v0.173.0 vouched and delivered to the three test boxes; pinned.day0_agent = 0.173.0 (D50)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,4 +1,145 @@
-## Unreleased (2026-10-28 night) — R-528: GET /guest/oom-kills, the kernel's OOM counter of each of the guest's containers, read on the host — commit only; the next agent release (needs the operator's vouch)
+## v0.173.0 (2026-11-10) — R-1368 part 2: the self-update folder keeps what it needs and no more — RELEASED and VOUCHED 2026-11-10 (release-agent.sh from a clean clone of `776025c`; agent sha256 752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea, bundle sha256 51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1)
+
+- **The defect (measured 2026-11-10, space list place H12).** `Execute` downloads each new agent to
+  `<state dir>/selfupdate/felhom-agent-<version>` and removed that file only when the download or its checksum failed.
+  A good update left it for ever: 49 / 48 / 33 binaries = 740 / 724 / 509 MB on demo-hp, demo-felhom and Tester 1.
+- **What the folder is needed for (read first: `configs/felhom-selfupdate-guarded`).** The root wrapper reads the staged
+  file once, copies it to its own root-owned folder and flips from that copy. The rollback needs `pending.json` (in the
+  folder) and `/usr/local/bin/felhom-agent.prev` (outside it); the commit needs `pending.json`. No staged binary.
+- **The fix (`internal/selfupdate/prune.go`).** After the wrapper's `commit` returned success, `MaybeCommit` removes
+  every staged binary but the running version's. Nothing is removed while a pending marker exists or cannot be read,
+  at a plain start, after a rollback (the failed version's binary stays to be read), or when the running version is
+  not a version this code can name a file for. Only a regular file with exactly the name `Execute` writes is removed,
+  one `os.Remove` per name; a failed removal is logged and never fails the commit. A download and a prune take turns
+  (`stagingMu`).
+- **Tests `TestPrune_*` (6).** After six updates the folder holds one binary and every bystander (unknown names, a
+  folder and a symlink that carry a staged name); a pending or unreadable marker refuses; only a healthy commit prunes;
+  the name rule follows `versionRe`; the wrapper's `commit` and `rollback` blocks name no staged binary; and the
+  wrapper's REAL `commit` and `rollback` verbs, run from a sandboxed copy, still put the previous binary back after
+  four pruned updates. **Red seen three times:** no prune call; no pending refusal; no regular-file check.
+- **Not reached.** `/usr/local/bin/felhom-agent.bak-*` (place H13): root-owned, in a folder the agent cannot write, made
+  by a person. R-1368 part 4 stays open.
+- **Corrected 2026-11-10 (measured on three boxes).** This entry said: „A box gets the clean-up at its first good update
+  AFTER the one that brings this code". That was wrong. The commit runs in the NEW binary, so the box cleans the folder
+  at the commit of the update that brings the code.
+- **Delivered 2026-11-10 to the three test boxes by a signed `agent_update` each (no bundle job: `configs/` did not
+  change since v0.172.1).** The folder before → after, read on each box: demo-hp 49 entries / 722,596 KB → 1 / 16,028 KB
+  (commit 14:59:19 UTC, `removed=49`); demo-felhom 48 / 706,968 KB → 1 / 16,028 KB (commit 14:51:50 UTC, `removed=48`);
+  Tester 1 33 / 497,244 KB → 1 / 16,028 KB (commit 15:00:19 UTC, `removed=33`). After each: `pending.json` absent,
+  `/usr/local/bin/felhom-agent.prev` = 0.172.1, the unit active with no restart.
+- **A rollback still works after the clean-up (Tester 1, 2026-11-10 15:14 UTC).** A signed `agent_update` to 0.172.1
+  (the vouched version; it has no prune code) was installed with its pending marker. One `SEGV` in the 60-second dwell
+  → the unit's `OnFailure` → the wrapper's `rollback` → 0.173.0 ran again 9 seconds after the install, `pending.json`
+  gone, no failed unit. The failed version's staged file stays (by design, until the next good update): the folder
+  holds 2 files, 32,040 KB. Evidence: felhom.eu `documentation/audits/release-space-fixes-2026-11-10/agent/`.
+- **Vouched by the operator 2026-11-10 16:29:16 CET** (read from the hub log: `Artifact manifest set: agent=0.173.0`, the
