Host power-off: a guest started after acceptance cancels it; escrow reply data race fixed

Security review of c6d9435: the other-guests check ran only at acceptance. waitJobsClear now
looks again before each step and CANCELS at once when another guest or VM runs (gate released).
Red-proofed. Also: go test -race found a data race in the escrow ceremony start reply (reads
job.Phase while the job goroutine writes it) — the reply fields are copied before the goroutine
starts; -race was red before, green 3/3 after.

.claude/rules/unprompted-work.md

@@ -73,3 +73,19 @@ that no longer exists. Each edit is named in the report (file, line, before, aft
 operator's word: loosen a safety rule, a fence, a „never", a protected machine, a secret rule, or a review step; or
 remove a rule. When in doubt, it is a rule change, and it goes to the operator. If Claude Code's own permission check
 asks before such an edit, wait for the operator's click; if it refuses, record that and file the exact line.
+
+## 6. The system poster stays true
+
+**A session that changes a fact listed in `architecture/felhom-system-poster.facts.md` (a machine, a
+role, a traffic path, a backup tier, a time, a retention, a key, a known gap) updates that file in
+the same commit.** If the change is text only, it also edits the matching text in
+`felhom-system-poster.html`. If it needs a new drawing, it adds the line
+**"System poster needs a refresh: <what changed>"** to `STATUS.md`'s "waiting on the operator" list.
+**The session report names which of the three it did.**
+
+Why the three-way split: the poster is a drawing made in Claude Design, and **nothing in this
+repository renders it** — unlike `where-felhom-stands.html`, which has `render_stands.py`. So the
+facts file is the source of truth and the drawing trails it. `scripts/poster_facts_gate.py` warns
+when the facts file has a newer commit than the poster; it **never fails a push**, because a refresh
+needs the operator and another tool, and a gate nobody can clear is a gate people learn to route
+around.

CHANGELOG.md

@@ -1,4 +1,68 @@
-## Unreleased — part of v0.152.0: the kernel lane (R-836; `09` §3 decisions 164, 172; `11` §5.11) (2026-10-07)
+## v0.154.0 — no OS leg after a household press; the after-boot kernel report carries the real ring (R-899); no „wrong code" when older packages were not checked (R-304); the last backup survives a restart in the host report; the Secure Boot meta-package leaves the Proxmox lane (2026-10-09)
+
+Released by `scripts/release-agent.sh`: binary sha256 `36a54ad20e896cd61d7b9944e2a521f4209c2b76940d8f1827af05b645463226`, bundle
+`93487989f50d4a3039a05cec0f91ec478d62489a414705e49403e9b1340d20e0` (tag `v0.154.0` = `db25b46`).
+
+**Delivery: the agent binary AND the config bundle** — the wrapper `felhom-os-apply` changed (2026-10-09).
+
+- **The hub's backup evidence survives a restart (2026-10-09, found in the kernel-night read-back).** The host report's
+  `backups` list came only from memory, which is empty after an agent restart. On demo-felhom the night backup landed
+  02:40 UTC and the kernel step restarted the host at 02:44 — no report fell in between, two nights running — so the hub
+  alarmed „host tier: newest backup is 48h old" at 03:00 after a good backup. The report now adds R-894's saved newest
+  success per tier and guest (`backup-success-state.json`, ONE instance shared with the local API) where memory holds no
+  success at or after it. Only successes are saved, so a failure is never hidden. `hub.KnownBackupReporter`,
+  `BackupSuccessState.KnownBackupSuccesses`; tests `TestCollectBackups_SavedSuccessSurvivesARestart` (red-proved: the
+  restart case reported nothing), `TestBackupSuccessState_KnownBackupSuccessesSurviveAReopen`, and
+  `TestR894_LastKnownBackupsIsWiredIntoTheDaemon` now also asserts the collector gets the same instance (red-proved).
+- **`proxmox-secure-boot-support` is a boot-chain package (2026-10-09).** On demo-hp (Secure Boot on) its upgrade pulled
+  `shim-signed-common`; in the ring-0 Proxmox plan that refused the whole step (R6) and skipped the night's kernel step,
+  after the household had been told „tonight". It joins `HOST_SLOW_RE` with shim and GRUB (they stay out of every lane,
+  as before). `test_ring0_pending_pve_leaves_the_secure_boot_meta_out` (red-proved).
+
+- **R-899 (operator ruling 2026-10-08, option A):** `POST /backup?trigger=manual` (a „Mentés most" press, sent by the
+  controller from its next release) runs no OS leg after it: the leg belongs to the night, after the night's own copy.
+  Before, a press ran the leg at once (in the day; on 2026-10-07 08:51 demo-hp skipped it only by the 20-hour rule). A
+  request without the parameter (an older controller, the scheduled path) behaves as before.
+  `internal/localapi/server.go`; `TestAfterPrimaryBackup` gained two sub-cases (red-proved: ignoring `trigger`, the leg
+  ran once after a press).
+- **R-304 — „wrong code" only when every earlier package was tried.** `POST /escrow/recover-offsite-password` answered
+  400 („the recovery code did not open the sealed bundle") whenever the current package and the TRIED earlier packages
+  refused the code — even when the hub withheld earlier packages (rows with no key material, rows over its serve cap), a
+  served package was malformed, the 6-attempt cap stopped the loop, or the retained list could not be read at all. Now
+  those cases answer **424** with `older_unchecked` (the count, -1 = unknown) and a sentence that does not call the code
+  wrong. `escrow.ErrRetainedUnchecked` / `RetainedUncheckedError`; the retained fetcher's second value is now every
+  withheld package (unopenable + truncated + malformed). Tests `TestR304_*` (real age crypto; red-proved: without the
+  check, four cases returned the wrong-code error) and a 424 row in `TestRecoverOffsitePassword_EachSituationGetsItsOwnStatus`.
+  An older controller maps the unknown 424 to its neutral „we do not know why" sentence.
+- **The „ring 1" label after a boot:** in the first second after a reboot the agent has not fetched the hub's block, and
+  the after-boot kernel reports (`judging`, `good`, `revert`, `fell_back`…) said ring 1 on a ring-0 box (demo-felhom,
+  2026-10-08 night). Now they read the fetched block, else the block the daemon saved on disk before the reboot (R-866),
+  else ring 1 as before. A label only — the hub's approval reads its own ring list. `kernelReportRing`,
+  `TestKernelReportRing_BeforeFirstFetch` (red-proved: ring 1, want 0).
+
+## v0.153.0 — ring 0 stages exactly the told kernel (R-898; `09` §3 decision 176) (2026-10-07)
+
+Released by `scripts/release-agent.sh`: binary sha256 `b204ebe6d65944f43b70dcfa4ae0dfb90da38c92e2ba6a38a1826e488eeb6630`, bundle
+`6db216275eb0dd39188d93481a2045998a69e8cb7838ad908a58d65d9a6a9b57` (tag `v0.153.0` = `2d1e5d0`). Delivered (binary only — the
+bundle files are unchanged from 0.152.0) to demo-hp, demo-felhom, Tester 1 on 2026-10-07 19:03.
+
+**Delivery: the agent binary only** — no root file changed (the wrapper is unchanged; its tests gained two cases).
+
+- `internal/osupdate/kernel.go`: ring 0's night kernel step stages EXACTLY the kernel the household was told about
+  (select `listed`, `KernelSet(kver)` = the series meta-package and the signed image at the kernel's own version) instead
+  of "whatever is pending tonight". Seen 2026-10-07: demo-felhom was told about 7.0.14-20 while its sources offered
+  7.0.14-22 by night — the old code staged `pending-kernel` and the wrapper refused it (R23), losing the night. A told
+  version that is no longer installable is refused by the wrapper before any change (R7) and the hub tells the household
+  again for the newer kernel (hub v0.143.1). Tests `TestKernel_Ring0ToldNightStagesThenReboots` (red-proved against the
+  old select), `TestKernelSet`; wrapper `test_ring0_listed_installs_the_told_kernel_not_the_newest`,
+  `test_ring0_told_kernel_gone_is_refused_before_any_change`.
+
+## v0.152.0 — the kernel lane (R-836; `09` §3 decisions 164, 172; `11` §5.11) (2026-10-07)
+
+Released by `scripts/release-agent.sh`: binary sha256 `95ff42208e36ba49b6e2b09a97e81a6fa11562ecc8042f1ed18d378b8b1f88b1`,
+config bundle sha256 `f0c2cec374b711b3c131c955012b33fd0ad495337d049b7a743c3eef9e85c20b` (tag `v0.152.0` = `d03ab7f`).
+Step bundle `0.152.0-step1` sha256 `0b71d32b054cf3b7ade0234ffcbb0df159901f542cde540adaee411db466f48e` (the 0.151.0 bundle
+with only `felhom-os-apply` replaced; `scripts/build-step-bundle.py`), published as package version `0.152.0-step1`.
 
 **Delivery: agent binary, then the STEP bundle `0.152.0-step1`, then the bundle `0.152.0`** — the bundle ADDS two paths
 (the GRUB generators), and an installed `felhom-os-apply` refuses a path its own table lacks (R16, R-880).
@@ -34,7 +98,7 @@ candidate 2 (`audits/kernel-spike-2026-10-07/`), with option C on the one-shot e
   signed `os_kernel_step` staged (`KernelStepExecutor`: stage only, under the heavy-op gate). The hub hears `staged`
   BEFORE the reboot. At every start `KernelAfterBoot`: on the new kernel it JUDGES the boot — `KernelVerdict` = the
   host health rule (`11` §8.2) AND the box reached the hub (the `judging` report itself) — for 20 minutes (measured:
-  everything healthy 68 s after the reboot on demo-felhom, 272 s on demo-hp; under the hub's 30-minute `host_stale`).
+  everything healthy 68 s after the reboot on demo-felhom, 272 s on demo-hp; under the hub's 45-minute `host_stale` (`alerting.stale_threshold`)).
   Healthy → `kernel-good`, outcome `applied`; not healthy → outcome `health_failed`, then ONE `kernel-revert`.
   Tests: `TestKernel*` (13); red-proofs in the same file.
 - `internal/hub`: `WireOSUpdate.Kernel` {kver, tonight, notified_at}. `internal/reconcile`: `os_kernel_step` is

CONTEXT.md

@@ -1,5 +1,12 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-10-08 (day) — UNRELEASED on main, ships with tomorrow's release (decision 178).** R-899: `POST /backup?trigger=manual`
+> runs no OS leg (`localapi/server.go`); after-boot kernel reports carry the saved block's ring (`kernelReportRing`). R-304:
+> `escrow.ErrRetainedUnchecked` → HTTP 424 `older_unchecked` when not every earlier package was tried (withheld, caps,
+> malformed, unreadable list). Binary-only delivery; no wrapper or root file changed.
+
+> **2026-10-07 (evening) — v0.152.0, the kernel lane (R-836, decision 172, `11` §5.11).** Wrapper layer `kernel` + two GRUB generators in the bundle (delivered with step bundle `0.152.0-step1` — the bundle adds paths, R-880); `osupdate/kernel.go`: night step on told nights only, after-boot judge (host rule + hub reached, 20 min), ONE self-revert, `os_kernel_step` stages only. Proven on Tester 1 (panic → fell_back, held guest → self_reverted, healthy → 7.0.14-22 default). Open: R-898, R-897; the ring-0 night run.
+
 > **2026-10-04 night — v0.143.0 RELEASED + vouched (R-840, decision 96): the config bundle.** `felhom-os-apply` mode
 > `bundle` (signed `agent_config_update`, verified by the wrapper itself; trust files never bundle paths) +
 > `--install-bundle` (installer 1.31.0); `BUNDLE_FILES` is the one table; `scripts/build-config-bundle.py`;

REPORT.md

@@ -1,9 +1,15 @@
-# REPORT — v0.151.0 released and delivered (2026-10-07 day)
+# REPORT — v0.154.0 released and delivered (2026-10-09)
 
-On the operator's word (`09` §3 decisions 163, 165, 168, 169). sha `0464354f…`, bundle `bacd1d17…`, tag `v0.151.0` = `dd7cdc0`.
+Built from the 2026-10-09 kernel-night read-back: (1) the host report now adds the saved newest backup success per tier
-Delivered binary first, then the bundle (its sudoers drops the `tee` grant 0.150.0 used), to demo-hp, demo-felhom and
+(R-894's file, one shared instance), so a restart right after a night backup no longer empties the hub's evidence — on
-Tester 1 — probe 68/68 on each. **Vouch refused by the hub** (`golden_behind_fleet`): new installs keep 0.150.0 until the
+demo-felhom it had caused a false „newest backup is 48h old" alarm; (2) `proxmox-secure-boot-support` joins the
-weekly golden. Carries: the Proxmox package lane + `/etc/pve` write gate (R-812 A — proven on demo-felhom: 65 packages,
+boot-chain lane, so it no longer pulls `shim-signed-common` into the ring-0 Proxmox plan (demo-hp's step was refused R6
-70 s, healthy), the `controller-image` root verb (R-861 a — on demo-hp an `alpine` ref is refused; a managed swap not yet
+and its kernel step skipped). Red-proofs: `TestCollectBackups_SavedSuccessSurvivesARestart`,
-seen), anchored felhom-op lines (B2), the other-key archive ledger (R-366), the `-directive` flag removed (R-105). Evidence
+`TestR894_LastKnownBackupsIsWiredIntoTheDaemon`, `test_ring0_pending_pve_leaves_the_secure_boot_meta_out`.
-`felhom.eu/documentation/audits/day-2026-10-07/`. Shared rule file: decision 162 line added.
+
+`scripts/release-agent.sh 0.154.0`: sha `36a54ad2…`, bundle `93487989…`, tag `v0.154.0` = `db25b46`, verified by
+download. CI 1576 (code) success; 1579 (CHANGELOG) failed in its fetch step (Gitea answered 500), re-run → success.
+Signed `agent_update` → demo-hp, demo-felhom, Tester 1 (07:16–07:18 local); signed `agent_config_update` → `BUNDLE DONE
+written=1 same=26 self-check=ok`, capability probe 68/68 on all three. NOT vouched (the vouch needs a golden at or above
+the fleet's controller; no golden today). Live: demo-felhom's first report after the update carries the 02:40Z backup.
+Evidence: `felhom.eu/documentation/audits/release-2026-10-09/delivery/`.

