
+	// HealFailedCount — repairs ATTEMPTED and not succeeded. Counted separately from
+	// RepairingCount: a failing repair is a harder fact than a frequent one.
+	HealFailedCount int
+}
+
+// Degraded is true when any owned guest is unhealthy OR is being repeatedly repaired. The repair leg
+// is the one that matters: without it a guest the watchdog fixes every ten minutes reports "healthy"
+// for ever.
+func (v guestNetView) Degraded() bool {
+	return v.UnhealthyCount > 0 || v.RepairingCount > 0 || v.HealFailedCount > 0
+}
+
+// parseGuestNet extracts the `guest_net` stanza. A missing or malformed body yields Reported=false
+// (unknown), never an error and never a partial claim of health.
+func parseGuestNet(reportJSON string) guestNetView {
+	v := guestNetView{Guests: []guestNetGuestView{}}
+	if reportJSON == "" {
+		return v
+	}
+	var body struct {
+		GuestNet *struct {
+			CheckedAt string `json:"checked_at"`
+			Guests    []struct {
+				VMID          int    `json:"vmid"`
+				State         string `json:"state"`
+				Mode          string `json:"mode"`
+				IP            string `json:"ip"`
+				HasRoute      bool   `json:"has_route"`
+				DHClientAlive bool   `json:"dhclient_alive"`
+				HealsLastHour int    `json:"heals_last_hour"`
+				Healed        bool   `json:"healed"`
+				HealSucceeded bool   `json:"heal_succeeded"`
+				LastHealAt    string `json:"last_heal_at"`
+				Damped        bool   `json:"damped"`
+				Message       string `json:"message"`
+			} `json:"guests"`
+		} `json:"guest_net"`
+	}
+	// A decode error is NOT propagated: one box's bad field must not break the page for the rest of
+	// the fleet. It degrades to Reported=false, which renders as unknown — the safe direction.
+	if err := json.Unmarshal([]byte(reportJSON), &body); err != nil || body.GuestNet == nil {
+		return v
+	}
+	v.Reported = true
+	v.CheckedAt = body.GuestNet.CheckedAt
+	for _, g := range body.GuestNet.Guests {
+		gv := guestNetGuestView{
+			VMID: g.VMID, State: g.State, Mode: g.Mode, IP: g.IP,
+			HasRoute: g.HasRoute, DHClientAlive: g.DHClientAlive,
+			RepairCount: g.HealsLastHour, LastHealAt: g.LastHealAt,
+			Damped: g.Damped, Message: g.Message,
+			Healed: g.Healed, HealSucceeded: g.HealSucceeded,
+		}
+		switch {
+		case gv.Unknown():
+			v.UnknownCount++
+		case gv.State == "unhealthy" || gv.State == "static_fault":
+			v.UnhealthyCount++
+		}
+		if gv.Repairing() {
+			v.RepairingCount++
+		}
+		if gv.HealFailed() {
+			v.HealFailedCount++
+		}
+		v.Guests = append(v.Guests, gv)
+	}
+	return v
+}
+
+// guestNet builds the card's view-model, applying the version gate before the report is consulted so
+// that an old agent's silence is named as such rather than rendered as a finding.
+func (s *Server) guestNet(host *store.Host, reportJSON string) guestNetView {
+	if host.AgentVersion != "" && semver.Valid(host.AgentVersion) &&
+		semver.Compare(host.AgentVersion, minAgentForGuestNet) < 0 {
+		return guestNetView{Guests: []guestNetGuestView{}, AgentTooOld: true}
+	}
+	return parseGuestNet(reportJSON)
+}
+
 // storageTargetView is the rich per-drive row the host-detail Storage Targets table renders:
 // fill %, role/state, thin-pool, and SMART health/temp/wear. Parsed from the latest report's
 // storage_targets[] (the full hostStorageTarget wire shape lives in the api package; this view
@@ -533,6 +702,9 @@ func (s *Server) hostDetailData(host *store.Host, r *http.Request) map[string]in
 	// v0.85.0 Network — the host's addresses + its WireGuard allocation.
 	network := s.hostNetwork(host, reportJSON)

+	// R-319 Guest network — the R-54 watchdog's per-guest verdict AND its repair count.