+  bundle sha = the release). `pinned.day0_agent` = 0.173.0 (D50).
+
+## v0.172.1 (2026-11-07) — proxmox-grub joins the boot-chain lane: the nightly pve step stops being refused R6 — RELEASED and VOUCHED 2026-11-07 (release-agent.sh from `39db030`; agent sha256 505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8, bundle 3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3)
+
+- **The defect (measured on demo-felhom, 2026-11-05, 11-06, 11-07).** Proxmox published `proxmox-grub` 2.12-9+pmx4. It
+  depends on `grub-efi-amd64` of the same version. `HOST_SLOW_RE` matches `grub` only at the START of a name, so
+  `proxmox-grub` landed in the ring-0 pve plan; the simulation then pulled `grub-efi-amd64`, which is not in the plan,
+  and `felhom-os-apply` refused the WHOLE pve step (R6 „the plan would touch grub-efi-amd64") every night — 34 Proxmox
+  userspace upgrades held with it, and an `os_update_failed` error mail each morning. The same class as the 2026-10-09
+  `proxmox-secure-boot-support` fix. Read-only proof on the box: `apt-get -s install --only-upgrade proxmox-grub` →
+  `Inst grub-efi-amd64 …pmx4`.
+- **The fix.** `proxmox-grub` joins `HOST_SLOW_RE`: GRUB's meta-package now waits with the rest of the boot chain (the
+  slow lane, the operator's signed step), and the pve step runs without it.
+- **Test** `test_ring0_pending_pve_leaves_proxmox_grub_out`; red seen before the fix (proxmox-grub entered the plan), green
+  after; the wrapper suite 149 of 149.
+- **Delivered 2026-11-07 (operator, signed jobs):** demo-felhom, demo-hp, Tester 1 — `agent_update` committed
+  (23:05/23:13/23:13 CET), then the bundle: `BUNDLE DONE agent=0.172.1 written=1 same=30 self-check=ok`, capability probe
+  77/77 on each. `pinned.day0_agent` = 0.172.1 (D50).
+- **Delivery.** `configs/` changed, so a box needs BOTH signed jobs: `agent_update` 0.172.1, then `agent_config_update`
+  0.172.1 with the bundle sha. Not vouched by CC. Bundle vs 0.170.0 (what the boxes run): no path added or removed, only
+  `felhom-os-apply` changed — so no step bundle is needed (R-880). Both downloads re-checked by sha.
+
+## v0.172.0 (2026-11-03) — R-1302: the first grant of a tier is no loss — RELEASED and VOUCHED 10:18:10 CET (release-agent.sh from a clean clone of `ecbb0cc`; agent sha256 2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7, config bundle cc34b0bc3346ffd6a4ba80fe9269852dced8c56c9503c8b14a50d9ded2961cce; configs/ unchanged since 0.171.0, so the signed delivery was agent_update alone)
+
+- **R-1302 — the first grant of a tier is no loss.** A fresh install arms the whole-guest tier before its storage exists, so the
+  first probe found no grant, repaired it and logged ERROR „GRANT WAS MISSING … investigate the loss (R-190)" plus a DEGRADED
+  capability, on every new box (VM 9375, 2026-10-26). The agent now remembers which tiers have EVER held their grant
+  (`<state dir>/store-grant-seen.json`, written by a healthy probe). A first grant logs INFO „granted" and reports healthy; a
+  grant that existed and vanished keeps R-190's ERROR and its one degraded cycle. A doubt keeps the ERROR: an unreadable or
+  corrupt file, or no file path. A box updated to this agent records its tiers at the first healthy probe, so a loss in the
+  one probe before that would read as a first grant. Tests `TestR1302_*`; red seen with the first-grant branch removed and on
+  three more mutants.
+
+## v0.171.0 (2026-10-30) — R-1344 decided from the night's measurement: a controller that runs but does not answer is RESTARTED — RELEASED (release-agent.sh from a clean clone of `bd18347`; agent sha256 c888ca7ba22a1f689059081575814a725e2edcecbb6bcc56829e9d9de88202a5, config bundle 95f977f6dc827185f2b5a2aa9e1c829db41a9f425d49eb40f317286d13c83d2b; binary-only signed agent_update on Tester 1, demo-hp, demo-felhom; vouched by the operator 2026-10-30 10:47:36 CET; `pinned.day0_agent` = 0.171.0). Live on Tester 1: the controller frozen (SIGSTOP) 09:24:50 UTC → Docker „unhealthy" 09:26:36 → the alarm 09:29:21 → the restart 09:31:22 → healthy 09:31:24; the hub mailed `controller_unresponsive` and `controller_unresponsive_restart` (hub 0.178.0), not `controller_restarted_by_agent`
+
+- **The measurement (operator brief 2026-10-29 Part 2, read 2026-10-30).** Docker's own health record of the controller
