os-apply: tell an UPDATED conffile from a KEPT one (dpkg's two shapes, measured live on demo-hp)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

configs/test_felhom_os_apply.py

@@ -136,7 +136,7 @@ class Fake:
                     if "=" in x and not x.startswith("-") and "::" not in x:
                         n, v = x.split("=", 1)
                         self.installed[n] = v
-                return 0, "Setting up libc6 ...\n", ""
+                return 0, getattr(self, "install_out", "Setting up libc6 ...\n"), ""
         if cmd == "df":
             return 0, f"Avail\n{self.free}\n", ""
         if cmd == "docker":
@@ -438,6 +438,21 @@ class Refusals(unittest.TestCase):
         self.refused(f, "R13")
 
 
+class Conffiles(unittest.TestCase):
+    # dpkg's two shapes, measured live 2026-10-04: an unchanged file is UPDATED; a locally changed one is KEPT.
+    def test_updated_vs_kept(self):
+        f = Fake()
+        f.install_out = ("Installing new version of config file /etc/debian_version ...\n"
+                         "Configuration file '/etc/ssh/sshd_config'\n ==> Modified (by you or by a script) since installation.\n"
+                         " ==> Keeping old config file as default.\n")
+        rc, rep = run(f)
+        self.assertEqual(rc, 0, rep)
+        self.assertIn("os-apply: CONFFILE updated /etc/debian_version (it was not changed locally)", f.logs)
+        self.assertTrue(any(l.startswith("os-apply: CONFFILE kept /etc/ssh/sshd_config") for l in f.logs), f.logs)
+        self.assertEqual(rep["conffiles_kept"], ["/etc/ssh/sshd_config"])
+        self.assertFalse(any("kept /etc/debian_version" in l for l in f.logs), "an updated file must not be reported as kept")
+
+
 class Failure(unittest.TestCase):
     def test_install_failure_is_rc3_with_dpkg_state(self):
         f = Fake()