+	guestNet := s.guestNet(host, reportJSON)
+
 	// v0.84.0 Console access — presence + username + set_at ONLY. GetHostRecoveryMeta cannot carry
 	// the secret (its query does not select the column); the plaintext reaches the operator solely
 	// through POST /hosts/{id}/reveal-recovery-credential.
@@ -573,6 +745,7 @@ func (s *Server) hostDetailData(host *store.Host, r *http.Request) map[string]in
 		// v0.84.0 break-glass Console access card. NEVER add a key holding the secret.
 		// v0.85.0 Network card (addresses + WireGuard allocation/confirmation).
 		"Network":         network,
+		"GuestNet":        guestNet,
 		"RecoveryVaulted": recoveryMeta != nil,
 		"RecoveryUsername": func() string {
 			if recoveryMeta != nil {
@@ -0,0 +1,259 @@
+package web
+
+// Guest-network card (R-319) — the first R-264 reader.
+//
+// THE FIXTURES BELOW ARE THE REAL WIRE. `liveGuestNetJSON` is the `guest_net` stanza copied verbatim
+// out of `demo-felhom-8363b5`'s newest row in the live hub's `host_reports` table on 2026-08-13
+// (agent 0.129.0). Testing against a hand-written shape would have proved only that the parser
+// matches my own idea of the format — and the defect this whole class comes from (R-260) was exactly
+// a hub-side struct that did not match what the agent actually sends.
+//
+// Every test drives ServeHTTP, so a template gate that never renders is visible here. That is the
+// seam-wiring rule: handler tests prove nothing about reachability, and this project has shipped four
+// features whose entry point was never wired.
+
+import (
+	"strings"
+	"testing"
+)
+
+// The real stanza: one owned guest, healthy, DHCP, no repairs. `heals_last_hour` and friends are
+// ABSENT because the agent marks them `omitempty` and this box has never needed a repair — which is
+// itself the shape scenario A has to survive.
+const liveGuestNetJSON = `{
+  "host": {"cpu_percent": 4.0, "memory_percent": 30.0, "disk_percent": 20.0},
+  "guest_net": {
+    "checked_at": "2026-08-13T08:15:33Z",
+    "guests": [
+      {"vmid": 9201, "state": "healthy", "mode": "dhcp", "ip": "192.168.0.149",
+       "has_route": true, "dhclient_alive": true, "checked_at": "2026-08-13T08:14:30Z",
+       "message": "address, default route and dhclient all present"}
+    ]
+  }
+}`
+
+// The same box after the watchdog has had to keep fixing it — the R-54 heal fields populated. This is
+// the shape the incident of 2026-07-20 would have produced had the watchdog existed then.
+const repairingGuestNetJSON = `{
+  "host": {"cpu_percent": 4.0, "memory_percent": 30.0, "disk_percent": 20.0},
+  "guest_net": {
+    "checked_at": "2026-08-13T08:15:33Z",
+    "guests": [
+      {"vmid": 9201, "state": "healthy", "mode": "dhcp", "ip": "192.168.0.149",
+       "has_route": true, "dhclient_alive": true, "checked_at": "2026-08-13T08:14:30Z",
+       "healed": true, "heal_succeeded": true, "last_heal_at": "2026-08-13T08:09:12Z",
+       "heals_last_hour": 6, "message": "dhclient was absent; restarted"}
+    ]
+  }
+}`
+
+// A report from a capable agent with NO guest_net stanza at all — the watchdog switched off, or a
+// report predating the feature on this box.
+const silentGuestNetJSON = `{"host": {"cpu_percent": 4.0, "memory_percent": 30.0, "disk_percent": 20.0}}`
+
+// The stanza arrives, but its contents are not what the hub expects: `guests` is an object where an
+// array belongs, and `heals_last_hour` is a string. This is what a wire drift or a truncated write
+// looks like from the hub's side.