cmd/felhom-agent/main.go

@@ -50,6 +50,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-agent/internal/pbs"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/pbsdr"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/poke"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/poweroff"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/provision"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/reconcile"
@@ -833,7 +834,25 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	// (The startup self-check log runs AFTER the pbsdr manager is wired below, so its snapshot
 	// already carries the gated view — v0.86.0.)
 	collector.SetCapabilityProber(probeAll)
+	// R-998 (doc 14): the household power-off record of THIS boot rides every report until the box is down.
+	powerOffState := poweroff.New(filepath.Join(cfg.OOB.WithDefaults().StateDir, "poweroff.json"), poweroff.ProcBtime)
+	collector.SetDeliberateOffSource(func() *hub.DeliberateOff {
+		if r := powerOffState.Current(); r != nil {
+			return &hub.DeliberateOff{RequestedAt: r.RequestedAt.UTC().Format(time.RFC3339)}
+		}
+		return nil
+	})
 	loop := hub.NewLoop(collector, client, time.Duration(hcfg.PollSeconds)*time.Second, logger)
+	// R-998: the power-off path waits until the hub ACCEPTED a report carrying the record.
+	powerOffAck := make(chan struct{}, 1)
+	loop.SetReportedHook(func(r *hub.HostReport) {
+		if r != nil && r.DeliberateOff != nil {
+			select {
+			case powerOffAck <- struct{}{}:
+			default:
+			}
+		}
+	})
 	interval := time.Duration(hcfg.PollSeconds) * time.Second
 	// Heartbeat log-pull (v0.83.0): when the control envelope requests it, the NEXT
 	// heartbeat carries the debug ring's tail (newest-kept, byte-capped in the loop).
@@ -881,7 +900,8 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	// judge it (the host health rule + the hub reached) for KernelJudgeWait, then make it the default or revert ONCE.
 	// The wait: measured 2026-10-07 (`audits/kernel-lane-2026-10-07/B/`) — every container healthy 68 s after the
 	// reboot on demo-felhom and 272 s on demo-hp (the hub reached at 63 s / 189 s); 20 minutes leaves room for a slow
-	// network and stays under the hub's 30-minute host_stale. On a box without the kernel lane (an older wrapper, a BYO host) the check is refused and logged.
+	// network and stays under the hub's 45-minute host_stale (its
+	// alerting.stale_threshold; host_down at 90). On a box without the kernel lane (an older wrapper, a BYO host) the check is refused and logged.
 	go osLeg.KernelAfterBoot(ctx, 0, osupdate.KernelJudge{Wait: osupdate.DefaultKernelJudgeWait})
 
 	// Reconcile (slice 4) runs alongside the hub loop, sharing the per-guest queue
@@ -1179,6 +1199,34 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	}
 	localSrv := buildLocalAPIServer(cfg, px, backupStore, heavyOps, observer, driveKnown, hostOps, gate, collector, client, intentRec, guestBindStore, formatJobStore, logRing, escrowCeremonyCfg, logger, &localTokens)
 	if localSrv != nil {
+		// R-998 (doc 14): POST /host/poweroff — guest shutdown, then host power-off; guards in hostpoweroff.go.
+		pwMode := proxmox.RunnerMode(cfg.Privileged.Mode)
+		if pwMode == "" {
+			pwMode = proxmox.RunnerSudo
+		}
+		localSrv.SetHostPowerOff(localapi.HostPowerOffConfig{
+			State: powerOffState,
+			Power: localapi.NewGuestBinder(&proxmox.ExecRunner{Mode: pwMode, SudoPath: cfg.Privileged.SudoPath}, logger),
+			ReportNow: func(ctx context.Context) bool {
+				select {
+				case storageTrigger <- struct{}{}:
+				default: // a report is already queued; it runs after the record was written
+				}
+				select {
+				case <-powerOffAck:
+					return true
+				case <-ctx.Done():
+					return false
+				}
+			},
+			Uptime: func() (time.Duration, bool) {
+				b, err := strconv.ParseInt(poweroff.ProcBtime(), 10, 64)
+				if err != nil || b <= 0 {
+					return 0, false
+				}
+				return time.Since(time.Unix(b, 0)), true
+			},
+		})
 		localSrv.SetAfterPrimaryBackup(func(ctx context.Context, vmid int) {
 			// Let the controller finish bringing its apps back after the backup, then run (still under the gate).
 			select {
@@ -1903,11 +1951,15 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 				return nil, 0, ferr
 			}
 			out := make([]escrow.RetainedBlob, 0, len(resp.Packages))
+			// R-304: every package the hub holds and the code will NOT be tried against — no key material,
+			// over the hub's cap, or malformed here. A refusal may call the code wrong only when this is 0.
+			withheld := resp.UnopenableCount + resp.TruncatedCount
 			for _, p := range resp.Packages {
 				blob, derr := base64.StdEncoding.DecodeString(p.IdentityEscrowB64)
 				if derr != nil || len(blob) == 0 {
 					// One malformed package must not sink the rest — the customer's code may open a
 					// later one, and a skipped entry is strictly better than a refusal we cannot justify.
+					withheld++
 					continue
 				}
 				out = append(out, escrow.RetainedBlob{
@@ -1917,9 +1969,13 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 					Index:          p.Index,
 				})
 			}
-			return out, resp.UnopenableCount, nil
+			return out, withheld, nil
 		},
 	}
+	// R-894: ONE instance — the local API writes it, the host report reads it (2026-10-09: a restart right
+	// after the night backup erased the hub's evidence of it).
+	lastKnownBackups := backup.NewBackupSuccessState(filepath.Join(cfg.OOB.WithDefaults().StateDir, "backup-success-state.json"))
+	collector.SetKnownBackupReporter(lastKnownBackups)
 	srv, err := localapi.NewServer(localapi.Options{
 		EscrowRecovery: escrowRecoverer,
 		ListenAddr:     cfg.LocalAPI.ListenAddr,
@@ -1932,7 +1988,7 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 		Store:          store,
 		// R-894: the newest success per tier on disk — the due-check's fallback when the storage cannot be
 		// read right after a restart. Same state dir as restore-test-state.json.
-		LastKnownBackups: backup.NewBackupSuccessState(filepath.Join(cfg.OOB.WithDefaults().StateDir, "backup-success-state.json")),
+		LastKnownBackups: lastKnownBackups,
 		Storage:          observer,
 		DriveTargets:     driveTargets,                    // Impl-2a: registry+units drives for the /disks view (union w/ Observe storages)
 		Smart:            storage.NewSmartReader(hostOps), // v0.95.0 Fix B: SMART for the union-path drives

cmd/felhom-agent/r894_wiring_test.go

@@ -12,12 +12,18 @@ import (
 //
 // COMPANION RED-PROOF (observed): delete the `LastKnownBackups:` line from buildLocalAPIServer → this
 // fails with "localapi.Options in buildLocalAPIServer has no LastKnownBackups field". Restored.
+//
+// 2026-10-09: the SAME instance also feeds the host report (collector.SetKnownBackupReporter), so a
+// restart right after a backup no longer erases the hub's evidence of it. The field may name a local
+// variable; the variable must be built by backup.NewBackupSuccessState and be the one handed to the
+// collector. RED-PROOF (observed): drop the SetKnownBackupReporter call → "not handed to the collector".
 func TestR894_LastKnownBackupsIsWiredIntoTheDaemon(t *testing.T) {
 	_, f := parseMain(t)
 	if !callsWithin(f, "main")["runDaemon"] || !callsWithin(f, "runDaemon")["buildLocalAPIServer"] {
 		t.Fatal("main → runDaemon → buildLocalAPIServer is broken — the path this test asserts is not the live one")
 	}
 	var field, built bool
+	var fieldVar, handed string
 	for _, d := range f.Decls {
 		fd, ok := d.(*ast.FuncDecl)
 		if !ok || fd.Name == nil || fd.Name.Name != "buildLocalAPIServer" || fd.Body == nil {
@@ -45,6 +51,28 @@ func TestR894_LastKnownBackupsIsWiredIntoTheDaemon(t *testing.T) {
 					if callsIn(kv.Value)["backup.NewBackupSuccessState"] {
 						built = true
 					}
+					if id, ok := kv.Value.(*ast.Ident); ok {
+						fieldVar = id.Name
+					}
+				}
+			}
+			return true
+		})
+		// a local variable: built by NewBackupSuccessState, and handed to the collector
+		ast.Inspect(fd.Body, func(n ast.Node) bool {
+			switch x := n.(type) {
+			case *ast.AssignStmt:
+				for i, l := range x.Lhs {
+					if id, ok := l.(*ast.Ident); ok && fieldVar != "" && id.Name == fieldVar && i < len(x.Rhs) &&
+						callsIn(x.Rhs[i])["backup.NewBackupSuccessState"] {
+						built = true
+					}
+				}
+			case *ast.CallExpr:
+				if fn, ok := x.Fun.(*ast.SelectorExpr); ok && fn.Sel.Name == "SetKnownBackupReporter" && len(x.Args) == 1 {
+					if id, ok := x.Args[0].(*ast.Ident); ok {
+						handed = id.Name
+					}
 				}
 			}
 			return true
@@ -56,6 +84,9 @@ func TestR894_LastKnownBackupsIsWiredIntoTheDaemon(t *testing.T) {
 	if !built {
 		t.Fatal("LastKnownBackups is not built by backup.NewBackupSuccessState")
 	}
+	if handed == "" || handed != fieldVar {
+		t.Fatalf("the saved backups (%q) are not handed to the collector (SetKnownBackupReporter got %q)", fieldVar, handed)
+	}
 }
 
 func callsIn(n ast.Node) map[string]bool {

configs/felhom-agent.sudoers

@@ -80,7 +80,13 @@ Cmnd_Alias FELHOM_DNSMASQ = \
 Cmnd_Alias FELHOM_GUESTHOOK = \
   /usr/sbin/pct ^set [0-9]+ --hookscript local\:snippets/felhom-guest-hook\.sh$, \
   /usr/sbin/pct ^set [0-9]+ --delete mp[0-9]+$, \
-  /usr/sbin/pct ^reboot [0-9]+$
+  /usr/sbin/pct ^reboot [0-9]+$, \
+  /usr/sbin/pct ^shutdown [0-9]+ --timeout [0-9]+$
+
+# Host power-off (R-998, doc 14): the household's „A gép kikapcsolása" — guest shutdown above, then this one fixed
+# vector. Guarded agent-side (10 min after boot, one per boot, never during a backup/restore/update/drive job).
+Cmnd_Alias FELHOM_POWEROFF = \
+  /usr/bin/systemctl poweroff
 
 # Intermediary mount model (the drive hot-swap re-architecture). The agent keeps a SHARED host parent
 # /mnt/felhom-drives (self-bind + make-shared) and binds/unbinds each drive's felhom-data namespace UNDERNEATH it so the
@@ -314,4 +320,4 @@ Cmnd_Alias FELHOM_GUESTNET = \
   /usr/sbin/pct ^exec [0-9]+ -- pgrep -x dhclient$, \
   /usr/sbin/pct ^exec [0-9]+ -- dhclient -pf /run/dhclient\.eth0\.pid -lf /var/lib/dhcp/dhclient\.eth0\.leases eth0$
 
-felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK, FELHOM_PROVISION, FELHOM_FORMAT, FELHOM_DNSMASQ, FELHOM_GUESTHOOK, FELHOM_INTERMEDIARY, FELHOM_CONTROLLERSWAP, FELHOM_STALELOCK, FELHOM_FSTRIM, FELHOM_NETMOUNT, FELHOM_WG, FELHOM_SELFUPDATE, FELHOM_SSHD, FELHOM_OOB, FELHOM_PBSDR, FELHOM_BACKUPTARGET, FELHOM_SELFHEAL, FELHOM_ESCROW, FELHOM_GUESTNET, FELHOM_SCRATCH_TEARDOWN, FELHOM_OSAPPLY
+felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK, FELHOM_PROVISION, FELHOM_FORMAT, FELHOM_DNSMASQ, FELHOM_GUESTHOOK, FELHOM_INTERMEDIARY, FELHOM_CONTROLLERSWAP, FELHOM_STALELOCK, FELHOM_FSTRIM, FELHOM_NETMOUNT, FELHOM_WG, FELHOM_SELFUPDATE, FELHOM_SSHD, FELHOM_OOB, FELHOM_PBSDR, FELHOM_BACKUPTARGET, FELHOM_SELFHEAL, FELHOM_ESCROW, FELHOM_GUESTNET, FELHOM_SCRATCH_TEARDOWN, FELHOM_OSAPPLY, FELHOM_POWEROFF

configs/felhom-os-apply

@@ -93,8 +93,13 @@ OOMCHECK_TIMEOUTS = {"image": 10, "clock": 5, "run": 30, "inspect": 10, "events"
 OOMCHECK_SETTLE = 2
 # Kernel, boot and firmware packages are the SLOW lane on the host whatever their origin (`11` C3, §5.2): a host
 # reboot is needed for them to take effect, and a bad one can stop the box from booting.
+# proxmox-secure-boot-support is the Secure Boot meta-package: its only job is to pull shim-signed and the signed GRUB,
+# so it belongs with them. Measured 2026-10-09 on demo-hp (Secure Boot on): left in the pve lane, its upgrade pulled
+# shim-signed-common, the whole pve step was refused R6, and the night's kernel step was skipped with it
+# (`audits/kernel-night-2026-10-08/`). Pinned by test_ring0_pending_pve_leaves_the_secure_boot_meta_out.
 HOST_SLOW_RE = re.compile(r"^(linux-(image|headers|kbuild|modules|base)|proxmox-kernel|proxmox-default-kernel|pve-kernel|"
-                          r"pve-firmware|firmware-|grub|shim|systemd-boot|intel-microcode|amd64-microcode|efibootmgr)")
+                          r"pve-firmware|firmware-|grub|shim|systemd-boot|intel-microcode|amd64-microcode|efibootmgr|"
+                          r"proxmox-secure-boot-support)")
 # restart_needed() leaves out processes whose cgroup line matches (grep basic regex). Host: the LXC guests' own
 # processes (`0::/lxc/<vmid>/...`) -- NOT lxc-start itself, whose cgroup is `0::/lxc.monitor/<vmid>` (measured
 # 2026-10-04 on demo-felhom: the old pattern "lxc" hid lxc-start with 20 deleted maps, so "reboot needed" stayed false

configs/test_felhom_os_apply.py

@@ -1469,6 +1469,23 @@ class PVELane(unittest.TestCase):
                          "pending-pve: installed, Proxmox-origin, never kernel/boot/firmware, never Debian or other origins")
         self.assertEqual(f.installed["libc6"], "2.41-12+deb13u3")
 
+    # 2026-10-09, demo-hp (Secure Boot on): proxmox-secure-boot-support's upgrade pulls shim-signed-common; in the pve
+    # plan that refused the whole step (R6) and skipped the night's kernel step. It is a boot-chain package: left out.
+    # RED-PROOF: drop proxmox-secure-boot-support from HOST_SLOW_RE -> it is in the plan -> this test fails.
+    def test_ring0_pending_pve_leaves_the_secure_boot_meta_out(self):
+        f = pve_fake(ring0=True)
+        f.plan["select"], f.plan["packages"] = "pending-pve", []
+        f.installed.update({"proxmox-secure-boot-support": "9.0.1"})
+        f.pending_sim = [
+            "Inst pve-manager [9.2.2] (9.2.21 Proxmox Debian Repository:stable [amd64])",
+            "Inst proxmox-secure-boot-support [9.0.1] (9.0.2 Proxmox Debian Repository:stable [all])",
+            "Inst shim-signed-common [1.48+pmx1+16.1-1+pmx1] (1.51+pmx1+16.1-2+pmx1 Proxmox Debian Repository:stable [all])",
+        ]
+        rc, rep = run(f)
+        self.assertEqual(rc, 0, rep)
+        self.assertEqual(sorted(u["name"] for u in rep["upgraded"]), ["pve-manager"])
+        self.assertEqual(f.installed["proxmox-secure-boot-support"], "9.0.1")
+
     def test_select_pending_pve_needs_the_pve_layer(self):
         f = Fake()
         f.plan["layer"], f.plan["select"], f.plan["packages"] = "host", "pending-pve", []
@@ -1838,6 +1855,33 @@ class KernelLane(unittest.TestCase):
         m.origins = {"proxmox-kernel-7.0": DEB}
         self.refused(m, "R2")
 