+  on Tester 1 and demo-hp, every probe from 2026-10-29 11:12 to 2026-10-30 07:00 UTC: 4 733 probes through the night
+  chain (demo-hp's PBS vzdump, Tester 1's local vzdump, both DB dumps, tier-2, the off-site push, a restore test, two
+  controller updates). No failed probe, no 5-s timeout; slowest 303 ms (demo-hp, during the PBS vzdump). The only
+  „unhealthy" was the controller stopped by hand for a proof. A busy night never came near ONE failed probe.
+- **So the alarm becomes a restart.** At `controllerUnresponsiveConfirm` = 6 unhealthy sweeps the alarm is raised, as
+  before. At `controllerUnresponsiveRestart` = 10 (2 minutes later; ~6.5 minutes after the first failed probe) the agent
+  restarts the controller's bootstrap unit — unless the controller's busy file is fresh (a backup, a restore, an
+  update, an export) or cannot be read, or the brake refuses (3 restarts in 15 minutes → the crash-loop pause, which
+  the hub mails). A swap, a parked guest, a locked guest and a vzdump keep resetting the count, as before. A refusal
+  keeps the alarm and is logged once per reason. After a restart the count starts again from zero.
+- **The stanza** carries `unresponsive_restart_after_s` (120: the hub's alarm text says when the restart comes) and
+  `unresponsive_restart_at` (equals `last_restart_at` for that act; the hub mails `controller_unresponsive_restart`).
+- **Refactor, no behaviour change:** the not-running restart's brake and its record are now `supervisorBrakeAllows`
+  and `recordSupervisorRestart`, shared by both restarts. The busy-file stale log line no longer says „operator reboot".
+- Tests `TestSupervisor_UnresponsiveIsAlarmedThenRestarted`, `…Guards` (now also: never restarted),
+  `…RestartRefusals` (busy fresh, busy unreadable, the brake, a crash-loop pause), `…StaleBusyFileDoesNotShield` —
+  red first (build failure, then 3 behaviour failures); 7 mutants, each killed (one survivor — the count reset after a
+  restart — found and pinned).
+
+## v0.170.0 (2026-10-29) — „Reboot guest" from the hub (D65 = A): `reboot_guest` joins the agent's closed list — RELEASED (release-agent.sh from a clean clone of `ca15a31`; agent sha256 da8d12a05ef607c338b9ba307e7a81b18253a3188721bbd8421ba36658a22404, config bundle 03f2ff6442fc3ca600b1f25f26767ce4da466a770a258f3e362cf95f6e76b543; signed agent_config_update + agent_update on Tester 1, demo-hp, demo-felhom; vouched by the operator 2026-10-29 18:57:48 CET; `pinned.day0_agent` = 0.170.0)
+
+- **D65 = A (operator ruling 2026-10-29 15:50; felhom.eu `04` §6.1, `03`).** The agent's closed operator-action list is
+  now `restart_controller` and `reboot_guest` (arg: the vmid). No signature: a reboot destroys nothing. The act is the
+  existing guest-reboot path (`pct reboot <vmid>` of THAT guest over the existing exact grant) — never the host.
+- **Guards** (each refuses with the reason; nothing is called, no record is written): a guest this agent did not
+  provision, not running, locked, or parked; the host-wide heavy-operation gate held (a backup of any tier the agent
+  runs, a restore test, an OS step — the reboot HOLDS the gate until the guest is up again); `jobBlocker` (an agent
+  backup job, a controller swap, a drive or NAS job, an escrow ceremony, a vzdump of the guest); the CONTROLLER busy —
+  its `data/ctl/busy` file (a backup, a restore, an off-site run, an app update), fresh within 90 s; a stale file is a
+  controller that stopped writing, not a busy one; any read failure but „no such file" refuses (fail closed); at most
+  ONE reboot per hour per guest (`<guests>/<vmid>/operator-reboot.json`, on disk — it survives an agent restart); the
+  operator restart's brake (a refusal in force refuses a reboot; a reboot counts as one of the 3 restarts in 15 minutes).
+- **During the reboot** the guest-power watchdog and the controller supervisor leave the guest alone (`rebootInFlight`):
+  a racing start would fail the reboot's own start half.
+- **The result** says both times from the press: „rebooted; the guest was up after 41 s, the controller answered after
+  63 s" — or `failed`, said plainly. The record is written BEFORE the reboot; the new self-scoped