+const malformedGuestNetJSON = `{
+  "host": {"cpu_percent": 4.0},
+  "guest_net": {"checked_at": "2026-08-13T08:15:33Z", "guests": {"vmid": "nine-two-oh-one"}}
+}`
+
+// ── A — a machine reporting healthy guest networking, no repairs → shown as healthy ─────────────
+//
+// WRONG OUTCOME GUARDED: an empty or alarming state on a machine that is fine. A card that cried
+// unknown on every healthy box would be switched off within a week, and then the B case below would
+// never be seen either.
+func TestGuestNet_A_HealthyRendersHealthy(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0", liveGuestNetJSON, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5")
+
+	if !strings.Contains(body, "Guest network") {
+		t.Fatal("no Guest network card — the reader shows nothing")
+	}
+	if !strings.Contains(body, "192.168.0.149") {
+		t.Error("the guest's address did not reach the page")
+	}
+	if !strings.Contains(body, "badge-ok") {
+		t.Error("a healthy guest must render as healthy, not as an empty or alarming state")
+	}
+	if strings.Contains(body, "needs attention") {
+		t.Error("a machine that is fine is being alarmed on")
+	}
+	// The unknown branches must NOT fire for a box that reported properly.
+	if strings.Contains(body, "does not run the guest-network watchdog") ||
+		strings.Contains(body, "reported no guest-network state") {
+		t.Error("a reporting box rendered one of the unknown sentences")
+	}
+}
+
+// ── B — a machine whose watchdog has repaired the guest repeatedly ──────────────────────────────
+//
+// WRONG OUTCOME GUARDED: a green tick because the CURRENT state is fine. This is the exact shape of
+// the failed-disk-drawn-as-a-healthy-empty-disk defect, and it is the reason this card exists at all:
+// `state` says "healthy" in this fixture, because between repairs it IS.
+func TestGuestNet_B_RepeatedRepairsAreVisible(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0", repairingGuestNetJSON, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5")
+
+	if !strings.Contains(body, "needs attention") {
+		t.Fatal("a guest repaired 6 times in an hour is reported as fine — the whole point of the card")
+	}
+	if !strings.Contains(body, "had their networking repaired in the last hour") {
+		t.Error("the climbing-repairs sentence is missing")
+	}
+	if !strings.Contains(body, ">6<") {
+		t.Error("the repair COUNT is not rendered; 'some repairs' is not the signal, the number is")
+	}
+	if !strings.Contains(body, "2026-08-13T08:09:12Z") {
+		t.Error("the last repair time is not offered (it is in the title attribute)")
+	}
+}
+
+// ── C — a machine that does not report the fact at all → drawn as unknown, never healthy ────────
+//
+// WRONG OUTCOME GUARDED: absence read as good news. THE ONE THAT MATTERS. Two distinct absences are
+// checked because they need different words: an agent that cannot report it, and a capable agent that
+// said nothing.
+func TestGuestNet_C_SilentIsUnknownNotHealthy(t *testing.T) {
+	t.Run("capable agent, no stanza", func(t *testing.T) {
+		s, st, _ := newRevealServer(t)
+		cookie, _ := newRevealSession(t, s)
+		seedNetHost(t, st, "demo-hp-bb76ea", "0.129.0", silentGuestNetJSON, "")
+
+		body := getHostPage(t, s, cookie, "demo-hp-bb76ea")
+
+		if !strings.Contains(body, "reported no guest-network state") {
+			t.Fatal("a silent box must SAY it is unknown")
+		}
+		if strings.Contains(body, "badge-ok") && strings.Contains(body, "Guest network") {
+			assertNoHealthyBadgeInGuestNetCard(t, body)
+		}
+	})
+
+	t.Run("agent too old to report it", func(t *testing.T) {
+		s, st, _ := newRevealServer(t)
+		cookie, _ := newRevealSession(t, s)
+		// 0.91.0 predates the R-54 watchdog (v0.92.0): the absence is expected AND still unknown.