+    # R-898: ring 0 stages EXACTLY the told kernel (select listed, the set derived from it) — even when the sources
+    # offer a newer one by night; a told version that can no longer be installed is refused BEFORE any change (R7).
+    def test_ring0_listed_installs_the_told_kernel_not_the_newest(self):
+        f = kfake()
+        f.live["proxmox-kernel-7.0"] = {"7.0.14-20", "7.0.14-22", "7.0.2-6"}
+        f.live["proxmox-kernel-7.0.14-20-pve-signed"] = {"7.0.14-20"}
+        told = [{"name": "proxmox-kernel-7.0", "version": "7.0.14-20", "origin": "Proxmox Debian Repository"},
+                {"name": "proxmox-kernel-7.0.14-20-pve-signed", "version": "7.0.14-20", "origin": "Proxmox Debian Repository"}]
+        f.plan.update(select="listed", packages=told, expect_kver="7.0.14-20-pve")
+        rc, rep = run(f)
+        self.assertEqual(rc, 0, rep)
+        self.assertEqual(rep["authority"], "ring0")
+        self.assertEqual(f.env, {"felhom_next": "7.0.14-20-pve"})
+        self.assertEqual(f.installed["proxmox-kernel-7.0"], "7.0.14-20")
+        self.assertNotIn("7.0.14-22-pve", f.boot)
+
+    def test_ring0_told_kernel_gone_is_refused_before_any_change(self):
+        f = kfake()
+        f.live["proxmox-kernel-7.0"] = {"7.0.14-22"}   # 7.0.14-20 is no longer in the archive
+        told = [{"name": "proxmox-kernel-7.0", "version": "7.0.14-20", "origin": "Proxmox Debian Repository"},
+                {"name": "proxmox-kernel-7.0.14-20-pve-signed", "version": "7.0.14-20", "origin": "Proxmox Debian Repository"}]
+        f.plan.update(select="listed", packages=told, expect_kver="7.0.14-20-pve")
+        rep = self.refused(f, "R7")
+        self.assertIsNone(f.env)
+        self.assertNotIn(osapply.KERNEL_DEFAULT_CFG, f.tree, "refused before the default was even pinned")
+        self.assertEqual(f.installed["proxmox-kernel-7.0"], "7.0.2-6")
+
     def test_nothing_pending_changes_nothing(self):
         f = kfake(kernel_pending=[])
         rc, rep = run(f)

internal/backup/backup_state.go

@@ -103,6 +103,29 @@ func (s *BackupSuccessState) LastKnownSuccess(target string, vmid int) (time.Tim
 	return e.at, ok
 }
 
+// KnownBackupSuccesses returns every saved success as a host-report record (the collector's
+// KnownBackupReporter, so the hub keeps its evidence across a restart). Only the tier, guest and start
+// time are known; the archive name is not saved and stays empty. Sorted for a stable report.
+func (s *BackupSuccessState) KnownBackupSuccesses() []hub.Backup {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	out := make([]hub.Backup, 0, len(s.last))
+	for _, e := range s.last {
+		out = append(out, hub.Backup{TargetID: e.target, VMID: e.vmid, Success: true, CrashConsistent: true,
+			StartedAt: e.at.Format(time.RFC3339), UncoveredVolumes: []string{}})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].TargetID != out[j].TargetID {
+			return out[i].TargetID < out[j].TargetID
+		}
+		return out[i].VMID < out[j].VMID
+	})
+	return out
+}
+
 func (s *BackupSuccessState) saveLocked() error {
 	entries := make([]backupSuccessJSON, 0, len(s.last))
 	for _, e := range s.last {

internal/backup/backup_state_test.go

@@ -57,3 +57,20 @@ func TestBackupSuccessState_CorruptFileIsEmpty(t *testing.T) {
 		t.Fatal("a corrupt file must read as nothing known")
 	}
 }
+
+// The saved successes come back as host-report records: success, tier, guest, start time (R-894 → the
+// host report, 2026-10-09). A new state read from the same file gives the same records (the restart case).
+func TestBackupSuccessState_KnownBackupSuccessesSurviveAReopen(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "backup-success-state.json")
+	s := NewBackupSuccessState(path)
+	if err := s.RecordBackupSuccess("felhom-backup", hub.Backup{VMID: 9201, Success: true, StartedAt: "2026-10-09T02:40:16Z"}); err != nil {
+		t.Fatal(err)
+	}
+	got := NewBackupSuccessState(path).KnownBackupSuccesses()
+	if len(got) != 1 || !got[0].Success || got[0].TargetID != "felhom-backup" || got[0].VMID != 9201 || got[0].StartedAt != "2026-10-09T02:40:16Z" {
+		t.Fatalf("got %+v", got)
+	}
+	if got[0].UncoveredVolumes == nil {
+		t.Fatal("uncovered_volumes must marshal as [], not null")
+	}
+}

internal/capability/manifest.go

@@ -115,6 +115,8 @@ var manifest = []Capability{
 	{"guesthook-register", "pre-start hook register", "/usr/sbin/pct", []string{"set", "9201", "--hookscript", "local:snippets/felhom-guest-hook.sh"}, false, ""},
 	{"guesthook-delete-mp", "dead mountpoint slot delete (C1 net)", "/usr/sbin/pct", []string{"set", "9201", "--delete", "mp0"}, false, ""},
 	{"guest-reboot", "enroll activate-binds reboot", "/usr/sbin/pct", []string{"reboot", "9201"}, false, ""},
+	{"guest-shutdown", "household power-off: guest shutdown (R-998)", "/usr/sbin/pct", []string{"shutdown", "9201", "--timeout", "120"}, false, ""},
+	{"host-poweroff", "household power-off: host power-off (R-998)", "/usr/bin/systemctl", []string{"poweroff"}, false, ""},
 
 	// ---- LAN split-horizon resolver (dnsmasq) ----
 	{"dnsmasq-install", "dnsmasq package install", "/usr/bin/apt-get", []string{"install", "-y", "-q", "dnsmasq"}, false, ""},

internal/capability/manifest_test.go

@@ -311,3 +311,39 @@ func TestWGCapabilityCriticality(t *testing.T) {
 		}
 	}
 }
+
+// TestEveryAliasIsGranted closes a gap found while adding FELHOM_POWEROFF (R-998): the coverage check above reads
+// every Cmnd_Alias body whether or not the alias appears on the grant line, so a manifest command whose alias was
+// never GRANTED still passed — and failed with „a password is required" on the box. Every defined alias must be
+// named on the `felhom-agent ALL=(root) NOPASSWD:` line. Red-proof: drop FELHOM_POWEROFF from that line.
+func TestEveryAliasIsGranted(t *testing.T) {
+	data, err := os.ReadFile(sudoersPath)
+	if err != nil {
+		t.Fatalf("read sudoers: %v", err)
+	}
+	var defined []string
+	granted := map[string]bool{}
+	grantLines := 0
+	for _, ln := range strings.Split(string(data), "\n") {
+		tr := strings.TrimSpace(ln)
+		if strings.HasPrefix(tr, "Cmnd_Alias ") {
+			if f := strings.Fields(tr); len(f) >= 2 {
+				defined = append(defined, f[1])
+			}
+		}
+		if strings.HasPrefix(tr, "felhom-agent ") && strings.Contains(tr, "NOPASSWD:") {
+			grantLines++
+			for _, a := range strings.Split(tr[strings.Index(tr, "NOPASSWD:")+len("NOPASSWD:"):], ",") {
+				granted[strings.TrimSpace(a)] = true
+			}
+		}
+	}
+	if grantLines == 0 || len(defined) < 10 {
+		t.Fatalf("parsed %d grant line(s), %d aliases — parser broke", grantLines, len(defined))
+	}
+	for _, a := range defined {
+		if !granted[a] {
+			t.Errorf("Cmnd_Alias %s is defined but never granted to felhom-agent", a)
+		}
+	}
+}

internal/capability/r861_injection_test.go

@@ -53,6 +53,16 @@ var r861Injections = []string{
 	"/usr/sbin/pct exec 9201 -- tee /etc/felhom-controller-image",
 	"/usr/local/sbin/felhom-priv-apply controller-image 9201 9202",
 	"/usr/local/sbin/felhom-priv-apply controller-image 9201;id",
+	// R-998 (host power-off): the two new grants take exactly their fixed shape — no extra option, no other target
+	"/usr/sbin/pct shutdown 9201 --timeout 120 --forceStop 1",
+	"/usr/sbin/pct shutdown 9201 --forceStop 1 --timeout 120",
+	"/usr/sbin/pct shutdown 9201",
+	"/usr/sbin/pct shutdown 9201 --timeout -1",
+	"/usr/bin/systemctl poweroff --force",
+	"/usr/bin/systemctl poweroff -ff",
+	"/usr/bin/systemctl reboot",
+	"/usr/bin/systemctl halt",
+	"/usr/bin/systemctl kexec",
 }
 
 func TestSudoersRefusesTheR861Injections(t *testing.T) {

internal/escrow/recover.go

@@ -59,8 +59,26 @@ var (
 	// It carries no material and no code: only WHICH earlier package opened, by its supersession date,
 	// which is the one fact the customer needs to recognise it.
 	ErrCodeOpensRetained = errors.New("escrow: the recovery code did not open the CURRENT sealed package, but it DID open a retained earlier one")
+	// ErrRetainedUnchecked — the code did NOT open the current package, and NOT every earlier package the hub
+	// holds for this host was tried (R-304, 2026-10-08): the retained list could not be fetched, the hub
+	// withheld rows (over its serve cap, or rows with no key material), a package was malformed, or the
+	// attempt cap stopped the loop. So „the code is wrong" is NOT known — it may be right for a package
+	// nobody tried. Distinct from a mistype for exactly the R-224 reason: never accuse the customer of
+	// something we did not check.
+	ErrRetainedUnchecked = errors.New("escrow: the recovery code did not open the current sealed package, and some earlier packages were NOT checked")
 )
 
+// RetainedUncheckedError wraps ErrRetainedUnchecked with how many earlier packages went unchecked
+// (-1 = unknown: the retained list itself could not be read). No secret.
+type RetainedUncheckedError struct {
+	Unchecked int
+}
+
+func (e *RetainedUncheckedError) Error() string {
+	return fmt.Sprintf("%s (unchecked=%d)", ErrRetainedUnchecked.Error(), e.Unchecked)
+}
+func (e *RetainedUncheckedError) Unwrap() error { return ErrRetainedUnchecked }
+
 // RetainedMatch says which retained package a code opened. Returned inside RetainedOpenedError; it
 // carries no secret — not the code, not the bundle, not the repository password.
 type RetainedMatch struct {
@@ -102,8 +120,10 @@ type RetainedBlob struct {
 }
 
 // RetainedFetcher yields this host's RETAINED sealed packages, newest-superseded first. An empty
-// slice is a clean "none". R-311.
+// slice is a clean "none". R-311. `withheld` counts the earlier packages the hub holds that are NOT in
-type RetainedFetcher func(ctx context.Context) (blobs []RetainedBlob, unopenable int, err error)
+// blobs — rows with no key material, rows over the hub's serve cap, and packages dropped as malformed
+// (R-304): each is a package the code was never tried against.
+type RetainedFetcher func(ctx context.Context) (blobs []RetainedBlob, withheld int, err error)
 
 // OffsiteKeyRecoverer is the assembled links 6→8. Construct it with a fetcher; call it with R.
 type OffsiteKeyRecoverer struct {
@@ -154,9 +174,14 @@ func (r OffsiteKeyRecoverer) RecoverOffsiteRepoPassword(ctx context.Context, rec
 		// from the unwrap alone; the only way to tell is to try. Until this existed nobody tried, and
 		// the screen said so out loud ("innen nem tudjuk megkülönböztetni őket") — a true sentence
 		// about our own incuriosity, read by the customer as a statement about their code.
-		if m, ok := r.tryRetained(ctx, recoveryCode); ok {
+		m, ok, unchecked := r.tryRetained(ctx, recoveryCode)
+		if ok {
 			return "", &RetainedOpenedError{Match: m}
 		}
+		// R-304: only when EVERY earlier package the hub holds was tried may this stay a wrong code.
+		if unchecked != 0 {
+			return "", &RetainedUncheckedError{Unchecked: unchecked}
+		}
 		return "", err // the fail-closed "the recovery code did not unwrap…" message; no secret in it
 	}
 	if bundle.ResticRepoPassword == "" {
@@ -173,23 +198,38 @@ func (r OffsiteKeyRecoverer) RecoverOffsiteRepoPassword(ctx context.Context, rec
 // function breaking is the behaviour we had before it existed.
 //
 // NOTHING IS LOGGED HERE and no return value carries the code, a bundle or a password.
-func (r OffsiteKeyRecoverer) tryRetained(ctx context.Context, recoveryCode string) (RetainedMatch, bool) {
+//
+// R-304 (2026-10-08): it also returns how many earlier packages were NOT tried — `withheld` from the hub, plus
+// the ones past the attempt cap — or -1 when the retained list could not be read at all. A nil FetchRetained
+// (an agent wired without the lookup) reports 0: the pre-R-311 refusal, unchanged.
+func (r OffsiteKeyRecoverer) tryRetained(ctx context.Context, recoveryCode string) (RetainedMatch, bool, int) {
 	if r.FetchRetained == nil {
-		return RetainedMatch{}, false
+		return RetainedMatch{}, false, 0
 	}
-	blobs, _, err := r.FetchRetained(ctx)
+	blobs, withheld, err := r.FetchRetained(ctx)
-	if err != nil || len(blobs) == 0 {
+	if err != nil {
-		return RetainedMatch{}, false
+		return RetainedMatch{}, false, -1
+	}
+	if withheld < 0 {
+		withheld = 0
+	}
+	if len(blobs) == 0 {
+		return RetainedMatch{}, false, withheld
 	}
 	limit := r.MaxRetainedTried
 	if limit <= 0 {
 		limit = defaultMaxRetainedTried
 	}
+	unchecked := withheld
+	if len(blobs) > limit {
+		unchecked += len(blobs) - limit
+	}
 	for i, rb := range blobs {
 		if i >= limit {
 			break
 		}
 		if len(rb.Blob) == 0 {
+			unchecked++
 			continue
 		}
 		bundle, uerr := UnwrapIdentityBundle(ctx, rb.Blob, recoveryCode)
@@ -204,7 +244,7 @@ func (r OffsiteKeyRecoverer) tryRetained(ctx context.Context, recoveryCode strin
 			// correct and must be told so — but the history behind it still cannot be reopened, and
 			// saying otherwise would be a promise this path cannot keep.
 			HasResticPassword: bundle.ResticRepoPassword != "",
-		}, true
+		}, true, 0
 	}
-	return RetainedMatch{}, false
+	return RetainedMatch{}, false, unchecked
 }

internal/escrow/recover_retained_test.go

@@ -115,8 +115,9 @@ func TestRecover_WrongCode_StaysAPlainRefusal(t *testing.T) {
 	}
 }
 