+  `GET /guest/operator-reboot` gives it to the controller for one day, for the household's line „Felhom support
+  restarted your box at <time>".
+- **One new sudo vector** (configs/ changed → the signed config bundle): `pct exec <vmid> -- cat
+  /var/lib/docker/volumes/felhom-controller-data/_data/data/ctl/busy` — read-only, one fixed path, in
+  `FELHOM_CONTROLLERSWAP`; capability `controller-busy-read` (not critical: without it, every reboot press is refused).
+- Tests `TestOpReboot_*` (the times + the record + the gate given back; 13 guard cases; a stale busy file; once per hour
+  across an agent restart; the brake counting a reboot; a failed reboot; the watchdogs leaving the guest alone; the
+  notice expiring after a day) and `TestOpActions_AgentClosedList` — each seen failing by a mutation (19 mutants).
+
+## v0.169.0 (2026-10-29) — „Restart controller" from the hub (the agent's own closed list); the unresponsive controller ALARM (R-1344) — RELEASED (release-agent.sh from a clean clone of `637c92c`; agent sha256 fc066de640007038ecfaed6a23e4301a27fc486f1d7851c36177acdd26c2df61, bundle 3ca33f9cbab3bdd4c1b7f8ac90aa21e43b64209f1cb45c77ac72b3405956041b; binary-only signed updates committed on demo-felhom, Tester 1, demo-hp) — **VOUCHED by the operator 2026-10-29 14:06:09 CET**; Day-0 pin set (D50). Live on Tester 1: four presses (one with the controller stopped, the fourth refused by the brake)
+
+- **Operator actions for the agent (operator brief 2026-10-29, Part 1; felhom.eu `04` §6.1).** The host-report reply may
+  carry `operator_actions: [{id, action, arg}]` (`hub.ControlEnvelope.OperatorActions`); the agent acts ONCE per id and
+  answers on the next report, `operator_action_results: [{id, outcome, message}]` (`hub.HostReport`), which it requests
+  at once through the cap-1 report trigger. CLOSED list: `restart_controller <vmid>` only — anything else refused, nothing
+  called. The act is the supervisor's (`systemctl restart felhom-controller-bootstrap.service` in the guest, existing
+  grants — no sudoers change, no config bundle) with its guards: provisioned guest, guest running, the guest list and the
+  vzdump state readable, not parked, no swap, not locked, no vzdump. The thrash brake counts operator restarts with the
+  supervisor's: 3 in 15 minutes → the press is refused, and presses stay refused for 30 minutes. The result says how long
+  the controller took to answer (Docker's health check: healthy), or `failed` when it did not within 3 minutes. One
+  `audit: operator action` line per decision. Works with the controller stopped. Tests `TestOpActions_*` (closed list,
+  unknown/bad arg refused, restart + answer time + report trigger + once per id + re-send until dropped, stopped
+  controller, every guard, the brake across supervisor and operator restarts, no healthy answer = failed) and
+  `TestMainWiresTheAgentOperatorActions` (AST) — each seen failing by a mutation.
+- **R-1344 — a controller that RUNS but does not answer: ALARM ONLY.** Each sweep also reads Docker's health status for a
+  running controller (the swap's `docker inspect -f` grant); 6 consecutive „unhealthy" sweeps (3 minutes, on top of
+  Docker's own ~90 s) start an episode: one ERROR line, the stanza's `unresponsive` / `unresponsive_since` (the hub raises
+  `controller_unresponsive`, operator-only). NOT restarted for it: the brief allows the restart only after a measurement
+  shows a busy night never reads like this, and that measurement runs through tonight (felhom.eu R-1344). Not counted
+  during a swap, a parked or locked guest, or a vzdump; healthy / starting / no health check / an unreadable status reset
+  the count. Tests `TestSupervisor_Unresponsive*` (red by mutation: the vzdump guard, the threshold).
+
+## v0.168.0 (2026-10-29) — R-528: the host's per-container OOM counter (`GET /guest/oom-kills`); R-1254: a lost or late escrow answer is asked again before it is worded — RELEASED (release-agent.sh from a clean clone of `91bd96c`; agent sha256 1e70196c51346cf10e3f04f51975de5899b5dc6baa5a45ec1d17bc248830d2ca, bundle 3415c034955d46c59ca3f7b284a648abf852b1257b77cc49bd6ea9994a7b8cb8; no configs/ change since v0.167.0 → binary-only signed updates to demo-felhom, Tester 1, demo-hp) — **VOUCHED by the operator 2026-10-29 10:21:56 CET**; Day-0 pin set (D50)
+
+### R-528
 
