## TL;DR
A host skipped for maintenance mode was not patched, so it must never be counted compliant. Fix the agent state model: skipped is its own terminal-for-this-wave state that carries into a follow-up queue, and compliance is computed only from host-side verified installs. Then re-run the skipped hosts when their maintenance mode clears, and correct the historical report so decisions are not made on inflated compliance numbers.

```text
patch agent skipped hosts in maintenance mode and reported them compliant
```

## Use this when
- Compliance for a wave looks complete, but sampling hosts shows some never installed the update and were in maintenance mode at the time.
- The agent log shows skip decisions, while the summary counts those hosts as successful or compliant.
- Maintenance mode is set in a monitoring or orchestration tool the agent checks before installing.

## Not for this skill when
- Hosts were intentionally excluded from the wave scope and reported as out of scope. That is correct reporting.
- Hosts installed the update but the report is stale. That is a reporting sync problem, not a skip classification problem.

## Steps
1. Reconcile the wave honestly: take the wave host list and classify every host from host-side evidence - installed update present or not - and compare it with the agent report. List every host the report calls compliant that does not actually carry the update, and quantify how much of the reported compliance those hosts represent. Verify: you have a corrected compliance figure and a named list of falsely compliant hosts
2. Trace why skipped became compliant in the agent logic: follow one skipped host through its run records from the maintenance check to the final status write. Common causes are a default success status that the skip path forgets to override, or a summary that counts every host not marked failed as compliant. Verify: the exact code path or status mapping that converts a skip into compliance is identified
3. Change the state model so the bug cannot recur silently: introduce an explicit skipped state with a reason field, make wave completion require every host to be in a named terminal state, and make the compliance calculation count only verified installed states. Add a test case with a maintenance mode host to the agent test suite that asserts it can never be reported compliant. Verify: a test run with a planted maintenance mode host reports it skipped with reason, and the summary compliance excludes it
4. Schedule the recovery automatically: skipped hosts enter a follow-up queue keyed to the reason, and when maintenance mode clears - by polling the same source the agent checked - the agent offers or runs the patch in the next approved window and updates the host record from its new verified state. Verify: skipped hosts are visibly queued, and clearing maintenance mode on a test host moves it into the follow-up flow without manual re-adding
5. Correct the record and notify the report consumers: issue a corrected wave report showing true compliance, the skipped count with reasons, and the recovery plan, because decisions about risk acceptance and audit evidence may already have been made from the inflated number. Keep the original and corrected reports linked so the change is auditable. Verify: stakeholders receive a corrected report and the wave record shows both figures with the correction explained

## Why it happens
Patch compliance is a safety claim, and maintenance mode skips are a legitimate operational decision that becomes dangerous only when reporting erases them. Agent pipelines often model outcomes as success or failure, so a host that was deliberately not attempted falls into whichever bucket the default logic assigns - and if summaries count not-failed as compliant, every skip silently inflates the number decision makers trust. A fleet can then believe a critical vulnerability is remediated while a set of hosts, often important ones that are frequently in maintenance, remain exposed. An explicit skipped state with its own recovery path keeps the operational flexibility without lying in the summary.

## Variants and edge cases
### Hosts in maintenance mode for weeks at a time
Some systems live in near-permanent maintenance. Escalate those hosts for a negotiated patch window at the process level; the agent should surface them as a standing exception list, not a per-wave skip.

### Agent skips hosts for other reasons with the same bug
Apply the same explicit state treatment to every non-install outcome: offline, locked, out of scope, and deferred each need their own state and follow-up, not a shared silent pass.

### Compliance is reported to an external dashboard
Fix the export mapping as well as the agent. Dashboards that receive only a percentage hide the composition; export counts per state so consumers can see skips.

Compatibility: Applies to patch orchestration agents integrating maintenance mode from monitoring or ITSM tools such as Configuration Manager, ServiceNow, or custom schedulers.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bHSqnI4dpLCouTCYfwGuRg