-// FAIL-SAFE — if the retained lookup itself fails, the original refusal must stand UNCHANGED. The
+// FAIL-SAFE — if the retained lookup itself fails, the lookup's error never reaches the customer and no
-// worst outcome of this feature breaking is the behaviour we had before it.
+// retained package is claimed. R-304 (2026-10-08) changed what stands instead: not the wrong-code refusal (the
+// earlier packages were never tried, so „wrong" is not known) but ErrRetainedUnchecked with Unchecked = -1.
 //
 // RED-PROOF: make tryRetained propagate the fetch error instead of returning false → the customer
 // gets a new, unexplained failure mode → this FAILS.
@@ -140,6 +141,10 @@ func TestRecover_RetainedFetchFails_OriginalRefusalStands(t *testing.T) {
 	if containsStr(err.Error(), "hub exploded") {
 		t.Error("the retained-lookup failure leaked into the customer-facing refusal — it must be silent")
 	}
+	var ue *RetainedUncheckedError
+	if !errors.As(err, &ue) || ue.Unchecked != -1 {
+		t.Errorf("err = %v, want RetainedUncheckedError{-1} — the earlier packages were never tried (R-304)", err)
+	}
 }
 
 // A nil FetchRetained keeps the pre-R-311 behaviour EXACTLY. An agent wired without it must be
@@ -228,3 +233,72 @@ func containsStr(hay, needle string) bool {
 		return false
 	})()
 }
+
+// ── R-304 (2026-10-08) — „wrong code" only when every earlier package was tried ──────────────────────
+//
+// The consequence asserted: is the refusal a WRONG CODE (the only error the screen may answer with „check your
+// typing")? It may be only when the hub withheld nothing and every served package was tried.
+//
+// RED-PROOF: make tryRetained return 0 for `unchecked` → the three „unchecked" cases return the plain refusal
+// → they FAIL; the all-tried case keeps passing.
+func TestR304_WrongCodeOnlyWhenEveryEarlierPackageWasTried(t *testing.T) {
+	ensureAge(t)
+	current := sealBundle(t, IdentityBundle{ResticRepoPassword: "4444567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}, testR)
+	other := sealBundle(t, IdentityBundle{ResticRepoPassword: "5555567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}, testR)
+	const code = "a code that opens nothing whatsoever in this test"
+	cases := []struct {
+		name      string
+		blobs     int
+		withheld  int
+		limit     int
+		unchecked int // 0 = must be a plain wrong code
+	}{
+		{"all tried, nothing withheld", 2, 0, 6, 0},
+		{"the hub withheld rows (no key material / over its cap)", 1, 3, 6, 3},
+		{"only withheld rows, nothing served", 0, 2, 6, 2},
+		{"the attempt cap stopped the loop", 5, 0, 2, 3},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			blobs := make([]RetainedBlob, 0, c.blobs)
+			for i := 0; i < c.blobs; i++ {
+				blobs = append(blobs, RetainedBlob{Blob: other, SupersededAt: "2026-08-01 00:00:00", Index: i})
+			}
+			_, err := OffsiteKeyRecoverer{
+				Fetch: fetcherFor(current),
+				FetchRetained: func(context.Context) ([]RetainedBlob, int, error) {
+					return blobs, c.withheld, nil
+				},
+				MaxRetainedTried: c.limit,
+			}.RecoverOffsiteRepoPassword(context.Background(), code)
+			if err == nil {
+				t.Fatal("a code that opens nothing succeeded")
+			}
+			var ue *RetainedUncheckedError
+			isUnchecked := errors.As(err, &ue)
+			if c.unchecked == 0 {
+				if isUnchecked {
+					t.Fatalf("every earlier package was tried — this IS a wrong code, got %v", err)
+				}
+				return
+			}
+			if !isUnchecked || ue.Unchecked != c.unchecked || !errors.Is(err, ErrRetainedUnchecked) {
+				t.Fatalf("err = %v, want RetainedUncheckedError{%d} — never call the code wrong when packages were not tried", err, c.unchecked)
+			}
+		})
+	}
+}
+
+// A malformed (empty) served package counts as not tried.
+func TestR304_EmptyServedPackageCountsAsUnchecked(t *testing.T) {
+	ensureAge(t)
+	current := sealBundle(t, IdentityBundle{ResticRepoPassword: "6666567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}, testR)
+	_, err := OffsiteKeyRecoverer{
+		Fetch:         fetcherFor(current),
+		FetchRetained: retainedFetcherFor(RetainedBlob{Blob: nil, SupersededAt: "2026-08-01 00:00:00"}),
+	}.RecoverOffsiteRepoPassword(context.Background(), testR2)
+	var ue *RetainedUncheckedError
+	if !errors.As(err, &ue) || ue.Unchecked != 1 {
+		t.Fatalf("err = %v, want RetainedUncheckedError{1}", err)
+	}
+}

internal/hub/collect.go

@@ -66,6 +66,13 @@ type ProvenRestoreTestReporter interface {
 	ProvenRestoreTests(ctx context.Context) []RestoreTest
 }
 
+// KnownBackupReporter is the newest SUCCESSFUL backup per tier and guest kept on disk (R-894's
+// backup-success-state.json). collectBackups folds it into the report so a restart does not erase the
+// hub's evidence of a backup that ran minutes before it (the kernel-night shape, 2026-10-09).
+type KnownBackupReporter interface {
+	KnownBackupSuccesses() []Backup
+}
+
 // PBSReporter is the slice-6-Phase-B seam the pbs verify loop plugs into (same pattern).
 // Returns the agent's latest-known PBS snapshot inventory + verify-state. nil → empty.
 type PBSReporter interface {
@@ -105,6 +112,7 @@ type Collector struct {
 	backups          BackupReporter
 	restoreTests     RestoreTestReporter
 	provenTests      ProvenRestoreTestReporter
+	knownBackups     KnownBackupReporter // R-894 file → host report after a restart (nil → in-memory only)
 	pbs              PBSReporter
 	temp             TempReader                                    // slice 9: host CPU/chassis temp (nil-safe → nil temp)
 	capProbe         func(ctx context.Context) []capability.Status // v0.44.0: privileged-capability self-check (nil → empty)
@@ -115,6 +123,7 @@ type Collector struct {
 	ctrlSup          ControllerSupervisorReporter                  // R-523: in-guest controller supervisor (nil → stanza omitted)
 	guestNet         GuestNetReporter                              // R-54: per-guest network watchdog (nil → stanza omitted)
 	diskTrim         GuestDiskTrimReporter                         // R-444: weekly guest disk trim (nil → stanza omitted)
+	deliberateOff    func() *DeliberateOff                         // R-998: household power-off record of this boot (nil → omitted)
 	foreignKey       ForeignKeyArchiveReporter                     // R-366 slice 2 (nil → omitted)
 	selfUpdate       SelfUpdateReporter                            // D1: agent self-update pending status (nil → false)
 	mgmtPlane        MgmtPlaneReporter                             // G1: management-plane health (nil → stanza omitted)
@@ -247,6 +256,12 @@ func (c *Collector) SetGuestDiskTrimReporter(r GuestDiskTrimReporter) *Collector
 	return c
 }
 
+// SetDeliberateOffSource wires the R-998 power-off record (poweroff.State.Current, adapted).
+func (c *Collector) SetDeliberateOffSource(f func() *DeliberateOff) *Collector {
+	c.deliberateOff = f
+	return c
+}
+
 // SelfUpdateReporter is the D1 seam the selfupdate commit-manager plugs into (same consumer-side
 // pattern — hub does not import selfupdate). nil (feature not wired) → pending=false on the report.
 type SelfUpdateReporter interface {
@@ -423,6 +438,10 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 	if c.oob != nil {
 		report.OOB = c.oob.OOBStatus(ctx)
 	}
+	// R-998: a household power-off accepted in this boot rides every report until the box is down.
+	if c.deliberateOff != nil {
+		report.DeliberateOff = c.deliberateOff()
+	}
 	return report, nil
 }
 
@@ -576,14 +595,50 @@ func (c *Collector) collectStorage(ctx context.Context) []StorageTarget {
 // collectBackups / collectRestoreTests read the agent's latest backup + restore-test state
 // via the seams. Best-effort: a nil reporter or nil slice degrades to an empty (non-nil)
 // list so the collection always marshals as [].
+//
+// The saved successes (SetKnownBackupReporter) are added for each tier and guest the in-memory list has
+// no success for at or after the saved time. Why: the in-memory list is empty after an agent restart,
+// and the hub's backup-freshness check reads only what the reports carried. Measured 2026-10-09 on
+// demo-felhom: the night backup landed 02:40 UTC, the kernel step restarted the host at 02:44, no report
+// fell in between, so two kernel nights in a row left no trace and the hub alarmed „newest backup is 48h
+// old" at 03:00. Only SUCCESSES are saved, so a failure is never hidden and never invented.
+// Pinned by TestCollectBackups_SavedSuccessSurvivesARestart.
 func (c *Collector) collectBackups(ctx context.Context) []Backup {
-	if c.backups == nil {
+	out := []Backup{}
-		return []Backup{}
+	if c.backups != nil {
+		if b := c.backups.Backups(ctx); b != nil {
+			out = append(out, b...)
+		}
 	}
-	if b := c.backups.Backups(ctx); b != nil {
+	if c.knownBackups == nil {
-		return b
+		return out
 	}
-	return []Backup{}
+	for _, k := range c.knownBackups.KnownBackupSuccesses() {
+		kt, err := time.Parse(time.RFC3339, k.StartedAt)
+		if err != nil {
+			continue
+		}
+		covered := false
+		for _, b := range out {
+			if !b.Success || b.TargetID != k.TargetID || b.VMID != k.VMID {
+				continue
+			}
+			if bt, err := time.Parse(time.RFC3339, b.StartedAt); err == nil && !bt.Before(kt) {
+				covered = true
+				break
+			}
+		}
+		if !covered {
+			out = append(out, k)
+		}
+	}
+	return out
+}
+
+// SetKnownBackupReporter wires the R-894 saved successes into the host report (nil-safe → in-memory only).
+func (c *Collector) SetKnownBackupReporter(r KnownBackupReporter) *Collector {
+	c.knownBackups = r
+	return c
 }
 
 // collectRestoreTests merges the in-memory result with the PERSISTED per-tier proofs (R-189).

internal/hub/collect_knownbackups_test.go

@@ -0,0 +1,62 @@
+package hub
+
+import (
+	"context"
+	"testing"
+)
+
+type fakeMemBackups []Backup
+
+func (f fakeMemBackups) Backups(context.Context) []Backup { return f }
+
+type fakeKnownBackups []Backup
+
+func (f fakeKnownBackups) KnownBackupSuccesses() []Backup { return f }
+
+// The consequence, not the mechanism: after a restart (empty in-memory list) the host report still carries
+// the night's backup, so the hub's freshness check sees it. Measured 2026-10-09 on demo-felhom: without this
+// the report carried backups: [] and the hub alarmed „newest backup is 48h old" an hour after a good backup.
+// RED-PROOF: return before the saved-success loop in collectBackups → the first case reports nothing → fails.
+func TestCollectBackups_SavedSuccessSurvivesARestart(t *testing.T) {
+	saved := Backup{TargetID: "felhom-backup", VMID: 9201, Success: true, StartedAt: "2026-10-09T02:40:16Z"}
+
+	t.Run("restart: memory empty, the saved success is reported", func(t *testing.T) {
+		c := &Collector{backups: fakeMemBackups(nil), knownBackups: fakeKnownBackups{saved}}
+		got := c.collectBackups(context.Background())
+		if len(got) != 1 || got[0].StartedAt != saved.StartedAt || !got[0].Success || got[0].TargetID != "felhom-backup" {
+			t.Fatalf("want the saved success, got %+v", got)
+		}
+	})
+
+	t.Run("memory holds the same or a newer success: no second entry", func(t *testing.T) {
+		mem := Backup{TargetID: "felhom-backup", VMID: 9201, Success: true, StartedAt: "2026-10-09T02:40:16Z", Archive: "a"}
+		c := &Collector{backups: fakeMemBackups{mem}, knownBackups: fakeKnownBackups{saved}}
+		if got := c.collectBackups(context.Background()); len(got) != 1 || got[0].Archive != "a" {
+			t.Fatalf("want only the in-memory record, got %+v", got)
+		}
+	})
+
+	t.Run("a newer FAILURE in memory never hides the saved success, and is kept", func(t *testing.T) {
+		fail := Backup{TargetID: "felhom-backup", VMID: 9201, Success: false, StartedAt: "2026-10-10T02:40:00Z", Error: "x"}
+		c := &Collector{backups: fakeMemBackups{fail}, knownBackups: fakeKnownBackups{saved}}
+		got := c.collectBackups(context.Background())
+		if len(got) != 2 || got[0].Success || !got[1].Success {
+			t.Fatalf("want the failure and the saved success, got %+v", got)
+		}
+	})
+
+	t.Run("another tier's success does not cover this tier", func(t *testing.T) {
+		other := Backup{TargetID: "felhom-pbs", VMID: 9201, Success: true, StartedAt: "2026-10-10T00:00:00Z"}
+		c := &Collector{backups: fakeMemBackups{other}, knownBackups: fakeKnownBackups{saved}}
+		if got := c.collectBackups(context.Background()); len(got) != 2 {
+			t.Fatalf("want both tiers, got %+v", got)
+		}
+	})
+
+	t.Run("no saved state wired: the in-memory list as before, never nil", func(t *testing.T) {
+		c := &Collector{}
+		if got := c.collectBackups(context.Background()); got == nil || len(got) != 0 {
+			t.Fatalf("want an empty non-nil list, got %#v", got)
+		}
+	})
+}

internal/hub/deliberate_off_test.go

@@ -0,0 +1,29 @@
+package hub
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// R-998: the power-off path waits on SetReportedHook, so the hook must fire only for a report the hub
+// ACCEPTED — a failed push must not let the box power off believing the hub knows.
+func TestLoop_ReportedHookOnlyAfterAcceptedReport(t *testing.T) {
+	var cn, rn int32
+	rep := &HostReport{DeliberateOff: &DeliberateOff{RequestedAt: "2026-10-13T18:00:00Z"}}
+	loop := NewLoop(&fakeCollector{report: rep, n: &cn},
+		&fakeReporter{env: &ControlEnvelope{}, errSeq: []error{errors.New("hub 5xx")}, n: &rn},
+		900*time.Second, quietLogger())
+	var seen []*HostReport
+	loop.SetReportedHook(func(r *HostReport) { seen = append(seen, r) })
+
+	loop.cycle(context.Background(), 900*time.Second) // the push fails
+	if len(seen) != 0 {
+		t.Fatalf("hook fired for a refused report: %d", len(seen))
+	}
+	loop.cycle(context.Background(), 900*time.Second) // the push is accepted
+	if len(seen) != 1 || seen[0].DeliberateOff == nil || seen[0].DeliberateOff.RequestedAt != "2026-10-13T18:00:00Z" {
+		t.Fatalf("hook after an accepted report = %+v", seen)
+	}
+}

internal/hub/loop.go

@@ -66,8 +66,15 @@ type Loop struct {
 	// retry, no duplicate shipping). Loop state is single-goroutine (cycle only).
 	logTailSource  func(maxBytes int) []string
 	logTailPending bool
+
+	// reported (R-998) is called after every report the hub ACCEPTED, with that report. The power-off
+	// path waits on it so the hub has the deliberate-off record before the box goes down.
+	reported func(r *HostReport)
 }
 
