D43 = A run close-out: REPORT and CONTEXT. Docs only.

CONTEXT.md

@@ -1,5 +1,10 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-24 night (unattended) — D43 = A on `main` (`c8d3c17`), NOT released (next v0.165.0, with R-1250).** The sshd
+> drop-in's bundle policy is `appliance` (install record `/var/lib/felhom-install/state.json` mode); BYO: nothing written,
+> our copy removed; no proof: untouched. X3: `lan_addresses()` for `sshd -T`. X4: `undo_sshd_step` — only the SSH file is
+> put back. Release + the operator's vouch: Monday's list (felhom.eu STATUS).
+
 > **2026-10-24 (attended release run) — v0.164.0: the weekly upload line test (R-1247; operator ruling 07:26).**
 > `internal/linetest`: the agent's own iperf3 client (operator's pick — nothing installed on hosts) to ep0's tunnel-only
 > server `10.77.0.1:5201`, Tuesday 10:00-15:59, after 10 quiet minutes, under the heavy-op gate, best of 3; `line_test`

REPORT.md

@@ -1,23 +1,16 @@
-# REPORT — a test on request for a box that seeds all day (R-1250), 2026-10-24 (attended)
+# REPORT — D43 = A: BYO hosts keep their own SSH settings (R-1257), 2026-10-24 night (unattended; commit only)
 
-Brief: „two DooPlex backup alarms …", Part 4 (commit only; the release rides the next normal train and needs the
-operator's vouch). Commits `29bcf44` (CI 2286 success) and `1e087bb` (CI 2288 success). Not released.
+Brief: the restore-holes run, Part 4. Starting the run was the operator's ruling **D43 = A**. Previous report (R-1250's
+line hold, attended, same day): `git show f5c3d77:REPORT.md`.
 
-- **What:** `GET /host/line-test` reports `waiting_for_quiet` (due, in the window, tries left, tunnel up, the full
-  10-minute window watched and busy). `POST /host/line-test/run` runs one measurement on request while the controller
-  holds its torrent app: every weekly rule holds except the 10 quiet minutes, which become a 5 s settle and a 10 s quiet
-  check (< 2 Mbit/s); runs 5 s apart; about 55 s. Refusals answer a code; a failed request spends one of the day's tries.
-- **Found live and fixed (`1e087bb`):** a freshly started tester said `waiting_for_quiet` before it had watched a
-  minute — a quiet box's app would have been held for nothing. Now it needs the full window.
-- **Tests:** 7 new, each seen failing (CHANGELOG lists them); a compile-time assertion that the Tester serves the route.
-- **Live (demo-hp host, a probe built from `1e087bb` running the real `Tester` with its minute watcher, plain HTTP):**
-  a real 10 Mbit/s torrent seed → `waiting_for_quiet` after 11 samples (worst minute 10.8); the control request refused
-  `not-quiet` (11.1 Mbit/s); with the controller's hold: runs 93.6 / 89.6 / 94.2 Mbit/s, the request 56.1 s. Evidence:
-  felhom.eu `audits/dooplex-alarms-2026-10-24/part4-r1250-live-proof.txt`.
-- **Teardown:** the probe stopped and deleted from demo-hp; no iperf3 left running; the installed agent (0.164.0) untouched.
-
----
-
-**Also on 2026-10-24 (review round 2, a separate unattended session):** `.claude/rules/unprompted-work.md` aligned with
-its four sibling copies (the missing „A version number is pushed once" paragraph); no code change. The report above is
-the attended session's and is kept as it was.
+- **`configs/felhom-os-apply` (commit `c8d3c17`):** the root-key-only sshd drop-in is an `appliance`-policy file —
+  written only when the root-owned install record says `appliance`; on `byo` nothing is written and a copy we wrote
+  (exact path, our header line) is removed (the previous copy kept for the undo, then `sshd -t` and a reload); a box
+  whose record proves nothing is left as it is. **X3:** the in-force check asks `sshd -T` for each of the host's own
+  global IPv4 addresses. **X4:** a failing `sshd -t` puts back only the SSH file (`sshd_step_undone` in the report);
+  the rest of the bundle stays.
+- **Tests:** `configs/test_felhom_config_bundle.py` class `ByoKeepsItsSSH` (7), each rule seen failing with it taken out
+  (policy back to `replace`; the probe back to 192.0.2.1; `sshd -t` back to `must`). The fake box now carries an
+  appliance record by default; all 68 bundle tests and 146 os-apply tests pass; `agent_gates.py --fast` OK.
+- **Not done here (Monday):** the agent release v0.165.0 and the operator's vouch; a signed bundle on a BYO test host.
+- Docs: felhom.eu `03` (the D4 paragraph) and `11` §1 carry the ruling; register R-1257 → VERIFY.