R-898: ring 0 stages exactly the told kernel (select listed, KernelSet(kver))

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/kernel.go

@@ -119,8 +119,12 @@ func (l *Leg) runKernel(ctx context.Context, runID string, vmid int, trigger str
 		lg.Info("osupdate: kernel step skipped — ring 1 boots only a kernel a signed os_kernel_step staged", "phase", st.Phase, "staged", st.To, "want", want)
 		return Report{}
 	default:
+		// R-898: EXACTLY the kernel the household was told about — never "whatever is pending tonight" (the sources can
+		// offer a newer one by night; the step then refused, R23, and the night was lost). A version no longer
+		// installable is refused by the wrapper before any change (R7) and the hub tells the household again.
 		wr, cerr := l.call(ctx, runID, kernelPlan("apply", vmid, map[string]any{"release_id": "ring0-" + runID,
-			"select": "pending-kernel", "expect_kver": want, "run_id": runID, "trigger": trigger, "ring": blk.Ring}))
+			"select": "listed", "packages": KernelSet(want), "expect_kver": want, "run_id": runID, "trigger": trigger,
+			"ring": blk.Ring}))
 		rep.unsent = reportFile(l.planDir(), runID, LayerKernel, "apply")
 		rep.Kernel = rawOrNil(wr.Kernel)
 		switch {
@@ -322,6 +326,21 @@ func truncate(s string, n int) string {
 	return s[:n]
 }
 
+// KernelSet is the package set that installs exactly kver (R-898; the hub's kernelSet, field-exact): the series
+// meta-package and the signed image, both at the kernel's own version. Proxmox keeps old kernel versions in its archive.
+// nil for a string that is not a kernel version.
+func KernelSet(kver string) []Package {
+	m := kverSeriesRE.FindStringSubmatch(kver)
+	if m == nil {
+		return nil
+	}
+	v := kver[:len(kver)-len("-pve")]
+	return []Package{{Name: "proxmox-kernel-" + m[1], Version: v, Origin: PVEOrigin},
+		{Name: "proxmox-kernel-" + kver + "-signed", Version: v, Origin: PVEOrigin}}
+}
+
+var kverSeriesRE = regexp.MustCompile(`^([0-9]+\.[0-9]+)\.[0-9]+-[0-9]+-pve$`)
+
 // KernelStepParams are a signed os_kernel_step's params: the exact kernel set (the wrapper compares it with the plan).
 type KernelStepParams struct {
 	ReleaseID string    `json:"release_id"`