Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/reconcile/classify.go

@@ -47,6 +47,10 @@ const (
 	// Destructive for unknown classes — this named constant documents the class and keeps the
 	// signed-op vocabulary explicit, it does not (and must not) loosen anything.
 	ClassAgentUpdate OpClass = "agent_update"
+
+	// A Docker engine step in the customer guest (agent v0.142.0, `11` §5.8) — ring 1, and every undo. Destructive-class
+	// (signed, operational key) like agent_update; the root wrapper re-verifies the same signature itself.
+	ClassOSDockerStep OpClass = "os_docker_step"
 )
 
 // Disposition is the classifier verdict.
@@ -115,7 +119,7 @@ func Classify(class OpClass, prov Provenance) Disposition {
 		return Destructive
 	case ClassKeyRotation:
 		return Destructive
-	case ClassAgentUpdate:
+	case ClassAgentUpdate, ClassOSDockerStep:
 		// Never benign — no agent-internal provenance can make replacing the agent binary
 		// unsigned-safe (a compromised process must not be able to self-bless an update).
 		return Destructive