+// SetReportedHook wires the R-998 after-report observer. Optional.
+func (l *Loop) SetReportedHook(f func(r *HostReport)) { l.reported = f }
+
 // logTailMaxBytes caps the heartbeat log tail (newest lines kept).
 const logTailMaxBytes = 128 * 1024
 
@@ -156,6 +163,9 @@ func (l *Loop) cycle(ctx context.Context, current time.Duration) time.Duration {
 		l.logger.Warn("hub: report failed; keeping current interval", "err", err)
 		return current
 	}
+	if l.reported != nil {
+		l.reported(report)
+	}
 	if report.LogTail != nil {
 		// Transparency: the pull is visible in the box's own log (and thus in the ring).
 		l.logger.Info("operator log pull served", "component", "agent", "lines", len(report.LogTail.Lines))

internal/hub/report.go

@@ -144,6 +144,12 @@ type HostReport struct {
 	// in the steady state, so the cross-repo host-report golden stays byte-stable.
 	LogTail *LogTail `json:"log_tail,omitempty"`
 
+	// DeliberateOff (R-998, doc 14): the household asked this box to power off, in THIS boot. Present on
+	// every report from the request until the box goes down; absent again after the next boot — that
+	// absence is how the hub learns the box is back. The hub holds its silence alarms while it is set
+	// (14 days). `omitempty`: absent in the steady state, so the cross-repo host-report golden stays stable.
+	DeliberateOff *DeliberateOff `json:"deliberate_off,omitempty"`
+
 	// OOB is the operator-access health stanza (TASK H1). It answers the operator's question — "can I
 	// get into this box right now, and if not, why" — from the hub: felhom-sshd up + on which port,
 	// locally reachable, the tunnel handshake age (the OOB path rides wg-felhom), whether the operator
@@ -758,3 +764,8 @@ type ForeignKeyArchives struct {
 	Oldest string `json:"oldest"`
 	Newest string `json:"newest"`
 }
+
+// DeliberateOff is the household-requested power-off record (R-998).
+type DeliberateOff struct {
+	RequestedAt string `json:"requested_at"` // RFC3339 UTC, the agent's clock
+}

internal/localapi/afterbackup_test.go

@@ -15,7 +15,7 @@ import (
 // Red-proof: drop the `b.Success &&` guard and the failed-backup sub-case fails; move the call after release()
 // and the gate sub-case fails.
 func TestAfterPrimaryBackup(t *testing.T) {
-	run := func(t *testing.T, failErr string) (calls []int, gateHeld bool) {
+	run := func(t *testing.T, failErr, path string) (calls []int, gateHeld bool) {
 		gate := &backup.InFlight{}
 		b := &fakeBackups{failErr: failErr}
 		srv := newTestServerS(t, &fakeGuests{}, b, &fakeStore{}, nil)
@@ -34,7 +34,7 @@ func TestAfterPrimaryBackup(t *testing.T) {
 			done <- struct{}{}
 		})
 		h := srv.Handler()
-		if do(t, h, "POST", "/backup", "A", "").Code != http.StatusAccepted {
+		if do(t, h, "POST", path, "A", "").Code != http.StatusAccepted {
 			t.Fatal("POST /backup not accepted")
 		}
 		select {
@@ -47,7 +47,7 @@ func TestAfterPrimaryBackup(t *testing.T) {
 		return calls, gateHeld
 	}
 	t.Run("success runs the leg under the gate", func(t *testing.T) {
-		calls, held := run(t, "")
+		calls, held := run(t, "", "/backup")
 		if len(calls) != 1 {
 			t.Fatalf("the leg ran %d time(s), want 1", len(calls))
 		}
@@ -56,8 +56,21 @@ func TestAfterPrimaryBackup(t *testing.T) {
 		}
 	})
 	t.Run("a failed backup runs nothing", func(t *testing.T) {
-		if calls, _ := run(t, "vzdump exploded"); len(calls) != 0 {
+		if calls, _ := run(t, "vzdump exploded", "/backup"); len(calls) != 0 {
 			t.Fatalf("the leg ran after a FAILED backup: %v", calls)
 		}
 	})
+	// R-899: a household press is not the night's backup — no OS leg after it. Same fake, same successful backup as
+	// the first sub-case; only the query differs. Red-proof: make handleBackup ignore `trigger` and this sub-case
+	// fails with the leg run once.
+	t.Run("a manual press runs nothing", func(t *testing.T) {
+		if calls, _ := run(t, "", "/backup?trigger=manual"); len(calls) != 0 {
+			t.Fatalf("the OS leg ran after a manual press: %v", calls)
+		}
+	})
+	t.Run("the scheduled path with the new query still runs the leg", func(t *testing.T) {
+		if calls, _ := run(t, "", "/backup?trigger=night"); len(calls) != 1 {
+			t.Fatalf("the leg ran %d time(s) after a non-manual backup, want 1", len(calls))
+		}
+	})
 }

internal/localapi/escrow_ceremony.go

@@ -226,6 +226,9 @@ func (s *Server) handleEscrowCeremonyStart(w http.ResponseWriter, r *http.Reques
 	if base == nil {
 		base = context.Background()
 	}
+	// The reply's fields are read HERE, before the job goroutine may write job.Phase (a data race the race
+	// detector caught, 2026-10-13 — the reply could show the finished phase or a torn value).
+	jobID, phase := job.JobID, job.Phase
 	done := make(chan struct{})
 	go func() {
 		defer close(done)
@@ -274,7 +277,7 @@ func (s *Server) handleEscrowCeremonyStart(w http.ResponseWriter, r *http.Reques
 			"claim_ttl_s", int(escrowClaimTTL.Seconds()), "duration_ms", time.Since(start).Milliseconds())
 	}()
 	s.escrowDone = done // tests wait on it; production polls the status endpoint
-	writeStatus(w, http.StatusAccepted, true, map[string]any{"vmid": vmid, "job_id": job.JobID, "phase": job.Phase}, "")
+	writeStatus(w, http.StatusAccepted, true, map[string]any{"vmid": vmid, "job_id": jobID, "phase": phase}, "")
 }
 
 // handleEscrowCeremonyStatus is GET /escrow/ceremony/status: phase + the NON-SECRET summary.

internal/localapi/escrow_recover.go

@@ -127,6 +127,22 @@ func (s *Server) handleRecoverOffsitePassword(w http.ResponseWriter, r *http.Req
 					"retained_has_restic_pw": match.HasResticPassword,
 				},
 				"the recovery code is correct, but it belongs to an EARLIER sealed package (superseded "+match.SupersededAt+"), not the one currently held")
+		// ── R-304 (2026-10-08) — NOT EVERY EARLIER PACKAGE WAS CHECKED. ─────────────────────────
+		//
+		// The current package refused the code, no retained package opened it — and at least one earlier
+		// package the hub holds was never tried (or the list could not be read). Saying „the code is
+		// wrong" here would claim a check that did not happen. 424 (Failed Dependency): the verdict
+		// depends on packages we could not try. The controller classifies on the status, never on this
+		// sentence; an older controller maps an unknown status to its neutral „we do not know why".
+		case errors.Is(err, escrow.ErrRetainedUnchecked):
+			n := -1
+			var ue *escrow.RetainedUncheckedError
+			if errors.As(err, &ue) {
+				n = ue.Unchecked
+			}
+			s.logger.Warn("local-api: offsite key recovery: the code did not open the current package and earlier packages were NOT all checked — not reported as a wrong code (R-304)", "vmid", vmid, "unchecked", n)
+			writeStatus(w, http.StatusFailedDependency, false, map[string]any{"older_unchecked": n},
+				"the recovery code did not open the current sealed package, and earlier packages the hub holds were not all checked — the code may belong to one of them; nothing was written")
 		case errors.Is(err, escrow.ErrNoResticPassword):
 			s.logger.Warn("local-api: offsite key recovery: the bundle opened but predates the repository-password field", "vmid", vmid)
 			writeErr(w, http.StatusConflict, "the recovery code opened the bundle, but it carries NO offsite repository password (sealed before that field existed; it cannot be retro-fitted)")

internal/localapi/escrow_recover_class_test.go

@@ -54,6 +54,13 @@ func TestRecoverOffsitePassword_EachSituationGetsItsOwnStatus(t *testing.T) {
 			wantStatus: 404,
 			mustNotSay: []string{"did not open"},
 		},
+		{
+			// R-304: earlier packages were not all tried — never „did not open the sealed bundle" (the wrong-code words).
+			name:       "earlier packages not all checked — not a wrong code",
+			err:        &escrow.RetainedUncheckedError{Unchecked: 2},
+			wantStatus: 424,
+			mustNotSay: []string{"did not open the sealed bundle", "could not be fetched"},
+		},
 		{
 			name:       "the bundle predates the repository-password field",
 			err:        escrow.ErrNoResticPassword,

internal/localapi/guestbind.go

@@ -1,6 +1,7 @@
 package localapi
 
 import (
+	"time"
 	"context"
 	"fmt"
 	"log/slog"
@@ -104,6 +105,26 @@ func (b *GuestBinder) RebootGuest(ctx context.Context, vmid int) error {
 	return nil
 }
 
+// ShutdownGuest stops the guest cleanly with a time limit (R-998 host power-off, step 2). `pct shutdown`
+// blocks until the guest is down or the limit passes; then it fails and the guest is still running.
+func (b *GuestBinder) ShutdownGuest(ctx context.Context, vmid int, timeout time.Duration) error {
+	secs := int(timeout / time.Second)
+	if secs < 1 {
+		secs = 1
+	}
+	b.logger.Warn("host-poweroff: shutting the guest down", "vmid", vmid, "timeout_s", secs)
+	if err := b.run(ctx, "pct", "shutdown", strconv.Itoa(vmid), "--timeout", strconv.Itoa(secs)); err != nil {
+		return fmt.Errorf("host-poweroff: pct shutdown %d: %w", vmid, err)
+	}
+	return nil
+}
+
+// PowerOffHost powers the Proxmox host off (R-998, step 3). The one fixed vector `/usr/bin/systemctl poweroff`.
+func (b *GuestBinder) PowerOffHost(ctx context.Context) error {
+	b.logger.Warn("host-poweroff: powering the host off")
+	return b.run(ctx, "/usr/bin/systemctl", "poweroff")
+}
+
 func (b *GuestBinder) run(ctx context.Context, name string, args ...string) error {
 	_, stderr, err := b.runner.Run(ctx, name, args...)
 	if err != nil {

