The PBS LXC had no persisted default route. Neither of its network interfaces carried one, and the route the nightly R2 offsite had used for weeks was runtime-only. A reboot removed it.
What the reboot took with it
With the route gone there was no DNS and no R2, and the copy failed.
What the sweep read
The sweep passed the failed copy, because the rc metric it read described the previous night.