R-528 (09 decision 157): after a Docker engine step the wrapper proves the engine reports a memory kill

felhom-os-apply: a docker-layer apply runs oom_check() after health_after and reports
"oom_check": {result pass|fail|error, oom_killed, oom_event, exit_code, image, detail}.
One throwaway container (the controller's image, --pull never, --network none, 64m cap,
label felhom.oomcheck=1) runs dd bs=200M; pass only with OOMKilled=true AND the oom event
(read after a 2 s settle, --until = guest epoch + 1: measured on demo-hp, an --until taken
right after the run missed the event). docker rm -f always runs in a finally; every call
is bounded (<= 90 s). It never changes the step's outcome or health. New wrapper-only mode
"oom-check" (docker layer) runs the check alone; check_guest etc. still apply.

Agent: WrapperReport/Report gain OOMCheck (json:"oom_check"), copied unchanged in runLayer
and in the kept-copy path.

Tests: 9 wrapper tests + 2 Go tests, each red-proofed (audits/readback-2026-10-07/F/red-*.txt).
Also: test_felhom_os_apply.py's `if __name__` sat mid-file, so 11 tests (UnsentReport,
SaveReportOnDisk, AgentDiesMidPass, CrashLeftTheJournal) never ran as a script or from
TestWrapperSuite; moved to the end (they pass).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/leg_test.go

@@ -98,9 +98,13 @@ func (f *fakeWrapper) RunStdin(ctx context.Context, _ io.Reader, name string, ar
 	return f.Run(ctx, name, args...)
 }
 
-type fakeHub struct{ reports []Report }
+type fakeHub struct {
+	reports []Report
+	bodies  [][]byte // the exact bytes posted (R-528: the oom_check object must arrive unchanged)
+}
 
 func (h *fakeHub) PostOSReport(_ context.Context, body []byte) error {
+	h.bodies = append(h.bodies, append([]byte(nil), body...))
 	var r Report
 	json.Unmarshal(body, &r)
 	h.reports = append(h.reports, r)
@@ -504,3 +508,42 @@ func TestHealthVerdict_ControllerBlindToDockerFails(t *testing.T) {
 		t.Fatal("an older wrapper (no field) must not fail")
 	}
 }
+
+// R-528 (`09` decision 157): the wrapper's oom_check object reaches the hub's docker report byte-for-byte; the guest
+// and host reports carry none. COMPANION RED-PROOF: drop `rep.OOMCheck = rawOrNil(wr.OOMCheck)` in runLayer → "no
+// oom_check in the docker report".
+const oomCheckWire = `{"detail":"the engine reported the memory kill: OOMKilled=true and the oom event","exit_code":137,"image":"gitea.dooplex.hu/admin/felhom-controller:0.300.0","oom_event":true,"oom_killed":true,"result":"pass"}`
+
+func TestDocker_OOMCheckReachesTheHubUnchanged(t *testing.T) {
+	w := &fakeWrapper{t: t, applyRep: map[string]WrapperReport{LayerDocker: {
+		Upgraded:     []Package{{Name: "docker-ce", Version: "5:29.8.2-1~debian.13~trixie"}},
+		DockerEngine: "29.8.2", Authority: "ring0", OOMCheck: json.RawMessage(oomCheckWire)}}}
+	l, h := newLeg(t, w, &hub.WireOSUpdate{Ring: 0, Enabled: true})
+	l.Run(context.Background(), 9201, "night")
+	found := false
+	for _, b := range h.bodies {
+		var m map[string]json.RawMessage
+		if err := json.Unmarshal(b, &m); err != nil {
+			t.Fatal(err)
+		}
+		var layer string
+		json.Unmarshal(m["layer"], &layer)
+		oc, has := m["oom_check"]
+		if layer != LayerDocker {
+			if has {
+				t.Fatalf("the %s report carries an oom_check: %s", layer, oc)
+			}
+			continue
+		}
+		found = true
+		if !has {
+			t.Fatalf("no oom_check in the docker report: %s", b)
+		}
+		if string(oc) != oomCheckWire {
+			t.Fatalf("oom_check changed on the way:\n got %s\nwant %s", oc, oomCheckWire)
+		}
+	}
+	if !found {
+		t.Fatalf("no docker report posted: %s", calls(w))
+	}
+}