internal/localapi/hostpoweroff.go

@@ -0,0 +1,362 @@
+package localapi
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/poweroff"
+)
+
+// ── POST /host/poweroff (R-998, documentation/architecture/14-host-power-off.md) ──────────────────────
+//
+// The household's „A gép kikapcsolása": shut THIS guest down cleanly, then power the whole host off. The
+// first local-API route whose effect reaches beyond the caller's own guest — a compromised controller can
+// now switch the box off, and nobody can switch it on remotely. The mitigations are the limits below:
+//
+//   - refused in the first 10 minutes after boot (no power-off loop);
+//   - at most ONE accepted request per boot (poweroff.State, persisted, keyed by the boot);
+//   - refused while a backup, restore test, OS update step, controller update, drive format, NAS verify
+//     or escrow ceremony runs, or a vzdump of the guest is in flight — each named in the 409;
+//   - refused while ANY OTHER guest or VM runs on the host (security review 2026-10-13): one guest's
+//     controller must not switch off another household's guest, a scratch guest or a test VM (demo-hp
+//     carries the Tester 1 VM). Read from /proc (`lxc-start -n N`, `kvm -id N`), fail closed;
+//   - the heavy-operation gate is TAKEN on acceptance and never given back (the box is going down), so no
+//     backup, restore test or OS step can start between the checks and the power-off (security review).
+//     Released only if the power-off command itself fails.
+//
+// Every check fails CLOSED: an unwired gate, an unreadable task list or /proc refuses.
+// On acceptance the record is written FIRST, the hub is given a report carrying it (bounded wait), and
+// only then: guest shutdown (time-limited), host power-off. Pinned by hostpoweroff_test.go.
+
+// HostPowerer is the privileged half: both run as fixed sudo vectors (configs/felhom-agent.sudoers).
+type HostPowerer interface {
+	ShutdownGuest(ctx context.Context, vmid int, timeout time.Duration) error
+	PowerOffHost(ctx context.Context) error
+}
+
+// HostPowerOffConfig wires the route. A nil config leaves it answering 503.
+type HostPowerOffConfig struct {
+	State     *poweroff.State
+	Power     HostPowerer
+	ReportNow func(ctx context.Context) bool // push a report carrying the record; true = the hub accepted it
+	Uptime    func() (time.Duration, bool)   // time since host boot; false = unknown (refuse)
+	Running   func() ([]int, error)          // vmids of every running guest and VM on the host; default /proc
+	MinUptime time.Duration                  // default 10 min
+	GuestStop time.Duration                  // pct shutdown --timeout; default 120 s
+	ReportMax time.Duration                  // longest wait for the hub; default 60 s
+	JobWait   time.Duration                  // longest wait for a job that started after acceptance; default 15 min
+	JobPoll   time.Duration                  // how often that wait looks again; default 10 s
+	Now       func() time.Time
+}
+
+// Refusal codes — the controller maps each to a household sentence. Stable wire values.
+const (
+	PowerOffTooSoon      = "too_soon_after_boot"
+	PowerOffAlreadyAsked = "already_requested_this_boot"
+	PowerOffBackup       = "backup_running"
+	PowerOffRestoreTest  = "restore_test_running"
+	PowerOffOSUpdate     = "os_update_running"
+	PowerOffCtrlUpdate   = "controller_update_running"
+	PowerOffDrive        = "drive_operation_running"
+	PowerOffEscrow       = "escrow_ceremony_running"
+	PowerOffBusy         = "host_busy"
+	PowerOffOtherGuests  = "other_guests_running"
+	PowerOffUnknown      = "state_unknown"
+)
+
+// SetHostPowerOff enables POST /host/poweroff.
+func (s *Server) SetHostPowerOff(c HostPowerOffConfig) {
+	if c.MinUptime == 0 {
+		c.MinUptime = 10 * time.Minute
+	}
+	if c.GuestStop == 0 {
+		c.GuestStop = 120 * time.Second
+	}
+	if c.ReportMax == 0 {
+		c.ReportMax = 60 * time.Second
+	}
+	if c.Now == nil {
+		c.Now = time.Now
+	}
+	if c.JobWait == 0 {
+		c.JobWait = 15 * time.Minute
+	}
+	if c.JobPoll == 0 {
+		c.JobPoll = 10 * time.Second
+	}
+	if c.Running == nil {
+		c.Running = func() ([]int, error) { return runningGuestsFromProc("/proc") }
+	}
+	s.powerOff = &c
+}
+
+type hostPowerOffRequest struct {
+	VMID int `json:"vmid"`
+}
+
+func (s *Server) handleHostPowerOff(w http.ResponseWriter, r *http.Request, vmid int) {
+	c := s.powerOff
+	if c == nil || c.State == nil || c.Power == nil {
+		writeErr(w, http.StatusServiceUnavailable, "host power-off not configured on this host")
+		return
+	}
+	if r.ContentLength != 0 {
+		var req hostPowerOffRequest
+		if !decodeBody(w, r, &req) {
+			return
+		}
+		if !s.scopedFromBody(w, req.VMID, vmid, r.URL.Path) {
+			return
+		}
+	}
+	// One decision at a time: two requests racing must not both pass the guards before either marks.
+	s.powerOffMu.Lock()
+	defer s.powerOffMu.Unlock()
+	if code, detail := s.powerOffBlocker(r.Context(), vmid); code != "" {
+		s.logger.Info("local-api: host power-off refused", "vmid", vmid, "reason", code, "detail", detail)
+		writeStatus(w, http.StatusConflict, false, map[string]any{"reason": code, "detail": detail}, "host power-off refused: "+code)
+		return
+	}
+	// Take the heavy-operation gate for good: nothing heavy may start between these checks and the power-off.
+	release, busy, free := s.inFlight.TryAcquire("host-poweroff")
+	if !free {
+		writeStatus(w, http.StatusConflict, false, map[string]any{"reason": PowerOffBusy, "detail": busy}, "host power-off refused: "+PowerOffBusy)
+		return
+	}
+	rec, err := c.State.Mark(c.Now(), vmid)
+	if err != nil {
+		release()
+		code := PowerOffUnknown
+		if errors.Is(err, poweroff.ErrAlreadyThisBoot) {
+			code = PowerOffAlreadyAsked
+		}
+		s.logger.Warn("local-api: host power-off refused (record)", "vmid", vmid, "reason", code, "err", err)
+		writeStatus(w, http.StatusConflict, false, map[string]any{"reason": code, "detail": err.Error()}, "host power-off refused: "+code)
+		return
+	}
+	s.logger.Warn("local-api: HOST POWER-OFF accepted (household request)", "vmid", vmid,
+		"requested_at", rec.RequestedAt.Format(time.RFC3339))
+	base := s.baseCtx
+	if base == nil {
+		base = context.Background()
+	}
+	go s.runHostPowerOff(base, vmid, release)
+	writeStatus(w, http.StatusAccepted, true, map[string]any{
+		"vmid": vmid, "powering_off": true, "requested_at": rec.RequestedAt.Format(time.RFC3339),
+	}, "")
+}
+
+// runHostPowerOff: hub first (bounded), then the guest (time-limited), then the host. A failed guest
+// shutdown does not stop the power-off — the household asked for it, and Proxmox's own shutdown stops
+// any guest still running (pve-guests) before the host goes down.
+func (s *Server) runHostPowerOff(base context.Context, vmid int, release func()) {
+	c := s.powerOff
+	if c.ReportNow != nil {
+		ctx, cancel := context.WithTimeout(base, c.ReportMax)
+		ok := c.ReportNow(ctx)
+		cancel()
+		s.logger.Warn("host-poweroff: step 1/3 — hub told", "vmid", vmid, "hub_accepted", ok)
+	}
+	if !s.waitJobsClear(base, vmid, "before the guest shutdown") {
+		release()
+		return
+	}
+	start := time.Now()
+	ctx, cancel := context.WithTimeout(base, c.GuestStop+60*time.Second)
+	err := c.Power.ShutdownGuest(ctx, vmid, c.GuestStop)
+	cancel()
+	if err != nil {
+		s.logger.Error("host-poweroff: step 2/3 — guest shutdown failed; powering off anyway", "vmid", vmid,
+			"took", time.Since(start).Round(time.Second), "err", err)
+	} else {
+		s.logger.Warn("host-poweroff: step 2/3 — guest stopped", "vmid", vmid, "took", time.Since(start).Round(time.Second))
+	}
+	if !s.waitJobsClear(base, vmid, "before the host power-off") {
+		release()
+		return
+	}
+	s.logger.Warn("host-poweroff: step 3/3 — powering the host off")
+	ctx, cancel = context.WithTimeout(base, 60*time.Second)
+	defer cancel()
+	if err := c.Power.PowerOffHost(ctx); err != nil {
+		s.logger.Error("host-poweroff: host power-off command failed — heavy-operation gate released", "err", err)
+		release()
+	}
+}
+
+// powerOffBlocker returns the first reason to refuse ("" = none) and a detail for the log/operator.
+func (s *Server) powerOffBlocker(ctx context.Context, vmid int) (string, string) {
+	c := s.powerOff
+	if c.State.Current() != nil {
+		return PowerOffAlreadyAsked, "a power-off was already accepted in this boot"
+	}
+	if c.Uptime == nil {
+		return PowerOffUnknown, "uptime not wired"
+	}
+	up, ok := c.Uptime()
+	if !ok {
+		return PowerOffUnknown, "cannot read the host uptime"
+	}
+	if up < c.MinUptime {
+		return PowerOffTooSoon, "host up " + up.Round(time.Second).String() + ", minimum " + c.MinUptime.String()
+	}
+	if s.inFlight == nil || s.staleLock == nil {
+		return PowerOffUnknown, "the heavy-operation gate or the Proxmox task reader is not wired"
+	}
+	if code, detail := s.otherGuestsBlocker(vmid); code != "" {
+		return code, detail
+	}
+	if busy := s.inFlight.Busy(); busy != "" {
+		switch {
+		case strings.HasPrefix(busy, "backup:"):
+			return PowerOffBackup, busy
+		case busy == "restore-test":
+			return PowerOffRestoreTest, busy
+		case strings.HasPrefix(busy, "os-"):
+			return PowerOffOSUpdate, busy
+		default:
+			return PowerOffBusy, busy
+		}
+	}
+	return s.jobBlocker(ctx, vmid)
+}
+
+// jobBlocker is the part of the checks that can change after acceptance — a backup job, a controller update, a drive
+// or NAS job, an escrow ceremony, a Proxmox vzdump. runHostPowerOff asks it again before each step (security review
+// 2026-10-13: the checks ran only once). The heavy-operation gate is not here: the power-off holds it.
+func (s *Server) jobBlocker(ctx context.Context, vmid int) (string, string) {
+	s.jobsMu.Lock()
+	for k, j := range s.jobs {
+		if j != nil && backupInFlight(j.Phase) {
+			s.jobsMu.Unlock()
+			return PowerOffBackup, "backup job " + j.JobID + " on target " + k.target
+		}
+	}
+	s.jobsMu.Unlock()
+	s.swapMu.Lock()
+	for v, on := range s.swapInFlight {
+		if on {
+			s.swapMu.Unlock()
+			return PowerOffCtrlUpdate, "controller swap in flight for guest " + strconv.Itoa(v)
+		}
+	}
+	s.swapMu.Unlock()
+	if s.formatJobs != nil {
+		if j := s.formatJobs.get(); j != nil && j.Phase == formatPhaseRunning {
+			return PowerOffDrive, "drive format running"
+		}
+	}
+	s.netVerifyMu.Lock()
+	nv := s.netVerifyCur != nil && s.netVerifyCur.Phase == netVerifyPhaseRunning
+	s.netVerifyMu.Unlock()
+	if nv {
+		return PowerOffDrive, "network storage verify running"
+	}
+	s.escrowMu.Lock()
+	esc := s.escrowJob != nil && s.escrowJob.Phase == escrowPhaseRunning
+	s.escrowMu.Unlock()
+	if esc {
+		return PowerOffEscrow, "escrow ceremony running"
+	}
+	vz, err := s.staleLock.BackupRunning(ctx, vmid)
+	if err != nil {
+		return PowerOffUnknown, "cannot list running Proxmox tasks: " + err.Error()
+	}
+	if vz {
+		return PowerOffBackup, "vzdump running for guest " + strconv.Itoa(vmid)
+	}
+	return "", ""
+}
+
+// runningGuestsFromProc lists the vmids of running containers (`lxc-start … -n N`) and VMs (`kvm -id N`) from
+// the process table — readable by the non-root agent, unlike /run/qemu-server (measured on demo-hp 2026-10-13).
+// An unreadable /proc is an error (fail closed); an unreadable single process is skipped (it exited).
+func runningGuestsFromProc(procDir string) ([]int, error) {
+	ents, err := os.ReadDir(procDir)
+	if err != nil {
+		return nil, err
+	}
+	seen := map[int]bool{}
+	var out []int
+	for _, e := range ents {
+		if _, err := strconv.Atoi(e.Name()); err != nil {
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(procDir, e.Name(), "cmdline"))
+		if err != nil || len(raw) == 0 {
+			continue
+		}
+		args := strings.Split(strings.TrimRight(string(raw), "\x00"), "\x00")
+		flag := ""
+		switch filepath.Base(args[0]) {
+		case "lxc-start":
+			flag = "-n"
+		case "kvm", "qemu-system-x86_64":
+			flag = "-id"
+		default:
+			continue
+		}
+		for i := 1; i+1 < len(args); i++ {
+			if args[i] == flag {
+				if v, err := strconv.Atoi(args[i+1]); err == nil && !seen[v] {
+					seen[v] = true
+					out = append(out, v)
+				}
+			}
+		}
+	}
+	return out, nil
+}
+
+// otherGuestsBlocker refuses while any guest or VM other than the caller's runs (or the list cannot be read).
+func (s *Server) otherGuestsBlocker(vmid int) (string, string) {
+	running, err := s.powerOff.Running()
+	if err != nil {
+		return PowerOffUnknown, "cannot list the running guests: " + err.Error()
+	}
+	var others []string
+	for _, v := range running {
+		if v != vmid {
+			others = append(others, strconv.Itoa(v))
+		}
+	}
+	if len(others) > 0 {
+		return PowerOffOtherGuests, "other guests or VMs running: " + strings.Join(others, ", ")
+	}
+	return "", ""
+}
+
+// waitJobsClear waits until jobBlocker finds nothing, at most JobWait. false = still busy (or unreadable) at the end:
+// the power-off is CANCELLED — the box stays on, the gate is released, the log says why. Better a box that did not
+// switch off than a backup, update or format cut in the middle.
+func (s *Server) waitJobsClear(base context.Context, vmid int, when string) bool {
+	c := s.powerOff
+	ctx, cancel := context.WithTimeout(base, c.JobWait)
+	defer cancel()
+	for {
+		// Another guest or VM started after acceptance (security review 2026-10-13): no waiting — cancel at once.
+		if code, detail := s.otherGuestsBlocker(vmid); code != "" {
+			s.logger.Error("host-poweroff: CANCELLED — another guest is running now; the box stays on", "when", when,
+				"reason", code, "detail", detail)
+			return false
+		}
+		code, detail := s.jobBlocker(ctx, vmid)
+		if code == "" {
+			return true
+		}
+		s.logger.Warn("host-poweroff: waiting — a job started after the request", "when", when, "reason", code, "detail", detail)
+		select {
+		case <-ctx.Done():
+			s.logger.Error("host-poweroff: CANCELLED — still busy after the wait; the box stays on", "when", when,
+				"reason", code, "detail", detail, "waited", c.JobWait)
+			return false
+		case <-time.After(c.JobPoll):
+		}
+	}
+}