 - **Why:** inside a Felhom LXC guest Docker can leave `State.OOMKilled` false and send no `oom` event after a
   memory-limit kill (measured 2026-09-15 on 9202 and 2026-09-16 on a fresh install), so the controller's OOM line
@@ -11,7 +152,7 @@
   count is per container run. Tests `TestR528_*` (a fake cgroup tree; red-proved: a glob over every guest leaks another
   guest's container; parsing `oom` instead of `oom_kill` reads the wrong number).
 
-## Unreleased (2026-10-28 night) — R-1254 (the ceremony half, review round 2 HUNT-3 H2): the agent asks the hub which package it holds before it words a failed upload — commit only; the next agent release (needs the operator's vouch)
+### R-1254 (the ceremony half, review round 2 HUNT-3 H2)
 
 - **The defect:** the claim's (R-978) and the confirm's (R-1151) package upload can lose its answer, or answer late
   (30 s), AFTER the hub stored the new package. The agent then answered 502 „the previous code still works" — false: the

CONTEXT.md

@@ -1,5 +1,44 @@
 # CONTEXT — felhom-agent working state
 
+> **2026-11-10 (afternoon, attended) — v0.173.0 RELEASED and VOUCHED (16:29:16 CET); on the three test boxes.** sha `752b2727…`, bundle `51ebc1f4…` (`configs/` unchanged since 0.172.1, so no bundle job). Measured: a box cleans its self-update folder at the commit of the update that BRINGS the code (49 → 1, 48 → 1, 33 → 1 entries; about 16 MB stays). The line below („at the first good update AFTER that release") was wrong. A rollback after the clean-up was proven on Tester 1 with a signed update to 0.172.1 and one crash in the dwell. `pinned.day0_agent` = 0.173.0. Open: the `.bak-*` files (R-1368 part 4).
+
+> **2026-11-10 (day, operator brief) — COMMITTED, NOT RELEASED: the self-update folder cleans itself (R-1368 part 2).** After a healthy `commit` the agent removes every staged binary but the running version's (`internal/selfupdate/prune.go`; tests `TestPrune_*`, the wrapper's real `rollback` verb run in a sandbox). No version bump, no build, no vouch: it rides the next agent release. A box cleans its folder at the first good update AFTER that release. Not reached: `/usr/local/bin/felhom-agent.bak-*` (root-owned, R-1368 part 4). The old-kernel clean-up is a design only (felhom.eu `11-os-updates.md` §5.11.1, proven by hand on demo-hp); nothing of it is in this repo.
+
+> **2026-11-07 (attended) — v0.172.1 RELEASED and VOUCHED; on the three test boxes (agent + bundle, 77/77).** `proxmox-grub` joins `HOST_SLOW_RE` (the N100's ring-0 pve step was refused R6 three nights: proxmox-grub pmx4 pulls grub-efi-amd64). sha `505a0594…`, bundle `3e7acaee…` (only `felhom-os-apply` changed vs 0.170.0, no step bundle). Done: vouch, both signed jobs on the three boxes, `pinned.day0_agent` = 0.172.1. Next: the N100's pve step on its next night (positive line: `os-apply: DONE` for `layer=pve:9201`, no R6).
+
+> **2026-11-03 (day, attended) — v0.172.0 RELEASED and VOUCHED (10:18:10 CET), R-1302.** `2c0222cd…`, bundle `cc34b0bc…`, `pinned.day0_agent` = 0.172.0; on the three test boxes by signed `agent_update`. The appliance path pre-positions the grant, so a plain first start logs neither line; staged live both ways (felhom.eu `audits/release-2026-11-03/part3/`).
+>
+> **2026-10-30 (day, attended) — v0.171.0 RELEASED and VOUCHED (10:47:36 CET): R-1344 decided — a controller that runs
+> but does not answer is RESTARTED.** The night's measurement (4 733 probes, slowest 303 ms, no failure) licensed it:
+> alarm at `controllerUnresponsiveConfirm` = 6 unhealthy sweeps, restart at `controllerUnresponsiveRestart` = 10 —
+> refused by a fresh/unreadable busy file (`controllerBusy`, shared with D65's reboot) or the brake
+> (`supervisorBrakeAllows`, now shared with the not-running restart; `recordSupervisorRestart` records both). The stanza
+> carries `unresponsive_restart_after_s` and `unresponsive_restart_at` (hub 0.178.0 mails
+> `controller_unresponsive_restart`). Built from `bd18347` (`c888ca7b…`, bundle `95f977f6…`), binary-only signed
+> updates on the three test boxes; live on Tester 1 (SIGSTOP → alarm 4.5 min → restart 6.5 min → healthy).
+> `pinned.day0_agent` = 0.171.0. felhom.eu `REPORT-release-2026-10-30.md`.
+
+> **2026-10-29 (evening, attended) — v0.170.0 RELEASED and VOUCHED (18:57:48 CET): `reboot_guest` (D65 = A).**
+> `da8d12a0…`, bundle `03f2ff64…`, tag `v0.170.0`, from a clean clone of `ca15a31`; configs/ changed (one new read-only
+> sudo vector: `cat` of the controller's `data/ctl/busy`), so per box a signed `agent_config_update` + `agent_update`
+> (Tester 1, demo-hp, demo-felhom; capability probe 76/76). The agent's closed list is `restart_controller` +
+> `reboot_guest` (`opreboot.go`; guards in felhom.eu `03`/`04` §6.1). Proven on Tester 1: refused during an off-site run
+> (the controller's busy file), done in 67 s / 79 s, refused a second time inside the hour. `pinned.day0_agent` = 0.170.0.
+> **R-1344 decided 2026-10-30: RESTART** (see the 2026-10-30 entry above).
+
+> **2026-10-29 (afternoon, attended) — v0.169.0 RELEASED and VOUCHED (14:06:09 CET).** `fc066de6…`, bundle `3ca33f9c…`,
+> from `637c92c`; `pinned.day0_agent` 0.169.0 (`db25eb0`). The agent's own closed operator-action list:
+> `restart_controller <vmid>` (host-report reply → result on the next host report; the supervisor's guards; the brake
+> counts operator restarts, then `opBrakeUntil` refuses presses 30 min). R-1344: 6 unhealthy sweeps → `unresponsive_since`
+> → the hub's `controller_unresponsive` — ALARM ONLY until the night's health log is read (to 2026-10-30 07:00 UTC).
+> Proven live on Tester 1: stopped controller restarted, 4th press refused, one press on the release builds „done" in 16 s.
+
+> **2026-10-29 (attended release run) — v0.168.0 RELEASED and VOUCHED (10:21:56 CET).** `release-agent.sh` from a clean
+> clone of `91bd96c` (agent `1e70196c…`, bundle `3415c034…`, tag `v0.168.0`); no configs/ change → binary-only signed
+> `agent_update` to demo-hp, Tester 1, demo-felhom, each committed, self-check 76/76; `pinned.day0_agent` = 0.168.0 (D50).
+> R-528 proven on the release (Tester 1: one `app_oom` „seen by docker,cgroup", host counter 1). R-1254: the happy path ran
+> live (a ceremony on 0.168.0 + controller 0.347.0); the lost-answer branch has tests only.
+
 > **2026-10-28 night (unattended) — R-528 + R-1254 on `main` (`6f933d6`, `5ddd124`), NOT released (the next agent
 > release, the operator's vouch).** `GET /guest/oom-kills` (`internal/localapi/guest_oom.go`): the host-side `oom_kill`
 > of each Docker container of the token's guest (`Server.cgroupRoot` is the test seam); proven on Tester 1 with a test

