fix(aiops): escalate failed host verification

apps/api/tests/test_auto_repair_service.py

@@ -335,6 +335,43 @@ class TestAutoRepairService:
         assert decision.can_auto_repair is True
         assert decision.blocked_by is None
 
+    def test_failed_verification_escalates_for_host_backup_ssh_playbook(self, service):
+        """Failed backup SSH diagnostics must not synthesize K8s rollback."""
+        playbook = Playbook(
+            playbook_id="PB-BACKUP-SSH",
+            name="Backup SSH diagnostics",
+            description="Read-only backup diagnosis",
+            status=PlaybookStatus.APPROVED,
+            symptom_pattern=SymptomPattern(
+                alert_names=["HostBackupFailed"],
+                affected_services=["test-service"],
+            ),
+            repair_steps=[
+                RepairStep(
+                    step_number=1,
+                    action_type=ActionType.SSH_COMMAND,
+                    command="ssh {host} 'tail -80 /var/log/backup.log'",
+                    risk_level=RiskLevel.LOW,
+                ),
+            ],
+            success_count=20,
+            failure_count=1,
+        )
+        incident = create_test_incident(
+            severity=Severity.P2,
+            alert_category="backup_failure",
+            alert_name="HostBackupFailed",
+        )
+
+        assert service._should_escalate_failed_verification(incident, playbook) is True
+
+    def test_failed_verification_allows_k8s_rollback_for_k8s_playbook(self, service):
+        """K8s playbooks may still use the existing K8s rollback path."""
+        playbook = create_high_quality_playbook(risk_level=RiskLevel.MEDIUM)
+        incident = create_test_incident(severity=Severity.P2)
+
+        assert service._should_escalate_failed_verification(incident, playbook) is False
+
     @pytest.mark.asyncio
     async def test_evaluate_low_risk_allowed(self, service, mock_playbook_service):
         """Test that LOW risk actions are allowed"""