internal/localapi/hostpoweroff_test.go

@@ -0,0 +1,353 @@
+package localapi
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/backup"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/poweroff"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
+)
+
+// fakePower records the power-off steps in order.
+type fakePower struct {
+	mu    sync.Mutex
+	steps []string
+}
+
+func (f *fakePower) ShutdownGuest(_ context.Context, vmid int, timeout time.Duration) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.steps = append(f.steps, "shutdown:"+itoaT(vmid)+":"+timeout.String())
+	return nil
+}
+func (f *fakePower) PowerOffHost(context.Context) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.steps = append(f.steps, "poweroff")
+	return nil
+}
+func (f *fakePower) got() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.steps...)
+}
+
+func itoaT(n int) string { b, _ := json.Marshal(n); return string(b) }
+
+type fakeVzdump struct{ running bool }
+
+func (f fakeVzdump) Guests(context.Context) ([]proxmox.Guest, error)      { return nil, nil }
+func (f fakeVzdump) Lock(context.Context, int) (string, bool, error)      { return "", true, nil }
+func (f fakeVzdump) BackupRunning(context.Context, int) (bool, error)     { return f.running, nil }
+func (f fakeVzdump) Unlock(context.Context, int) error                    { return nil }
+func (f fakeVzdump) Start(context.Context, int) error                     { return nil }
+func (f fakeVzdump) HasVzdumpSnapshot(context.Context, int) (bool, error) { return false, nil }
+func (f fakeVzdump) DeleteVzdumpSnapshot(context.Context, int) error      { return nil }
+
+type powerRig struct {
+	srv    *Server
+	h      http.Handler
+	power  *fakePower
+	state  *poweroff.State
+	report *[]string
+}
+
+func newPowerRig(t *testing.T, uptime time.Duration) *powerRig {
+	t.Helper()
+	srv := newTestServerS(t, &fakeGuests{}, &fakeBackups{}, &fakeStore{}, nil)
+	srv.inFlight = &backup.InFlight{}
+	srv.staleLock = fakeVzdump{}
+	p := &fakePower{}
+	st := poweroff.New(filepath.Join(t.TempDir(), "poweroff.json"), func() string { return "1700000000" })
+	var reports []string
+	srv.SetHostPowerOff(HostPowerOffConfig{
+		State: st,
+		Power: p,
+		ReportNow: func(context.Context) bool {
+			// The record must already exist when the hub is told — that is the point of telling it.
+			if st.Current() == nil {
+				reports = append(reports, "report-without-record")
+			} else if len(p.got()) != 0 {
+				reports = append(reports, "report-after-"+p.got()[0])
+			} else {
+				reports = append(reports, "report")
+			}
+			return true
+		},
+		Uptime:  func() (time.Duration, bool) { return uptime, true },
+		Running: func() ([]int, error) { return []int{8200}, nil },
+		Now:     func() time.Time { return testNow },
+	})
+	return &powerRig{srv: srv, h: srv.Handler(), power: p, state: st, report: &reports}
+}
+
+func (r *powerRig) waitSteps(t *testing.T, n int) []string {
+	t.Helper()
+	for i := 0; i < 200 && len(r.power.got()) < n; i++ {
+		time.Sleep(time.Millisecond)
+	}
+	return r.power.got()
+}
+
+func reasonOf(t *testing.T, body []byte) string {
+	t.Helper()
+	var resp struct {
+		Data struct {
+			Reason string `json:"reason"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		t.Fatalf("body %s: %v", body, err)
+	}
+	return resp.Data.Reason
+}
+
+// The whole path: 202, the record written, the hub told FIRST, then guest shutdown (120 s), then host off.
+func TestHostPowerOff_AcceptedOrder(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("got %d want 202 (%s)", w.Code, w.Body.String())
+	}
+	steps := r.waitSteps(t, 2)
+	want := []string{"shutdown:8200:2m0s", "poweroff"}
+	if len(steps) != 2 || steps[0] != want[0] || steps[1] != want[1] {
+		t.Fatalf("steps = %v, want %v", steps, want)
+	}
+	// The heavy-operation gate stays taken: no backup can start between the checks and the power-off.
+	if _, busy, ok := r.srv.inFlight.TryAcquire("backup:primary"); ok || busy != "host-poweroff" {
+		t.Fatalf("after acceptance a backup could take the gate (ok=%v busy=%q)", ok, busy)
+	}
+	if len(*r.report) != 1 || (*r.report)[0] != "report" {
+		t.Fatalf("hub report = %v, want one report carrying the record", *r.report)
+	}
+	if rec := r.state.Current(); rec == nil || rec.VMID != 8200 {
+		t.Fatalf("record = %+v", rec)
+	}
+}
+
+// Refused during a backup — the shared heavy-operation gate held by a backup tier.
+func TestHostPowerOff_RefusedDuringBackup(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	release, _, ok := r.srv.inFlight.TryAcquire("backup:primary")
+	if !ok {
+		t.Fatal("could not hold the gate")
+	}
+	defer release()
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffBackup {
+		t.Fatalf("got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffBackup)
+	}
+	time.Sleep(5 * time.Millisecond)
+	if s := r.power.got(); len(s) != 0 {
+		t.Fatalf("power steps ran during a backup: %v", s)
+	}
+	if r.state.Current() != nil {
+		t.Fatal("a refused request must not use up the boot's one request")
+	}
+	// The same guard names a restore test and an OS step.
+	release()
+	for gate, want := range map[string]string{"restore-test": PowerOffRestoreTest, "os-pve-step": PowerOffOSUpdate} {
+		rel, _, _ := r.srv.inFlight.TryAcquire(gate)
+		w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+		rel()
+		if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != want {
+			t.Fatalf("%s: got %d %s, want 409 %s", gate, w.Code, w.Body.String(), want)
+		}
+	}
+}
+
+// A vzdump of the guest in flight (a Proxmox task, not the agent's own gate) refuses too.
+func TestHostPowerOff_RefusedDuringVzdump(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	r.srv.staleLock = fakeVzdump{running: true}
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffBackup {
+		t.Fatalf("got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffBackup)
+	}
+}
+
+// One accepted request per boot: the second is refused and nothing runs twice.
+func TestHostPowerOff_SecondRequestSameBootRefused(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	if w := do(t, r.h, "POST", "/host/poweroff", "A", ""); w.Code != http.StatusAccepted {
+		t.Fatalf("first: %d", w.Code)
+	}
+	r.waitSteps(t, 2)
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffAlreadyAsked {
+		t.Fatalf("second: got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffAlreadyAsked)
+	}
+	time.Sleep(5 * time.Millisecond)
+	if s := r.power.got(); len(s) != 2 {
+		t.Fatalf("steps = %v, want exactly one run", s)
+	}
+}
+
+// Refused in the first 10 minutes after boot; an unknown uptime refuses too (fail closed).
+func TestHostPowerOff_TooSoonAfterBoot(t *testing.T) {
+	r := newPowerRig(t, 9*time.Minute)
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffTooSoon {
+		t.Fatalf("got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffTooSoon)
+	}
+	r.srv.powerOff.Uptime = func() (time.Duration, bool) { return 0, false }
+	w = do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffUnknown {
+		t.Fatalf("unknown uptime: got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffUnknown)
+	}
+}
+
+// Not configured → 503; another guest's vmid in the body → 403; no token → 401.
+func TestHostPowerOff_ScopeAndConfig(t *testing.T) {
+	plain := newTestServer(t, &fakeGuests{}, &fakeBackups{}, &fakeStore{}, nil)
+	if w := do(t, plain, "POST", "/host/poweroff", "A", ""); w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("unconfigured: %d", w.Code)
+	}
+	r := newPowerRig(t, time.Hour)
+	if w := do(t, r.h, "POST", "/host/poweroff", "A", `{"vmid":9300}`); w.Code != http.StatusForbidden {
+		t.Fatalf("cross-guest: %d", w.Code)
+	}
+	if w := do(t, r.h, "POST", "/host/poweroff", "", ""); w.Code != http.StatusUnauthorized {
+		t.Fatalf("no token: %d", w.Code)
+	}
+	if r.state.Current() != nil || len(r.power.got()) != 0 {
+		t.Fatal("a refused request changed state")
+	}
+}
+
+// Another guest or VM on the host refuses: one controller must not switch off someone else's guest (security
+// review 2026-10-13; demo-hp runs a scratch guest and the Tester 1 VM). An unreadable process list refuses too.
+func TestHostPowerOff_RefusedWhileOtherGuestsRun(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	r.srv.powerOff.Running = func() ([]int, error) { return []int{8200, 9202, 341}, nil }
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffOtherGuests {
+		t.Fatalf("got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffOtherGuests)
+	}
+	r.srv.powerOff.Running = func() ([]int, error) { return nil, errors.New("no /proc") }
+	w = do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffUnknown {
+		t.Fatalf("unreadable: got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffUnknown)
+	}
+	if len(r.power.got()) != 0 || r.state.Current() != nil {
+		t.Fatal("a refused request changed state")
+	}
+}
+
+// Fail closed: an unwired vzdump reader refuses instead of skipping the check.
+func TestHostPowerOff_FailsClosedWithoutTaskReader(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	r.srv.staleLock = nil
+	w := do(t, r.h, "POST", "/host/poweroff", "A", "")
+	if w.Code != http.StatusConflict || reasonOf(t, w.Body.Bytes()) != PowerOffUnknown {
+		t.Fatalf("got %d %s, want 409 %s", w.Code, w.Body.String(), PowerOffUnknown)
+	}
+}
+
+// The /proc reader finds containers and VMs by their real command lines (as measured on demo-hp).
+func TestRunningGuestsFromProc(t *testing.T) {
+	dir := t.TempDir()
+	write := func(pid, cmd string) {
+		_ = os.MkdirAll(filepath.Join(dir, pid), 0o755)
+		_ = os.WriteFile(filepath.Join(dir, pid, "cmdline"), []byte(strings.ReplaceAll(cmd, " ", "\x00")+"\x00"), 0o644)
+	}
+	write("1927", "/usr/bin/lxc-start -F -n 9201")
+	write("1900", "/usr/bin/lxc-start -F -n 9202")
+	write("1823", "/usr/bin/kvm -id 341 -name night1004-tester1 -no-shutdown")
+	write("974", "/usr/libexec/lxc/lxc-monitord --daemon")
+	write("50", "/usr/bin/bash -c echo -n 5")
+	_ = os.MkdirAll(filepath.Join(dir, "self"), 0o755)
+	got, err := runningGuestsFromProc(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sort.Ints(got)
+	if len(got) != 3 || got[0] != 341 || got[1] != 9201 || got[2] != 9202 {
+		t.Fatalf("got %v, want [341 9201 9202]", got)
+	}
+	if _, err := runningGuestsFromProc(filepath.Join(dir, "missing")); err == nil {
+		t.Fatal("an unreadable /proc must be an error")
+	}
+}
+
+// switchVzdump is a vzdump reader the test can flip while the power-off runs.
+type switchVzdump struct {
+	fakeVzdump
+	on *atomic.Bool
+}
+
+func (f switchVzdump) BackupRunning(context.Context, int) (bool, error) { return f.on.Load(), nil }
+
+// A job that starts AFTER acceptance (security review 2026-10-13): the power-off waits; if the job is still running
+// when the wait ends, the power-off is cancelled — no guest shutdown, no host power-off, the gate given back.
+func TestHostPowerOff_JobStartedAfterAcceptance(t *testing.T) {
+	// (a) it clears during the wait → the power-off goes ahead after it
+	r := newPowerRig(t, time.Hour)
+	var on atomic.Bool
+	r.srv.staleLock = switchVzdump{on: &on}
+	r.srv.powerOff.JobWait, r.srv.powerOff.JobPoll = 2*time.Second, 2*time.Millisecond
+	r.srv.powerOff.ReportNow = func(context.Context) bool { on.Store(true); return true } // a vzdump starts now
+	if w := do(t, r.h, "POST", "/host/poweroff", "A", ""); w.Code != http.StatusAccepted {
+		t.Fatalf("accept: %d %s", w.Code, w.Body.String())
+	}
+	time.Sleep(30 * time.Millisecond)
+	if s := r.power.got(); len(s) != 0 {
+		t.Fatalf("a step ran while the vzdump ran: %v", s)
+	}
+	on.Store(false)
+	if s := r.waitSteps(t, 2); len(s) != 2 {
+		t.Fatalf("after the vzdump ended the steps = %v, want shutdown + poweroff", s)
+	}
+
+	// (b) it never clears → cancelled, nothing switched off, the heavy gate free again
+	r2 := newPowerRig(t, time.Hour)
+	var on2 atomic.Bool
+	r2.srv.staleLock = switchVzdump{on: &on2}
+	r2.srv.powerOff.JobWait, r2.srv.powerOff.JobPoll = 40*time.Millisecond, 2*time.Millisecond
+	r2.srv.powerOff.ReportNow = func(context.Context) bool { on2.Store(true); return true }
+	if w := do(t, r2.h, "POST", "/host/poweroff", "A", ""); w.Code != http.StatusAccepted {
+		t.Fatalf("accept: %d", w.Code)
+	}
+	time.Sleep(150 * time.Millisecond)
+	if s := r2.power.got(); len(s) != 0 {
+		t.Fatalf("cancelled power-off still ran: %v", s)
+	}
+	if busy := r2.srv.inFlight.Busy(); busy != "" {
+		t.Fatalf("the heavy gate is still held after a cancel: %q", busy)
+	}
+}
+
+// A guest or VM started AFTER acceptance cancels the power-off at once (security review 2026-10-13).
+func TestHostPowerOff_OtherGuestStartedAfterAcceptance(t *testing.T) {
+	r := newPowerRig(t, time.Hour)
+	var started atomic.Bool
+	r.srv.powerOff.Running = func() ([]int, error) {
+		if started.Load() {
+			return []int{8200, 341}, nil
+		}
+		return []int{8200}, nil
+	}
+	r.srv.powerOff.ReportNow = func(context.Context) bool { started.Store(true); return true } // a VM starts now
+	if w := do(t, r.h, "POST", "/host/poweroff", "A", ""); w.Code != http.StatusAccepted {
+		t.Fatalf("accept: %d %s", w.Code, w.Body.String())
+	}
+	time.Sleep(50 * time.Millisecond)
+	if s := r.power.got(); len(s) != 0 {
+		t.Fatalf("power-off ran although a VM started: %v", s)
+	}
+	if busy := r.srv.inFlight.Busy(); busy != "" {
+		t.Fatalf("the heavy gate is still held after a cancel: %q", busy)
+	}
+}

internal/localapi/server.go

@@ -394,6 +394,10 @@ type Server struct {
 	// detached pipeline runs through (tests inject; production defaults set in NewServer).
 	netVerifyMu  sync.Mutex
 	netVerifyCur *netVerifyJob
+
+	// R-998: POST /host/poweroff (nil = not configured → 503); one guard-and-mark decision at a time.
+	powerOff   *HostPowerOffConfig
+	powerOffMu sync.Mutex
 	// netTrigger performs the mount-waking directory read through the automount path (Q1).
 	netTrigger func(where string) error
 	// netMounted judges mount success from /proc/mounts — the §8 truth source (never readability).
@@ -550,6 +554,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /disks/guest-attach", s.withGuest(s.handleDiskGuestAttach))
 	// Guest reboot (slice 10 P2 activation): user-triggered restart to activate pending drive binds.
 	mux.HandleFunc("POST /guest/reboot", s.withGuest(s.handleGuestReboot))
+	// Host power-off (R-998, doc 14): the household's „A gép kikapcsolása". Guarded in hostpoweroff.go.
+	mux.HandleFunc("POST /host/poweroff", s.withGuest(s.handleHostPowerOff))
 	// Guest RAM resize (v0.90.0, R-24): read current allocation + bounds, and apply a bounded resize
 	// (live cgroup apply, no reboot). Self-scoped; the agent enforces every bound fresh per request.
 	mux.HandleFunc("GET /guest/memory", s.withGuest(s.handleGuestMemory))
@@ -825,6 +831,10 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request, vmid int)
 		return
 	}
 	key := backupJobKey{vmid: vmid, target: tier.TargetID}
+	// R-899 (operator ruling 2026-10-08): a household press („Mentés most") is not the night's backup. A controller
+	// that knows sends `trigger=manual`; then the OS leg does not follow (it belongs to the night, after the night's
+	// own copy). An older controller sends nothing and keeps the old behaviour.
+	manual := r.URL.Query().Get("trigger") == "manual"
 
 	// ONE BACKUP AT A TIME PER GUEST, ACROSS ALL TIERS (operator ruling 2026-07-26: "other backup
 	// shouldn't start until finished"). vzdump takes a guest lock, so a concurrent second backup
@@ -926,7 +936,9 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request, vmid int)
 		}
 		s.finishJob(key, jobID, b)
 		// OS leg (agent v0.140.0): after the night's whole-guest copy exists, still holding the heavy-op gate.
-		if b.Success && tier.Primary && s.afterPrimaryBackup != nil {
+		if b.Success && tier.Primary && s.afterPrimaryBackup != nil && manual {
+			s.logger.Info("local-api: no OS leg after a manual backup — it follows the night's own backup (R-899)", "vmid", vmid, "job", jobID)
+		} else if b.Success && tier.Primary && s.afterPrimaryBackup != nil {
 			s.afterPrimaryBackup(base, vmid)
 		}
 	}()

internal/osupdate/kernel.go

@@ -33,7 +33,7 @@ const OpKernelStep = "os_kernel_step"
 
 // DefaultKernelJudgeWait is how long a one-shot boot may take to come back healthy before the agent reverts it ONCE.
 // Measured 2026-10-07 (`audits/kernel-lane-2026-10-07/B/`): every container healthy 68 s after a reboot on demo-felhom,
-// 272 s on demo-hp; 20 minutes stays under the hub's 30-minute host_stale (a box that never comes back alarms after it).
+// 272 s on demo-hp; 20 minutes stays under the hub's 45-minute host_stale (a box that never comes back alarms after it).
 const DefaultKernelJudgeWait = 20 * time.Minute
 
 var kverRE = regexp.MustCompile(`^[0-9]+\.[0-9]+\.[0-9]+-[0-9]+-pve$`)
@@ -51,6 +51,24 @@ type KernelView struct {
 	VMID           int     `json:"vmid"` // the customer guest the step was staged for (the health rule's guest)
 }
 
