fix 1.23.6: mon pages only from remote suite tip

Host-agent must fetch/reset to origin/main and refuse if HEAD lags.
Refresh suite-overlay from tip after update; do not re-apply stale overlay
over Forgejo by default (was regenerating mon HTML with old site-gen).

host-agent/run-host-report.sh

@@ -152,25 +152,38 @@ UPD_LOG="$LOG_DIR/suite-update-${STAMP}.log"
 : >"$LOG"
 
 # --- suite auto-upgrade BEFORE the HTML log (git noise must not pollute mon pages) ---
+# Always download newest taler-monitoring from Forgejo first. Mon HTML landing pages
+# embed COMMIT/VERSION from this tree — never generate pages from a lagging clone.
 OVERLAY_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/suite-overlay"
-if [ -f "$AGENT_MON/taler-monitoring.sh" ]; then
-  mkdir -p "$OVERLAY_DIR"
-  rsync -a \
-    --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
-    --exclude 'android-test/out*' --exclude '__pycache__' \
-    "$AGENT_MON/" "$OVERLAY_DIR/" 2>/dev/null || true
-fi
 
+# Prefer update-suite from the live suite tree if present (may itself be slightly
+# old until fetch); fall back to agent-bundled copy.
+_upd_src="$AGENT_DIR/update-suite.sh"
+if [ -f "${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh" ]; then
+  _upd_src="${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh"
+fi
 # shellcheck source=update-suite.sh
-if ! source "$AGENT_DIR/update-suite.sh" >"$UPD_LOG" 2>&1; then
+if ! source "$_upd_src" >"$UPD_LOG" 2>&1; then
   echo "ERROR: suite auto-update failed — refusing to run with stale tree" >&2
   echo "       detail: $UPD_LOG" >&2
   tail -n 30 "$UPD_LOG" >&2 || true
   echo "       fix git/network or set SUITE_UPDATE_STRICT=0 only as emergency" >&2
   exit 1
 fi
+unset _upd_src
 if [ -d "${SUITE_DIR:-}/host-agent" ]; then
   AGENT_DIR="${SUITE_DIR}/host-agent"
+  AGENT_MON="${SUITE_DIR}"
+fi
+# After tip reset: refresh suite-overlay FROM remote tip (never the reverse by default).
+# Old behaviour rsynced local agent → overlay *before* fetch, then could re-apply a
+# stale overlay over a fresh Forgejo tree and publish outdated mon-page generators.
+if [ -f "${SUITE_DIR}/taler-monitoring.sh" ]; then
+  mkdir -p "$OVERLAY_DIR"
+  rsync -a --delete \
+    --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
+    --exclude 'android-test/out*' --exclude '__pycache__' \
+    "${SUITE_DIR}/" "$OVERLAY_DIR/" 2>/dev/null || true
 fi
 
 # Now open the public HTML log (clean agent header + suite summary only)
@@ -215,9 +228,11 @@ if [ -f "$OVERLAY_DIR/host-agent/run-host-report.sh" ] \
   && grep -q '_wrap_keys\|_WRAP_SET_' "$OVERLAY_DIR/host-agent/run-host-report.sh" 2>/dev/null; then
   _need_overlay=1
 fi
-if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
-  echo "WARN: Forgejo @ ${COMMIT_SHORT:-?} lagging local suite-overlay (phases=[$PHASES])" >&2
-  echo "      re-applying suite-overlay → $SUITE_MON" >&2
+# Default: never re-apply overlay over a just-fetched remote tip (v1.23.6+).
+# Emergency only: SUITE_ALLOW_STALE_OVERLAY=1 restores old "overlay wins" path.
+if [ "$_need_overlay" = "1" ] && [ "${SUITE_ALLOW_STALE_OVERLAY:-0}" = "1" ] \
+  && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
+  echo "WARN: SUITE_ALLOW_STALE_OVERLAY=1 — re-applying suite-overlay over ${COMMIT_SHORT:-?}" >&2
   mkdir -p "$SUITE_MON"
   rsync -a \
     --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
@@ -225,11 +240,12 @@ if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
     "$OVERLAY_DIR/" "$SUITE_MON/"
   ROOT="$SUITE_MON"
 elif [ "$_need_overlay" = "1" ]; then
-  echo "WARN: Forgejo missing features and no suite-overlay — using agent mon $AGENT_MON" >&2
-  ROOT="$AGENT_MON"
+  echo "WARN: suite @ ${COMMIT_SHORT:-?} may lack phase files for [$PHASES] — using remote tip anyway (push missing features; set SUITE_ALLOW_STALE_OVERLAY=1 only as emergency)" >&2
+  ROOT="$SUITE_MON"
+  echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT"
 else
   echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT"
-  # Do NOT rsync suite-overlay over a fresh Forgejo tree — that reintroduced
+  # Never rsync suite-overlay over a fresh Forgejo tree — that reintroduced
   # stale site-gen/host-agent (bootstrap sticky, old monpages) on stage/betel.
 fi
 unset _need_overlay