+		seedNetHost(t, st, "old-agent-box", "0.91.0", silentGuestNetJSON, "")
+
+		body := getHostPage(t, s, cookie, "old-agent-box")
+
+		if !strings.Contains(body, "does not run the guest-network watchdog") {
+			t.Fatal("an old agent's silence must be named as an old agent's silence")
+		}
+		if !strings.Contains(body, "<strong>unknown</strong>, not healthy") {
+			t.Error("the unknown-is-not-healthy sentence is missing")
+		}
+		assertNoHealthyBadgeInGuestNetCard(t, body)
+	})
+}
+
+// ── D — the fact arrives malformed → unknown, and the hub does not 500 ──────────────────────────
+//
+// WRONG OUTCOME GUARDED: a page that breaks on one machine's bad field. getHostPage fails the test on
+// any non-200, so surviving the call IS half the assertion.
+func TestGuestNet_D_MalformedIsUnknownAndDoesNotBreakThePage(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0", malformedGuestNetJSON, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5") // 200 or the test dies here
+
+	if !strings.Contains(body, "reported no guest-network state") {
+		t.Fatal("a malformed stanza must degrade to unknown")
+	}
+	assertNoHealthyBadgeInGuestNetCard(t, body)
+}
+
+// A guest whose state string is one the watchdog never asserts (a future value, or a truncated field)
+// is drawn as unknown rather than falling through to the healthy branch. The switch in
+// guestNetGuestView.Unknown is an ALLOW-LIST for exactly this reason: an unrecognised value defaults
+// to unknown, and adding a state to the agent cannot silently paint it green here.
+func TestGuestNet_UnrecognisedStateIsUnknown(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0", `{
+      "host": {"cpu_percent": 1.0},
+      "guest_net": {"checked_at": "2026-08-13T08:15:33Z",
+        "guests": [{"vmid": 9201, "state": "quantum", "mode": "dhcp", "ip": "10.0.0.5"}]}}`, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5")
+
+	if !strings.Contains(body, "partly unknown") {
+		t.Fatal("an unrecognised guest state must summarise as unknown, not healthy")
+	}
+}
+
+// The empty-list case is deliberately NOT the same as silence: the agent's own contract says a stanza
+// with a fresh checked_at and no guests means "the watchdog ran and found nothing to report", and that
+// must stay distinguishable from "the watchdog is not wired" — the shape the v0.91.0 inert seam hid
+// behind.
+func TestGuestNet_EmptyListIsNotSilence(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0",
+		`{"host": {"cpu_percent": 1.0}, "guest_net": {"checked_at": "2026-08-13T08:15:33Z"}}`, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5")
+
+	if !strings.Contains(body, "The watchdog ran and has no guest to report") {
+		t.Fatal("an empty guest list must say the watchdog RAN")
+	}
+	if strings.Contains(body, "reported no guest-network state") {
+		t.Error("an empty list was collapsed into silence — the two are different facts")
+	}
+}
+
+// assertNoHealthyBadgeInGuestNetCard checks that the Guest network card contains no healthy badge.
+// It slices the card out of the page rather than searching the whole body, because `badge-ok` occurs
+// all over a host page (capabilities, storage, WireGuard) and a whole-page search would pass
+// vacuously — which is the "instrument that can drop results silently" trap.
+func assertNoHealthyBadgeInGuestNetCard(t *testing.T, body string) {
+	t.Helper()
+	i := strings.Index(body, "Guest network")
+	if i < 0 {
+		t.Fatal("no Guest network card to slice — the assertion would have passed vacuously")
+	}
+	card := body[i:]
+	if j := strings.Index(card, "</section>"); j >= 0 {
+		card = card[:j]
+	} else {
+		t.Fatal("could not find the end of the Guest network card")
+	}
+	if strings.Contains(card, "badge-ok") {
+		t.Errorf("an UNKNOWN guest-network state rendered a healthy badge:\n%s", card)
+	}
+}
+
+// A repair that was ATTEMPTED and FAILED is a harder fact than a repair that worked, and the count
+// alone cannot express it: six successful repairs is a nuisance, six failed ones is a guest that is
+// down right now. Dropping `heal_succeeded` from the decoder would be R-260 exactly — the OOB decoder
+// mirrored five of eight fields and the three it dropped included the deciding one.