+// kernelReportRing is the ring an after-boot report carries. In the first second after a boot the agent has not
+// fetched the hub's block yet, and Block() then answers ring 1 — so a ring-0 box's „judging" report said ring 1
+// (seen on demo-felhom, 2026-10-08 night, `audits/kernel-night-2026-10-07/readback/`). Order: the fetched block; the
+// block the daemon saved on disk before the reboot (R-866); ring 1 as before. A label only: the hub's approval reads its
+// own ring list. Pinned by TestKernelReportRing_BeforeFirstFetch.
+func (l *Leg) kernelReportRing() int {
+	l.mu.Lock()
+	fetched := l.block
+	l.mu.Unlock()
+	if fetched != nil {
+		return fetched.Ring
+	}
+	if b, _, ok := LoadSavedBlock(l.planDir()); ok && b != nil {
+		return b.Ring
+	}
+	return 1
+}
+
 func parseKernel(raw json.RawMessage) KernelView {
 	var v KernelView
 	_ = json.Unmarshal(raw, &v)
@@ -119,8 +137,12 @@ func (l *Leg) runKernel(ctx context.Context, runID string, vmid int, trigger str
 		lg.Info("osupdate: kernel step skipped — ring 1 boots only a kernel a signed os_kernel_step staged", "phase", st.Phase, "staged", st.To, "want", want)
 		return Report{}
 	default:
+		// R-898: EXACTLY the kernel the household was told about — never "whatever is pending tonight" (the sources can
+		// offer a newer one by night; the step then refused, R23, and the night was lost). A version no longer
+		// installable is refused by the wrapper before any change (R7) and the hub tells the household again.
 		wr, cerr := l.call(ctx, runID, kernelPlan("apply", vmid, map[string]any{"release_id": "ring0-" + runID,
-			"select": "pending-kernel", "expect_kver": want, "run_id": runID, "trigger": trigger, "ring": blk.Ring}))
+			"select": "listed", "packages": KernelSet(want), "expect_kver": want, "run_id": runID, "trigger": trigger,
+			"ring": blk.Ring}))
 		rep.unsent = reportFile(l.planDir(), runID, LayerKernel, "apply")
 		rep.Kernel = rawOrNil(wr.Kernel)
 		switch {
@@ -186,7 +208,7 @@ func (l *Leg) KernelAfterBoot(ctx context.Context, vmid int, j KernelJudge) Repo
 	if vmid <= 0 {
 		vmid = v.VMID // after a boot the guest may not run yet — the step's own record names it
 	}
-	rep := Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.Block().Ring, VMID: vmid, Mode: "kernel-boot",
+	rep := Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.kernelReportRing(), VMID: vmid, Mode: "kernel-boot",
 		ReleaseID: v.To, Kernel: rawOrNil(wr.Kernel)}
 	switch wr.KernelEvent {
 	case "fell_back":
@@ -236,7 +258,7 @@ func (l *Leg) judgeKernel(ctx context.Context, runID string, vmid int, v KernelV
 	for {
 		if !hubReached && l.Hub != nil {
 			// the hub's reachability IS this report reaching it (and the operator sees the box is back on the new kernel)
-			body, _ := json.Marshal(Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.Block().Ring, VMID: vmid,
+			body, _ := json.Marshal(Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.kernelReportRing(), VMID: vmid,
 				Mode: "kernel-boot", ReleaseID: v.To, Outcome: "judging", Kernel: mustRaw(v)})
 			rctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 			if err := l.Hub.PostOSReport(rctx, body); err == nil {
@@ -276,7 +298,7 @@ func (l *Leg) judgeKernel(ctx context.Context, runID string, vmid int, v KernelV
 		return Report{}
 	}
 	// not healthy by the deadline: tell the hub (best effort), then ONE self-revert into the old kernel
-	rep := l.finish(ctx, lg, Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.Block().Ring, VMID: vmid,
+	rep := l.finish(ctx, lg, Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.kernelReportRing(), VMID: vmid,
 		Mode: "kernel-revert", ReleaseID: v.To, Outcome: "health_failed", HealthReason: why + " — reverting to " + v.From,
 		Kernel: mustRaw(v)})
 	lg.Error("osupdate: kernel step — the one-shot boot is NOT healthy; restarting ONCE into the old kernel", "reason", why,
@@ -285,7 +307,7 @@ func (l *Leg) judgeKernel(ctx context.Context, runID string, vmid int, v KernelV
 	if err != nil || wr.refused() || wr.failed() {
 		lg.Error("osupdate: kernel self-revert did not start — the box stays on the new kernel; the operator decides",
 			"err", err, "refused", string(firstRaw(wr.Refused, wr.Failed)))
-		return l.finish(ctx, lg, Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.Block().Ring, VMID: vmid,
+		return l.finish(ctx, lg, Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.kernelReportRing(), VMID: vmid,
 			Mode: "kernel-revert", ReleaseID: v.To, Outcome: "revert_failed", Refused: firstRaw(wr.Refused, wr.Failed),
 			HealthReason: "the self-revert did not start"})
 	}
@@ -294,7 +316,7 @@ func (l *Leg) judgeKernel(ctx context.Context, runID string, vmid int, v KernelV
 
 func (l *Leg) kernelGood(ctx context.Context, runID string, vmid int, v KernelView, start time.Time, lg *slog.Logger) Report {
 	wr, err := l.call(ctx, runID, kernelPlan("kernel-good", vmid, nil))
-	rep := Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.Block().Ring, VMID: vmid, Mode: "kernel-good",
+	rep := Report{RunID: runID, Layer: LayerKernel, Trigger: "boot", Ring: l.kernelReportRing(), VMID: vmid, Mode: "kernel-good",
 		ReleaseID: v.To}
 	switch {
 	case err != nil:
@@ -322,6 +344,21 @@ func truncate(s string, n int) string {
 	return s[:n]
 }
 
+// KernelSet is the package set that installs exactly kver (R-898; the hub's kernelSet, field-exact): the series
+// meta-package and the signed image, both at the kernel's own version. Proxmox keeps old kernel versions in its archive.
+// nil for a string that is not a kernel version.
+func KernelSet(kver string) []Package {
+	m := kverSeriesRE.FindStringSubmatch(kver)
+	if m == nil {
+		return nil
+	}
+	v := kver[:len(kver)-len("-pve")]
+	return []Package{{Name: "proxmox-kernel-" + m[1], Version: v, Origin: PVEOrigin},
+		{Name: "proxmox-kernel-" + kver + "-signed", Version: v, Origin: PVEOrigin}}
+}
+
+var kverSeriesRE = regexp.MustCompile(`^([0-9]+\.[0-9]+)\.[0-9]+-[0-9]+-pve$`)
+
 // KernelStepParams are a signed os_kernel_step's params: the exact kernel set (the wrapper compares it with the plan).
 type KernelStepParams struct {
 	ReleaseID string    `json:"release_id"`

internal/osupdate/kernel_test.go

@@ -54,8 +54,12 @@ func TestKernel_Ring0ToldNightStagesThenReboots(t *testing.T) {
 			ap = x
 		}
 	}
-	if ap["select"] != "pending-kernel" || ap["expect_kver"] != kNew || ap["lane"] != "slow" {
+	// R-898: EXACTLY the told kernel — the listed set derived from it, never "pending" (red before the fix: select was
-		t.Fatalf("stage plan = %v", ap)
+	// pending-kernel, so a newer kernel in the sources by night was refused R23 and the night was lost)
+	pk, _ := json.Marshal(ap["packages"])
+	if ap["select"] != "listed" || ap["expect_kver"] != kNew || ap["lane"] != "slow" ||
+		string(pk) != `[{"name":"proxmox-kernel-7.0","origin":"Proxmox Debian Repository","version":"7.0.14-22"},{"name":"proxmox-kernel-7.0.14-22-pve-signed","origin":"Proxmox Debian Repository","version":"7.0.14-22"}]` {
+		t.Fatalf("stage plan = %v (packages %s)", ap, pk)
 	}
 	if p.Kernel.Outcome != "staged" || !p.Kernel.Healthy {
 		t.Fatalf("kernel report = %+v", p.Kernel)
@@ -312,3 +316,13 @@ func TestKernel_KeptStageReportIsStaged(t *testing.T) {
 		t.Fatalf("kept = %+v", rep)
 	}
 }
+
+func TestKernelSet(t *testing.T) {
+	if got := KernelSet("7.0.14-20-pve"); len(got) != 2 || got[0].Name != "proxmox-kernel-7.0" || got[0].Version != "7.0.14-20" ||
+		got[1].Name != "proxmox-kernel-7.0.14-20-pve-signed" {
+		t.Fatalf("%+v", got)
+	}
+	if KernelSet("7.0; reboot") != nil || KernelSet("") != nil {
+		t.Fatal("a non-kernel string must give no set")
+	}
+}

internal/osupdate/r899_ring_test.go

@@ -0,0 +1,32 @@
+package osupdate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+)
+
+// After a boot the agent has not fetched the hub's block yet; the after-boot kernel report must still carry the
+// box's real ring (seen 2026-10-08: a ring-0 box's „judging" report said ring 1). Red-proof: return Block().Ring
+// from kernelReportRing and the saved-block case fails with 1.
+func TestKernelReportRing_BeforeFirstFetch(t *testing.T) {
+	dir := t.TempDir()
+	l := &Leg{PlanDir: dir}
+	if got := l.kernelReportRing(); got != 1 {
+		t.Fatalf("nothing fetched, nothing saved: ring %d, want 1 (the old default)", got)
+	}
+	l.saveBlock(&hub.WireOSUpdate{Ring: 0, Enabled: true})
+	l2 := &Leg{PlanDir: dir} // a fresh daemon after the reboot: no block fetched yet
+	if got := l2.kernelReportRing(); got != 0 {
+		t.Fatalf("ring-0 block saved before the reboot: ring %d, want 0", got)
+	}
+	l2.SetBlock(&hub.WireOSUpdate{Ring: 1, Enabled: true})
+	if got := l2.kernelReportRing(); got != 1 {
+		t.Fatalf("a fetched block wins over the saved one: ring %d, want 1", got)
+	}
+	if _, err := os.Stat(filepath.Join(dir, SavedBlockFile)); err != nil {
+		t.Fatalf("saved block missing: %v", err)
+	}
+}

internal/poweroff/state.go

@@ -0,0 +1,117 @@
+// Package poweroff keeps the box's record of a household-requested power-off (R-998, doc 14).
+//
+// One small JSON file in the agent's state dir. A record belongs to the boot it was made in (the
+// kernel's btime from /proc/stat), so:
+//   - "at most one accepted request per boot": Mark refuses when this boot already has a record;
+//   - the host report carries the record only while the box is still in that boot (Current), and
+//     the next boot's reports carry nothing — that absence is how the hub learns the box is back.
+//
+// Pinned by state_test.go.
+package poweroff
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+// ErrAlreadyThisBoot is Mark's refusal: a power-off was already accepted in the current boot.
+var ErrAlreadyThisBoot = errors.New("a power-off was already accepted in this boot")
+
+// ErrBootUnknown is Mark's refusal when the boot cannot be identified — fail closed: without it the
+// per-boot limit could not hold.
+var ErrBootUnknown = errors.New("cannot read the host's boot time")
+
+// Record is one accepted request.
+type Record struct {
+	RequestedAt time.Time `json:"requested_at"`
+	BootBtime   string    `json:"boot_btime"` // /proc/stat btime of the boot it was accepted in
+	VMID        int       `json:"vmid"`       // the guest whose controller asked
+}
+
+// State is the persisted record.
+type State struct {
+	path  string
+	btime func() string
+	mu    sync.Mutex
+}
+
+// New returns the state at path. btime returns the current boot's /proc/stat btime ("" = unknown).
+func New(path string, btime func() string) *State {
+	if btime == nil {
+		btime = ProcBtime
+	}
+	return &State{path: path, btime: btime}
+}
+
+// Current is the record made in THIS boot, or nil (none, another boot's, unreadable).
+func (s *State) Current() *Record {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	r := s.load()
+	b := s.btime()
+	if r == nil || b == "" || r.BootBtime != b {
+		return nil
+	}
+	return r
+}
+
+// Mark records an accepted request for this boot. It refuses a second one in the same boot.
+func (s *State) Mark(now time.Time, vmid int) (*Record, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	b := s.btime()
+	if b == "" {
+		return nil, ErrBootUnknown
+	}
+	if r := s.load(); r != nil && r.BootBtime == b {
+		return nil, ErrAlreadyThisBoot
+	}
+	r := &Record{RequestedAt: now.UTC().Truncate(time.Second), BootBtime: b, VMID: vmid}
+	data, _ := json.Marshal(r)
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o750); err != nil {
+		return nil, fmt.Errorf("poweroff: state dir: %w", err)
+	}
+	tmp := s.path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0o600); err != nil {
+		return nil, fmt.Errorf("poweroff: write: %w", err)
+	}
+	if err := os.Rename(tmp, s.path); err != nil {
+		return nil, fmt.Errorf("poweroff: rename: %w", err)
+	}
+	return r, nil
+}
+
+func (s *State) load() *Record {
+	data, err := os.ReadFile(s.path)
+	if err != nil {
+		return nil
+	}
+	var r Record
+	if json.Unmarshal(data, &r) != nil || r.BootBtime == "" {
+		return nil
+	}
+	return &r
+}
+
+// ProcBtime reads the boot time (seconds since the epoch, as text) from /proc/stat; "" when unreadable.
+func ProcBtime() string {
+	data, err := os.ReadFile("/proc/stat")
+	if err != nil {
+		return ""
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.HasPrefix(line, "btime ") {
+			return strings.TrimSpace(strings.TrimPrefix(line, "btime "))
+		}
+	}
+	return ""
+}

internal/poweroff/state_test.go

@@ -0,0 +1,41 @@
+package poweroff
+
+import (
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// One accepted request per boot; the record is "current" only in the boot it was made in.
+func TestOnePerBootAndCurrentFollowsTheBoot(t *testing.T) {
+	boot := "1000"
+	s := New(filepath.Join(t.TempDir(), "poweroff.json"), func() string { return boot })
+	if s.Current() != nil {
+		t.Fatal("no record yet, Current must be nil")
+	}
+	now := time.Date(2026, 10, 13, 18, 0, 0, 0, time.UTC)
+	if _, err := s.Mark(now, 9201); err != nil {
+		t.Fatalf("first Mark: %v", err)
+	}
+	if r := s.Current(); r == nil || !r.RequestedAt.Equal(now) || r.VMID != 9201 {
+		t.Fatalf("Current after Mark = %+v", r)
+	}
+	if _, err := s.Mark(now.Add(time.Minute), 9201); !errors.Is(err, ErrAlreadyThisBoot) {
+		t.Fatalf("second Mark in the same boot: err = %v, want ErrAlreadyThisBoot", err)
+	}
+	boot = "2000" // the machine was switched on again
+	if s.Current() != nil {
+		t.Fatal("a record from the previous boot must not be current")
+	}
+	if _, err := s.Mark(now.Add(time.Hour), 9201); err != nil {
+		t.Fatalf("Mark in a new boot: %v", err)
+	}
+}
+
+func TestUnknownBootFailsClosed(t *testing.T) {
+	s := New(filepath.Join(t.TempDir(), "p.json"), func() string { return "" })
+	if _, err := s.Mark(time.Now(), 1); !errors.Is(err, ErrBootUnknown) {
+		t.Fatalf("err = %v, want ErrBootUnknown", err)
+	}
+}