ATTRIBUTION — who makes the requests, and who leaks the descriptors window 2026-08-18 ~09:51Z -> 2026-08-20 08:03Z (166251 s = 46.18 h) user agent endpoint requests req/day libwww-perl/6.78 pvestatd: GET /admin/datastore 81192 42195 proxmox-backup-client/1.0 GET .../felhom-offsite/status 80061 41607 libwww-perl/6.78 GET .../felhom-offsite/snapshots 1131 588 Go-http-client/1.1 GET .../felhom-offsite/snapshots 387 201 Go-http-client/1.1 GET /version 371 193 Go-http-client/1.1 POST .../verify + task status 53 28 TOTAL (both boxes, all agents) 163215 84822 LEAKED DESCRIPTORS OVER THE SAME WINDOW: 388 (all ESTABLISHED on :8007) requests by libwww-perl + proxmox-backup-client : 162404 descriptors leaked: 0 requests by Go-http-client/1.1 (felhom-agent) : 811 descriptors leaked: 388 Go-http-client GET .../snapshots calls : 387 leaked ESTAB sockets : 388 -> ratio 1.0026 (ONE per call, within 1) Per box, at the instant of reading A: ep0 ESTAB from 10.77.0.2 (demo-felhom) = 194 ; from 10.77.0.3 (demo-hp) = 194 demo-felhom ESTAB to 10.77.0.1:8007 = 194 ; demo-hp = 194 194 + 194 = 388 = ep0 total. Both sides agree EXACTLY -> Q2 outcome (a). CADENCE RECONCILIATION (why 194 and not 185): hub report poll poll_seconds=900 -> 184.7 cycles in the window pbs VerifyLoop DefaultVerifyCadence=6h -> 7.7 cycles in the window sum -> 192.4 observed leaked/box: 194 observed POST .../verify per box in the window: 8 (matches 7.7) observed GET /version per box: ~185.5 (matches the 184.7 hub cycles) Mean interval between leaked descriptors, per box: 857 s = 14.28 min (900 s poll + a 6 h verify cycle superposed)