hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/cmd/hub/main.go

@@ -447,7 +447,7 @@ func main() {
 		logger.Printf("[WARN] osupdates: %d TEST approval(s) cancelled at start: %s", len(cancelled), strings.Join(cancelled, ", "))
 	}
 	logger.Printf("[INFO] osupdates: approval rule = every ring-0 box healthy for %s and %d night run(s)", osSvc.ApproveAfter, osSvc.NightsRequired)
-	logger.Printf("[INFO] osupdates: the Docker engine set is approved only by the operator, after %d healthy ring-0 night(s)", osSvc.DockerNights)
+	logger.Printf("[INFO] osupdates: the Docker engine set is approved only by the operator, after %d healthy ring-0 night(s)", osSvc.DockerNightsEffective())
 	apiHandler.SetOSUpdateService(osSvc)
 	webServer.SetOSUpdateAdmin(osSvc)
 	// `11` §8.3: the four alarm thresholds are configuration (decided by CC unattended — operator may reverse).
@@ -662,6 +662,7 @@ func main() {
 				wgReconciler := wgsync.NewReconciler(dataStore, wgClient, logger)
 				go wgReconciler.Run(ctx)
 				apiHandler.SetWGSyncer(wgReconciler)
+				webServer.SetWGPeerSync(wgReconciler.Trigger) // R-600: the customer delete pushes at once
 				logger.Printf("[INFO] WG peer-sync enabled (endpoint %s, user %s)", wgAddr, wgUser)
 			}
 		} else {

hub/cmd/hub/r600_wiring_test.go

@@ -0,0 +1,34 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"testing"
+)
+
+// R-600 seam wiring: main() must hand the WG reconciler's Trigger to the web server, or the customer
+// delete cascade's immediate peer push is dead code and the deleted box's peer lingers on the endpoint
+// until the next 5-minute tick. RED-PROOF: delete the SetWGPeerSync call → this test fails.
+func TestR600_MainWiresWGPeerSyncIntoWeb(t *testing.T) {
+	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wired := false
+	ast.Inspect(f, func(n ast.Node) bool {
+		c, ok := n.(*ast.CallExpr)
+		if !ok {
+			return true
+		}
+		if sel, ok := c.Fun.(*ast.SelectorExpr); ok && sel.Sel.Name == "SetWGPeerSync" && len(c.Args) == 1 {
+			if arg, ok := c.Args[0].(*ast.SelectorExpr); ok && arg.Sel.Name == "Trigger" {
+				wired = true
+			}
+		}
+		return true
+	})
+	if !wired {
+		t.Error("cmd/hub/main.go never calls webServer.SetWGPeerSync(<reconciler>.Trigger) — the delete cascade cannot push the peer removal")
+	}
+}

hub/cmd/hub/r855_docker_nights_log_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"strings"
+	"testing"
+)
+
+// R-855: the start log line naming the Docker approval nights must print the EFFECTIVE count
+// (osSvc.DockerNightsEffective()), not the raw field, whose TEST "none" value is -1 and printed
+// "after -1 healthy ring-0 night(s)". RED-PROOF: pass osSvc.DockerNights → this test fails.
+func TestR855_StartLogPrintsEffectiveDockerNights(t *testing.T) {
+	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found, effective := false, false
+	ast.Inspect(f, func(n ast.Node) bool {
+		c, ok := n.(*ast.CallExpr)
+		if !ok || len(c.Args) < 2 {
+			return true
+		}
+		lit, ok := c.Args[0].(*ast.BasicLit)
+		if !ok || !strings.Contains(lit.Value, "healthy ring-0 night(s)") {
+			return true
+		}
+		found = true
+		if call, ok := c.Args[1].(*ast.CallExpr); ok {
+			if sel, ok := call.Fun.(*ast.SelectorExpr); ok && sel.Sel.Name == "DockerNightsEffective" {
+				effective = true
+			}
+		}
+		return true
+	})
+	if !found {
+		t.Fatal("main.go no longer logs the Docker approval nights — update this test with the new line")
+	}
+	if !effective {
+		t.Error("the Docker approval-nights start log must print osSvc.DockerNightsEffective(), not the raw field")
+	}
+}