REPORT.md

@@ -1,30 +1,56 @@
-# REPORT — two agent fixes on main, NOT released (night 2026-10-28 → 29, unattended)
+# REPORT — v0.173.0 released, vouched and delivered to the three test boxes (2026-11-10, attended)
 
-**Plain words first.** Two changes are on main and tested. Neither is released: an agent release needs the operator's
-vouch, and the night brief allowed no release. Both go on the morning list.
+**Plain words first.** Each agent update left its downloaded file on the box for ever. Version 0.173.0 removes the old
+files after an update that ended well. It is released and it runs on the three test boxes. The folders went from
+49, 48 and 33 files to 1 file each. A rollback still works after the clean-up. The operator vouched it at 16:29 CET.
 
-## What changed
+The full report of the run is in `felhom.eu`: `REPORT-release-space-fixes-2026-11-10.md`.
 
-- **R-528 — the OOM counter (`6f933d6`, CI run id 2473 / #284 green).** New local-API route `GET /guest/oom-kills`. It
-  reads the kernel's `oom_kill` count of each Docker container of the token's own guest, on the host, from
-  `/sys/fs/cgroup/lxc/<vmid>/ns/system.slice/docker-<id>.scope/memory.events` (mode 0444, readable by the non-root
-  agent user). Docker inside an LXC guest does not see these kills (`OOMKilled` stays false). The controller reads the
-  route every 30 s (controller `eed23e7`). Tests `TestR528_*`, red first by mutation (another guest's container served;
-  `oom` parsed for `oom_kill`).
-- **R-1254 — the escrow ceremony half (`5ddd124`, CI run id 2471 / #283 green).** After an escrow upload that fails, the
-  agent asks the hub which package it holds (the identity blob compared): the new one → success; another one → 502 and
-  „the previous code still works"; no answer → 504, which promises nothing. Tests `TestR1254_*`, red first.
+## One claim that was wrong
 
-## Live proof
+The CHANGELOG entry and the report of the morning said: a box cleans its folder at the first good update AFTER the
+release. That was wrong. The commit runs in the new binary. So the box cleans the folder at the commit of the update
+that brings the code. Measured on three boxes; the CHANGELOG entry is corrected.
 
