Night 2026-10-19 Part 10: ep0's first weekly prune matched the dry runs (only tester-1's 10-04 copy removed; every household has a rule) -> R-1162 closed, register 161 -> 160; R-895 and R-435 due dates moved 10-20 -> 10-21 with the reason; P10 evidence

documentation/backlog/CLOSED-ITEMS.md

@@ -33,6 +33,7 @@
 | **R-921** | **When the off-site tier answers BUSY, the household still gets a short stop of every app — with no copy.** (P3) | CLOSED 2026-10-19 — **the measured case is now seen before the stop** (operator answer „add one field", 19:2x): the agent serves its host-wide gate as `host_busy` on `GET /backup/status` (agent `56aabc7`, committed, NOT released — it reaches a box with the next agent release, STATUS's morning question), and controller 0.335.0 (the floor since 18:39 UTC) reads it before any stop: held → no app stopped, each due tier recorded as contention (15-minute skip, one „BLOCKED" alarm after 3 h). An agent without the field keeps the old order (proven live: demo-hp's agent answers no `host_busy`). The race (free at the read, busy at the start) keeps the old short stop, resumed at once. Tests red-proved: agent `TestBackupStatus_R921_HostBusy`; controller `TestR921_NoStopWhileTheHostIsBusy` (without the branch: 3 apps stopped), `…SkipsStillAlarmAfterTheCeiling`, `…OtherAnswersKeepTheOldOrder`, `TestHostBusy_ReadsTheAgentsGate`. A live busy state was not made on 9201 (it needs the new agent there). | `audits/night-2026-10-19/P9/` (release), controller `15ea002`, agent `56aabc7` |
 | **R-953** | **A full ArgoCD sync of the `felhom` app with prune would DELETE three live Secrets and so break the hub and Umami.** (P3) | CLOSED 2026-10-19 — **not reproducing: ArgoCD no longer tracks the three Secrets.** Read back 18:21 UTC (read only, no sync): app `felhom` Synced/Healthy at `a28f162c`, 25 tracked resources, none of them a Secret, none `requiresPruning`, `Deployment/umami` Synced; the three Secrets carry no labels and no annotations (no tracking id). A sync with prune touches only tracked resources, so the next deploy does nothing with them. No manifest change was possible or needed (a `Prune=false` annotation would live on the untracked live object). How the tracking marks went after 2026-10-12 is not recorded. The build-deploy skill's „sync only the hub" line stays. | `audits/night-2026-10-19/P4/r953-readback.txt` |
 | **R-986** | **No dependency or secret scanner runs on any push, so a known-vulnerable library or a committed key is found only by a review like this one.** (P3) | CLOSED 2026-10-19 — **the warn-first gate runs on every push in all four repos.** `felhom.eu/scripts/security_scan_gate.py` (shared, never copied) in each runner's FAST set — pre-push hook and CI: govulncheck v1.8.0 (called vulnerabilities only) on each Go module, gitleaks 8.24.3 on the pushed commits with the default rules pinned; hits listed, exit 0. Accepted hits per repo in `.security-accepted` (gitleaks by rule + a hash of the line + file), reason per line. CI fetches the pinned gitleaks with both sha256 checked (seen in CI 2108: 42 hits, all accepted); CI has no Go, so govulncheck is NOT CHECKED there, out loud — the hook runs it. 8 decoys in scratch repos, red-proved. First scan of today's `main`: 0 called vulnerabilities, 0 real secrets, every gitleaks hit with a verdict. The govulncheck pin moved v1.1.4 → v1.8.0 (v1.1.4 cannot read Go 1.27 code). Warn → fail: R-1168. | `audits/night-2026-10-19/P7/triage.md`, `SCANNERS.md` §5 |
+| **R-1162** | **ep0's whole-guest off-site prune was a count (keep-last 2), so a compromised controller could push out the pre-compromise copy, slowly.** (P3) | CLOSED 2026-10-20 — **the first scheduled run matched the dry runs** (read only on ep0, 03:45–03:47 UTC). The four household prune jobs ran at 03:30 UTC, each `TASK OK`, each `--max-depth 0 --keep-weekly 2`: demo-hp kept 2026-10-08 and 10-15; demo-felhom kept 10-06 and 10-13; Tester-2 kept its one copy (10-04); tester-1 removed 10-04 and kept 10-11 and 10-18 — the only copy removed, as predicted. Copies after: 2, 2, 1, 2. The hub's ep0 read (tenantsync v1.3.0 on ep0, the repo file's sha256) answers `unpruned_checked: true, unpruned: []` when run directly; the hub (0.161.0) logs a PBS-DR refresh every 15 minutes and no „no prune job" line since its start (2026-10-19 14:10 UTC). The operator job (`keep-daily 14 --keep-weekly 8`, 03:45) removed one hub copy (2026-10-06), its own retention. | `audits/night-2026-10-19/P10/01-before.txt`, `02-after.txt` |
 
 ## 2026-10-19 (third day brief) — the passphrase locks once the box uses its own key, every ep0 household gets a prune job, demo-hp's address (full text of each row: `git show 97f27a75:documentation/backlog/OPEN-ITEMS.md`)