R-1285: the new agent runs the bundle policy pass once after its self-update commits — in the normal two-job delivery the old process installs the bundle. Test in the real order (commit, then one bundle-policy plan); red-proved. Commit only, not released.

internal/osupdate/bundle.go

@@ -126,6 +126,19 @@ func (e ConfigUpdateExecutor) Execute(ctx context.Context, op string, params jso
 // appliance-only files' policy (mode "bundle-policy"): on a BYO host it removes the SSH drop-in we wrote. The bundle run
 // itself was planned by the wrapper that was on disk BEFORE it, which may predate the policy (0.164.0). Never fatal:
 // the bundle is installed either way; an older wrapper refuses the unknown mode and the next bundle does it.
+// PolicyPassAfterUpdate runs the wrapper's bundle-policy pass once after a self-update commits (R-1285). In the normal
+// delivery the box gets agent_update and agent_config_update in ONE pass: the bundle job runs in the OLD process, which
+// has no policy pass, and the restart into the new agent comes a second later (measured 2026-10-26 on demo-hp). By the
+// commit the wrapper on disk is the bundle's own, so the pass removes our appliance-only files from a BYO host in the
+// SAME update. Idempotent; on an appliance it removes nothing.
+func (e ConfigUpdateExecutor) PolicyPassAfterUpdate(ctx context.Context, lg *slog.Logger, ver string) {
+	if lg == nil {
+		lg = slog.Default()
+	}
+	lg.Info("osupdate: running the bundle policy pass after the self-update commit (R-1285)", "agent_version", ver)
+	e.policyPass(ctx, lg, ver)
+}
+
 func (e ConfigUpdateExecutor) policyPass(ctx context.Context, lg *slog.Logger, ver string) {
 	runID := "bundle-policy-" + e.Leg.now().UTC().Format("20060102T150405Z")
 	wr, err := e.Leg.call(ctx, runID, map[string]any{"release_id": "bundle-policy-" + ver, "layer": LayerHost, "mode": "bundle-policy"})