v0.173.0 released (not vouched): CHANGELOG, REPORT, CONTEXT — the folder clean-up measured on three boxes, the rollback proven on Tester 1

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,23 +1,57 @@
-# REPORT — the self-update folder cleans itself (R-1368 part 2) — committed, NOT released (2026-11-10, operator brief)
+# REPORT — v0.173.0 released and delivered to the three test boxes; NOT vouched yet (2026-11-10, attended)
 
-**Plain words first.** Each agent update left its downloaded file on the box for ever: 49 files and 740 MB on demo-hp.
-The agent now removes the old files after an update that ended well. It keeps the file of the version that runs.
-This is a commit only. No version, no build, no vouch. No box has it. It waits for the next agent release.
+**Plain words first.** Each agent update left its downloaded file on the box for ever. Version 0.173.0 removes the old
+files after an update that ended well. It is released and it runs on the three test boxes. The folders went from
+49, 48 and 33 files to 1 file each. A rollback still works after the clean-up. The operator's vouch is still open.
 
-The full report of the run is in `felhom.eu`: `REPORT-endings-kernels-fixes-2026-11-10.md`.
+The full report of the run is in `felhom.eu`: `REPORT-release-space-fixes-2026-11-10.md`.
+
+## One claim that was wrong
+
+The CHANGELOG entry and the report of the morning said: a box cleans its folder at the first good update AFTER the
+release. That was wrong. The commit runs in the new binary. So the box cleans the folder at the commit of the update
+that brings the code. Measured on three boxes; the CHANGELOG entry is corrected.
+
+## The release
 
 | | |
 |---|---|
-| Change | `internal/selfupdate/prune.go` (new); the call in `MaybeCommit` (`commit.go`); one lock in `Execute` (`executor.go`) |
-| Rule | After the wrapper's `commit` returned success: remove every staged binary but the running version's |
-| Never removed | anything while `pending.json` exists or cannot be read; anything at a plain start or after a rollback; `pending.json`; a folder; a symlink; a name the code does not know |
-| Rollback | Needs `pending.json` and `/usr/local/bin/felhom-agent.prev`. It reads no staged binary (`configs/felhom-selfupdate-guarded`, read first) |
-| Tests | `TestPrune_*`, 6 tests. One runs the wrapper's real `commit` and `rollback` verbs from a sandboxed copy |
-| Red seen | 3 times: no prune call; no pending refusal; no regular-file check |
-| Gates | `python3 scripts/agent_gates.py --fast`: all OK |
-| Not reached | `/usr/local/bin/felhom-agent.bak-*`: root-owned, made by a person. R-1368 part 4 stays open |
-| Not proven | On a box. A box cleans its folder at the first good update AFTER the release that brings this code |
-| Machines | None touched by this change |
+| Version | 0.173.0, `scripts/release-agent.sh` from a clean clone of `776025c8` (tag `v0.173.0`) |
+| Agent sha256 | `752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea` |
+| Bundle sha256 | `51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1` |
+| CI | `776025c8`: run 2608, `gates #311`, success (read by commit on the public Actions page) |
+| Delivery | one signed `agent_update` per box. No bundle job: `configs/` did not change since v0.172.1 |
+| Vouch | **not given yet.** `pinned.day0_agent` stays 0.172.1 until the vouch is read back from the hub |
 
-**Next.** A release session builds and vouches it. After two updates on a test box, read the folder: it must hold one
-binary.
+## The folder `/var/lib/felhom-agent/selfupdate`, before and after
+
+| Box | Before (on 0.172.1) | After the commit of 0.173.0 | Commit (UTC) |
+|---|---|---|---|
+| demo-hp | 49 entries, 722,596 KB | 1 entry, 16,028 KB | 14:59:19, `removed=49` |
+| demo-felhom | 48 entries, 706,968 KB | 1 entry, 16,028 KB | 14:51:50, `removed=48` |
+| Tester 1 | 33 entries, 497,244 KB | 1 entry, 16,028 KB | 15:00:19, `removed=33` |
+
+After each commit: `pending.json` absent, `/usr/local/bin/felhom-agent.prev` = 0.172.1, the unit active, no restart.
+
+## The rollback proof (Tester 1)
+
+1. A signed `agent_update` to 0.172.1 (the vouched version) was uploaded at 15:01:19 UTC. The box took it at its next
+   report, 15:14:31 UTC. The wrapper installed 0.172.1 and wrote the pending marker.
+2. At 15:14:40 UTC, inside the 60-second dwell, one `systemctl kill -s SEGV` hit the agent's main process.
+3. The unit's `OnFailure` ran the wrapper's `rollback`. Journal: `rolled back to previous binary and restarted
+   felhom-agent.service`. 0.173.0 started at 15:14:40 UTC.
+4. Read at 15:15:56 UTC: agent 0.173.0, active, `pending.json` absent, no failed unit. The folder holds 2 files
+   (32,040 KB): the running version's and the failed 0.172.1. The failed file stays by design, until the next good
+   update.
+
+This is the path the repo already has. No second version was released for the proof.
+
+## What stays open
+
+- The operator's vouch.
+- `/usr/local/bin/felhom-agent.bak-*` (R-1368 part 4): demo-felhom holds 11 such files, demo-hp 1. The agent cannot
+  reach them.
+- After a rollback, `/usr/local/bin/felhom-agent.prev` holds the same version as the running binary. That is how the
+  wrapper works; it is not new.
+
+Evidence: felhom.eu `documentation/audits/release-space-fixes-2026-11-10/agent/`.