+func TestGuestNet_FailedRepairIsDistinctFromFrequentRepair(t *testing.T) {
+	s, st, _ := newRevealServer(t)
+	cookie, _ := newRevealSession(t, s)
+	seedNetHost(t, st, "demo-felhom-8363b5", "0.129.0", `{
+      "host": {"cpu_percent": 1.0},
+      "guest_net": {"checked_at": "2026-08-13T08:15:33Z",
+        "guests": [{"vmid": 9201, "state": "unhealthy", "mode": "dhcp",
+                    "has_route": false, "dhclient_alive": false,
+                    "healed": true, "heal_succeeded": false, "heals_last_hour": 3,
+                    "message": "dhclient restart did not restore the lease"}]}}`, "")
+
+	body := getHostPage(t, s, cookie, "demo-felhom-8363b5")
+
+	if !strings.Contains(body, "repair failed") {
+		t.Fatal("a repair that was attempted and failed is not distinguished from one that worked")
+	}
+	if !strings.Contains(body, "needs attention") {
+		t.Error("a guest whose repair failed must summarise as needing attention")
+	}
+	assertNoHealthyBadgeInGuestNetCard(t, body)
+}
@@ -473,7 +473,7 @@
                {{if .Claim}}
                <form method="POST" action="/configs/{{.CustomerID}}/claim-resend" style="margin-top: 0.5rem;">
                    {{.CSRFField}}
-                    <button type="submit" class="btn btn-outline btn-sm" data-confirm="Send a fresh code to the registered address? The previous code stops working immediately (the box activates it on its next report, ~15 min).">{{if .Claim.ClaimedAt}}Visszaállító kód küldése{{else}}Kód újraküldése{{end}}</button>
+                    <button type="submit" class="btn btn-outline btn-sm" data-confirm="Send a fresh code to the registered address? The previous code stops working immediately (the box activates it on its next report, ~15 min).">{{if .Claim.ClaimedAt}}Beállító kód küldése{{else}}Kód újraküldése{{end}}</button>
                </form>
                {{end}}

@@ -317,6 +317,82 @@
            {{end}}
        </section>

+        <!-- Guest network (R-319): the R-54 watchdog's verdict per owned guest, and — the reason this
+             card exists — HOW OFTEN IT HAD TO REPAIR EACH ONE. A guest the watchdog keeps fixing is
+             healthy every time anyone looks and is nevertheless failing; showing only the state would
+             give it a green tick, which is the failed-disk-drawn-as-a-healthy-empty-disk defect.
+
+             An unknown is NEVER drawn as healthy. Three absences, three sentences: an agent too old to
+             report it, a capable agent that reported nothing, and a guest whose own state the watchdog
+             did not assert. Each branch of this gate has its own render test (the template-gate rule).
+             The agent has sent this on every heartbeat since v0.92.0 and nothing read it until now. -->
+        <section class="card">
+            <h2>Guest network
+                {{if .GuestNet.AgentTooOld}}<span class="badge badge-neutral" title="This agent predates the guest-network watchdog">unknown</span>
+                {{else if not .GuestNet.Reported}}<span class="badge badge-neutral" title="A capable agent sent no guest-network stanza">unknown</span>
+                {{else if .GuestNet.Degraded}}<span class="badge badge-warn" title="A guest is unhealthy, or is being repaired repeatedly">needs attention</span>
+                {{else if .GuestNet.UnknownCount}}<span class="badge badge-neutral" title="The watchdog did not assert a state for every guest">partly unknown</span>
+                {{else if .GuestNet.Guests}}<span class="badge badge-ok" title="Every owned guest has an address, a default route and a live dhclient">healthy</span>
+                {{end}}
+            </h2>
+
+            {{if .GuestNet.AgentTooOld}}
+            <p class="hint" style="color: var(--text-muted); font-size: 0.85rem;">
+                This host's agent (<code>{{.AgentVersion}}</code>) does not run the guest-network watchdog &mdash;
+                its guests' networking is <strong>unknown</strong>, not healthy. Needs agent <code>0.92.0</code> or newer.