-- R-528, 2026-10-28 23:27 UTC on Tester 1 with a test build of this agent (put back after: 0.167.0, sha256 `28bdd282…`).
-  A Radicale capped at 128 MB, a memory hog inside it killed: the host counter 0 → 1, one `app_oom` „seen by
-  docker,cgroup", one mail to the operator with `"source":"docker,cgroup"`. Evidence: felhom.eu
-  `documentation/audits/night-2026-10-28/r528-oom/`.
-- R-1254: no live proof. It needs a hub answer lost on purpose; that is a hub change, and no hub deploy runs at night.
+## The release
 
-## Next
+| | |
+|---|---|
+| Version | 0.173.0, `scripts/release-agent.sh` from a clean clone of `776025c8` (tag `v0.173.0`) |
+| Agent sha256 | `752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea` |
+| Bundle sha256 | `51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1` |
+| CI | `776025c8`: run 2608, `gates #311`, success (read by commit on the public Actions page) |
+| Delivery | one signed `agent_update` per box. No bundle job: `configs/` did not change since v0.172.1 |
+| Vouch | the operator, 2026-11-10 16:29:16 CET. Read from the hub log: `Artifact manifest set: agent=0.173.0`, bundle sha = the release. `pinned.day0_agent` = 0.173.0 (D50) |
 
-The agent release (the operator's vouch), then `pinned.day0_agent` in `scripts/retention-policy.json` (D50).
-The controller needs no MinAgent change for R-528: an old agent answers 404, and the controller then waits 10 minutes
-before it asks again.
+## The folder `/var/lib/felhom-agent/selfupdate`, before and after
+
+| Box | Before (on 0.172.1) | After the commit of 0.173.0 | Commit (UTC) |
+|---|---|---|---|
+| demo-hp | 49 entries, 722,596 KB | 1 entry, 16,028 KB | 14:59:19, `removed=49` |
+| demo-felhom | 48 entries, 706,968 KB | 1 entry, 16,028 KB | 14:51:50, `removed=48` |
+| Tester 1 | 33 entries, 497,244 KB | 1 entry, 16,028 KB | 15:00:19, `removed=33` |
+
+After each commit: `pending.json` absent, `/usr/local/bin/felhom-agent.prev` = 0.172.1, the unit active, no restart.
+
+## The rollback proof (Tester 1)
+
+1. A signed `agent_update` to 0.172.1 (the vouched version) was uploaded at 15:01:19 UTC. The box took it at its next
+   report, 15:14:31 UTC. The wrapper installed 0.172.1 and wrote the pending marker.
+2. At 15:14:40 UTC, inside the 60-second dwell, one `systemctl kill -s SEGV` hit the agent's main process.
+3. The unit's `OnFailure` ran the wrapper's `rollback`. Journal: `rolled back to previous binary and restarted
+   felhom-agent.service`. 0.173.0 started at 15:14:40 UTC.
+4. Read at 15:15:56 UTC: agent 0.173.0, active, `pending.json` absent, no failed unit. The folder holds 2 files
+   (32,040 KB): the running version's and the failed 0.172.1. The failed file stays by design, until the next good
+   update.
+
+This is the path the repo already has. No second version was released for the proof.
+
+## What stays open
+
+- `/usr/local/bin/felhom-agent.bak-*` (R-1368 part 4): demo-felhom holds 11 such files, demo-hp 1. The agent cannot
+  reach them.
+- After a rollback, `/usr/local/bin/felhom-agent.prev` holds the same version as the running binary. That is how the
+  wrapper works; it is not new.
+
+Evidence: felhom.eu `documentation/audits/release-space-fixes-2026-11-10/agent/`.

