# REPORT — the day of 2026-10-22: the family's mail list, the swap check (D28 = A), the Tester 2 hand-over

**Operator rulings (11:42):** D28 = A; agent 0.162.0 vouched (read back: hub `artifact_agent_version` 0.162.0, 07:57
UTC); Tester 2's laptop used our installer; Tester 2 off, no date. Design read: `08-alarm-ladder.md`,
`05-hub-architecture.md`, `03-host-agent.md`. Baselines: controller `08fa440d`, agent `2d5840ba`, felhom.eu `a9283741`.

## Four lines

1. **Mail list fix live** on the hub (0.165.0) and on Tester 1, demo-hp and demo-felhom (controller 0.339.0, global
   floor). A box with no list of its own now adopts the family's list from the hub; a default never overwrites it.
2. **One family list restored: demo-felhom** (13 events, from the hub's 00:00 UTC snapshot; this morning's release had
   made it 17). After the release demo-felhom adopted it; all six hub rows equal the snapshot.
3. **Swap warning rule:** none, or below 90 % of min(the guests' swap, 8 GB). The two morning alarms cleared at the next
   report (demo-hp 11:04, demo-felhom 11:09 UTC), no mail. No agent change.
4. **Hand-over list:** `documentation/pilot/TESTER2-handover.md`, linked from STATUS.

## Versions, digests, CI

| | version | digest | CI (commit → job) |
|---|---|---|---|
| hub | 0.165.0, DEPLOYED (operator yes; only `Deployment/hub` synced, manifest `25dae2f5`) | `sha256:c6180fb79a2ff7d5546a704c68b634b9207afb0a0ecd524c74b0310434532537` | `5ae5984c` → 2207 success; `25dae2f5` → 2208 success |
| controller | 0.339.0-rc.1 (9202) | `sha256:7d4c88528b50adeb891e409cf50343f44fb168a84e890d42864b8124f3051fdd` | `add310c` → 2206 success |
| controller | 0.339.0, released, global floor (MinAgent 0.158.1) | `sha256:fee71aafceb4a7d5f24ae4a6a273a8d51eb26e0550fe9d12d4d86955f6a343a8` | `fc5a20f` → 2209 success |

Agent: no change. Evidence: `documentation/audits/day-2026-10-22/` (rows before, the restore, rows after, the release
on the three boxes, https-only).

## What was built

- **Hub:** `customer_notifications.household_saved` — set only by the household's own save (`source: household`),
  never cleared; any other push over a marked list → `{"status":"kept"}` (an older controller's push with neither
  address nor clear counts as not the household's — that is 0.338.0's default push); `GET /api/v1/preferences`
  (customer-scoped); one-time backfill (written after creation → a box wrote it): Tester-2 false, Tester4 false,
  demo-felhom / demo-hp / tester-1 / `_resend-rotation-test` true. `host_swap_short` by the new rule.
- **Controller:** start-up — a saved list as before (R-922); none saved → read the hub, adopt a household's, else push
  the default once and save it; unreadable hub → nothing. The swap sentence by the same rule.
- **Contract:** one case table in both repos, byte-identical, each run by a Go test; `scripts/host_swap_rule_gate.py`
  with 4 decoys (`test_host_swap_rule_gate.py`).
- **Red-proofs seen failing:** hub A / A-legacy / C (refusal removed), the swap table and the clear (morning rule), the
  backfill (marking off); controller A / B / unreadable hub (0.338.0's rule), the empty-list test (getter restored),
  the swap table (morning rule).

## Rows

Before 178, after 178. Opened 2: R-1199 (reopened), R-1217 (demo-hp's hub list has 3 app events its page does not
show — P4). Closed 2: R-1199, R-1216.

## Observations

- An empty saved list read back as the 17 defaults (Tester 1, demo-hp) — **NOT-A-FINDING: fixed in this session**
  (size rule; controller CHANGELOG „Fixed without a row").
- The add-only seeds re-added a just-switched-off mail on a new box's second start — **NOT-A-FINDING: fixed in this
  session** (same entry).
- demo-hp: hub mails 3 app events the page does not show — **FILED: R-1217**.
- The cleared swap alarms sent no mail (`host_swap_ok` is info) — **NOT-A-FINDING: the ladder sends no operator mail
  for an info clear; the event row is the record.**
- A docstring test refused my first push (`9c.` is not a gate-list number) — **NOT-A-FINDING: my numbering; fixed
  before the push.**
- The safety check blocked one `sh -c` with a temp-file removal; rewritten with no file to remove — **NOT-A-FINDING:
  nothing was run.**
- 9202 has no hub link, so the rc there proved start-up only — **NOT-A-FINDING: the mail path was proven on the three
  test boxes through the floor.**

## Teardown

- **Machine:** nothing created. 9202 now runs 0.339.0-rc.1 (the scratch box; the floor moves it at its next report if
  it reports — it has no hub link, so set it by hand next time it is needed).
- **Host:** the three test boxes on controller 0.339.0 — intended.
- **Hub:** one row written (demo-felhom's restored list, through `POST /api/v1/preferences`); global floor 0.339.0;
  no per-customer floor left.