+            </p>
+            {{else if not .GuestNet.Reported}}
+            <p class="hint" style="color: var(--text-muted); font-size: 0.85rem;">
+                This host reported no guest-network state, so it is <strong>unknown</strong> &mdash; not healthy.
+                The watchdog is default-on; a silent capable agent means it was switched off
+                (<code>guest_net.disable</code>), or this report predates it on this box.
+            </p>
+            {{else if .GuestNet.Guests}}
+            <table class="data-table">
+                <thead>
+                    <tr><th>Guest</th><th>State</th><th>Address</th><th>Route</th><th>dhclient</th><th>Repairs (1h)</th></tr>
+                </thead>
+                <tbody>
+                    {{range .GuestNet.Guests}}
+                    <tr>
+                        <td><code>{{.VMID}}</code></td>
+                        <td>
+                            {{if .Unknown}}<span class="badge badge-neutral" title="{{.Message}}">unknown</span>
+                            {{else if eq .State "healthy"}}<span class="badge badge-ok" title="{{.Message}}">healthy</span>
+                            {{else if eq .State "static_fault"}}<span class="badge badge-warn" title="{{.Message}}">static fault</span>
+                            {{else}}<span class="badge badge-error" title="{{.Message}}">unhealthy</span>{{end}}
+                            {{if .HealFailed}}<span class="badge badge-error" title="The watchdog TRIED to repair this guest and did not succeed">repair failed</span>{{end}}
+                            {{if .Damped}}<span class="badge badge-neutral" title="Repairs are rate-limited on this guest">damped</span>{{end}}
+                        </td>
+                        <td>{{if .IP}}<code>{{.IP}}</code> <span class="text-muted">({{.Mode}})</span>{{else}}<span class="text-muted">&mdash;</span>{{end}}</td>
+                        <td>{{if .HasRoute}}yes{{else}}<strong>no</strong>{{end}}</td>
+                        <td>{{if .DHClientAlive}}yes{{else if eq .Mode "static"}}<span class="text-muted">n/a</span>{{else}}<strong>no</strong>{{end}}</td>
+                        <td>
+                            {{if .Repairing}}<span class="badge badge-warn" title="The watchdog repaired this guest's network {{.RepairCount}} time(s) in the last hour — last at {{.LastHealAt}}">{{.RepairCount}}</span>
+                            {{else}}<span class="text-muted">0</span>{{end}}
+                        </td>
+                    </tr>
+                    {{end}}
+                </tbody>
+            </table>
+            {{if .GuestNet.RepairingCount}}
+            <p class="hint" style="font-size: 0.85rem; margin-top: 0.5rem;">
+                <strong>{{.GuestNet.RepairingCount}} guest(s) had their networking repaired in the last hour.</strong>
+                A guest that keeps being repaired reads healthy between repairs and is not. A killed
+                <code>dhclient</code> once took a tunnel down for 1 h 15 m with nobody told; this row is that signal.
+            </p>
+            {{end}}
+            <p class="hint" style="color: var(--text-muted); font-size: 0.85rem; margin-top: 0.5rem;">
+                Last swept {{.GuestNet.CheckedAt}}. One row per owned <em>running</em> guest the watchdog has probed.
+            </p>
+            {{else}}
+            <p class="hint" style="color: var(--text-muted); font-size: 0.85rem;">
+                The watchdog ran and has no guest to report (swept {{.GuestNet.CheckedAt}}). This is
+                distinguishable from silence: the stanza arrived, its guest list is empty.
+            </p>
+            {{end}}
+        </section>
+
        <!-- DR / Backup -->
        <section class="card">
            <h2>DR / Backup</h2>