R-898: ring 0 stages exactly the told kernel (select listed, KernelSet(kver))

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/kernel.go

@@ -119,8 +119,12 @@ func (l *Leg) runKernel(ctx context.Context, runID string, vmid int, trigger str
 		lg.Info("osupdate: kernel step skipped — ring 1 boots only a kernel a signed os_kernel_step staged", "phase", st.Phase, "staged", st.To, "want", want)
 		return Report{}
 	default:
+		// R-898: EXACTLY the kernel the household was told about — never "whatever is pending tonight" (the sources can
+		// offer a newer one by night; the step then refused, R23, and the night was lost). A version no longer
+		// installable is refused by the wrapper before any change (R7) and the hub tells the household again.
 		wr, cerr := l.call(ctx, runID, kernelPlan("apply", vmid, map[string]any{"release_id": "ring0-" + runID,
-			"select": "pending-kernel", "expect_kver": want, "run_id": runID, "trigger": trigger, "ring": blk.Ring}))
+			"select": "listed", "packages": KernelSet(want), "expect_kver": want, "run_id": runID, "trigger": trigger,
+			"ring": blk.Ring}))
 		rep.unsent = reportFile(l.planDir(), runID, LayerKernel, "apply")
 		rep.Kernel = rawOrNil(wr.Kernel)
 		switch {
@@ -322,6 +326,21 @@ func truncate(s string, n int) string {
 	return s[:n]
 }
 
+// KernelSet is the package set that installs exactly kver (R-898; the hub's kernelSet, field-exact): the series
+// meta-package and the signed image, both at the kernel's own version. Proxmox keeps old kernel versions in its archive.
+// nil for a string that is not a kernel version.
+func KernelSet(kver string) []Package {
+	m := kverSeriesRE.FindStringSubmatch(kver)
+	if m == nil {
+		return nil
+	}
+	v := kver[:len(kver)-len("-pve")]
+	return []Package{{Name: "proxmox-kernel-" + m[1], Version: v, Origin: PVEOrigin},
+		{Name: "proxmox-kernel-" + kver + "-signed", Version: v, Origin: PVEOrigin}}
+}
+
+var kverSeriesRE = regexp.MustCompile(`^([0-9]+\.[0-9]+)\.[0-9]+-[0-9]+-pve$`)
+
 // KernelStepParams are a signed os_kernel_step's params: the exact kernel set (the wrapper compares it with the plan).
 type KernelStepParams struct {
 	ReleaseID string    `json:"release_id"`

internal/osupdate/kernel_test.go

@@ -54,8 +54,12 @@ func TestKernel_Ring0ToldNightStagesThenReboots(t *testing.T) {
 			ap = x
 		}
 	}
-	if ap["select"] != "pending-kernel" || ap["expect_kver"] != kNew || ap["lane"] != "slow" {
-		t.Fatalf("stage plan = %v", ap)
+	// R-898: EXACTLY the told kernel — the listed set derived from it, never "pending" (red before the fix: select was
+	// pending-kernel, so a newer kernel in the sources by night was refused R23 and the night was lost)
+	pk, _ := json.Marshal(ap["packages"])
+	if ap["select"] != "listed" || ap["expect_kver"] != kNew || ap["lane"] != "slow" ||
+		string(pk) != `[{"name":"proxmox-kernel-7.0","origin":"Proxmox Debian Repository","version":"7.0.14-22"},{"name":"proxmox-kernel-7.0.14-22-pve-signed","origin":"Proxmox Debian Repository","version":"7.0.14-22"}]` {
+		t.Fatalf("stage plan = %v (packages %s)", ap, pk)
 	}
 	if p.Kernel.Outcome != "staged" || !p.Kernel.Healthy {
 		t.Fatalf("kernel report = %+v", p.Kernel)
@@ -312,3 +316,13 @@ func TestKernel_KeptStageReportIsStaged(t *testing.T) {
 		t.Fatalf("kept = %+v", rep)
 	}
 }
+
+func TestKernelSet(t *testing.T) {
+	if got := KernelSet("7.0.14-20-pve"); len(got) != 2 || got[0].Name != "proxmox-kernel-7.0" || got[0].Version != "7.0.14-20" ||
+		got[1].Name != "proxmox-kernel-7.0.14-20-pve-signed" {
+		t.Fatalf("%+v", got)
+	}
+	if KernelSet("7.0; reboot") != nil || KernelSet("") != nil {
+		t.Fatal("a non-kernel string must give no set")
+	}
+}