REUSE.md

@@ -35,7 +35,7 @@
 | `SudoHostOps.ListCandidateDisks` | internal/storage/candidates.go | `ListCandidateDisks(ctx) ([]CandidateDisk, error)` | enroll-candidate discovery | Fail-safe: omits anything not provably unclaimed |
 | `antiRetargetResolveExpect` (+ `antiRetargetResolve`, `antiRetargetResolveBlank`) | internal/localapi/wipe_reresolve.go | `(durableID, expectDataBearing, resolve, derive, inspect) (device, err)` | pre-mkfs anti-retarget: resolve durable id → re-derive+match → re-inspect | AGENT-001 + audit D3; refuses path-only bindings; wired via `Server.reresolveWipe`/`reresolveBlank` (test-injectable) |
 | `signedjobs.WipeExecutor.Execute` | internal/signedjobs/wipe.go | `Execute(ctx, op, params) error` | operator-signed data-bearing wipe | Durable-id bound; nonce burned by gate BEFORE execute; refuses no-longer-data-bearing targets |
-| `selfupdate.Executor` / `selfupdate.Manager` | internal/selfupdate/{executor,commit}.go | `NewExecutor(Config)` / `NewManager(ManagerConfig)` | operator-signed agent self-update (D1): download+verify-vs-signed-sha → wrapper `apply`; startup dwell → `commit` | sha is the ONLY integrity root; wrapper (`felhom-selfupdate-guarded`) re-verifies as root + does the A/B flip; NEVER rolls back (systemd + wrapper do). `WrapperRunner` seam. Report seam `SelfUpdatePending()` |
+| `selfupdate.Executor` / `selfupdate.Manager` | internal/selfupdate/{executor,commit}.go | `NewExecutor(Config)` / `NewManager(ManagerConfig)` | operator-signed agent self-update (D1): download+verify-vs-signed-sha → wrapper `apply`; startup dwell → `commit` | sha is the ONLY integrity root; wrapper (`felhom-selfupdate-guarded`) re-verifies as root + does the A/B flip; NEVER rolls back (systemd + wrapper do). `WrapperRunner` seam. Report seam `SelfUpdatePending()`. **The staging folder cleans itself** (`prune.go`, R-1368): after a healthy `commit` only the running version's staged binary stays; a new file kept in `<state dir>/selfupdate/` must NOT be named `felhom-agent-<version>` or the prune removes it |
 | `Gate.AuthorizeStorageWipe` | internal/reconcile/gate.go | `AuthorizeStorageWipe(StorageWipeAuthz, *SignedOp) Decision` | tiered wipe authz | user-data ⇒ customer confirm bound to agent's DeviceDurableID; system/backup ⇒ operator signature only, `Confirmed` IGNORED by role |
 | `Gate.Authorize` | internal/reconcile/gate.go | `Authorize(Intent, *SignedOp) Decision` | every destructive intent | role-scoping (`roleAuthorizes`) + op-to-action binding; benign passes unsigned; audits every decision |
 | `storage.DeviceDurableID` / `ResolveDurableDevice` | internal/storage/durable_device.go | `DeviceDurableID(device) (string, error)` | WIPE-binding ids (`byid:`/`byuuid:`) | Single seam for /disks list AND gate (F20-BUG2); `ResolveDurableDevice` refuses bare paths |
@@ -88,7 +88,8 @@
 | `EnsureLeaf` | internal/localapi/cert.go | `EnsureLeaf(certPath, keyPath, host) (cert, fingerprint, generated, err)` | pinned self-signed leaf | `generated=true` invalidates every issued bootstrap pin — log LOUD (B.1) |
 | `Server.RecoverStaleLockedGuests` | internal/localapi/stalelock.go | `RecoverStaleLockedGuests(ctx)` | startup stale vzdump-lock heal (F2-b) | Clears ONLY `backup`/`snapshot-delete`, only when no vzdump in-flight; A1 RESOLVED (v0.62.0): scan is pool-intersected (`ListLXC` ∩ `Client.Pool`), fail-safe skip on pool-read failure |
 | `ControllerSwapper.Swap` + `ValidControllerImage` | internal/localapi/controllerswap.go | `Swap(ctx, vmid, target) *ControllerSwapState` | agent-owned controller image swap + rollback | Strict image regex (repo + 3-part semver); state file written BEFORE swap; no-healthcheck images need `verifyDwell` |
-| `Server.ControllerSupervisorTick` + `ControllerParkedMarker` | internal/localapi/controllersupervisor.go | `ControllerSupervisorTick(ctx)` | R-523: restart a provisioned guest's not-running controller via its bootstrap unit | Two-sweep confirm; honours swapInFlight, the host-side park marker, guest lock + vzdump; 3 restarts/15 min → 30 min pause; record rides the report as `controller_supervisor` (the hub mints the events — the agent has no event channel) |
+| `Server.ControllerSupervisorTick` + `ControllerParkedMarker` | internal/localapi/controllersupervisor.go | `ControllerSupervisorTick(ctx)` | R-523: restart a provisioned guest's not-running controller via its bootstrap unit | Two-sweep confirm; honours swapInFlight, the host-side park marker, guest lock + vzdump; 3 restarts/15 min → 30 min pause (`supervisorBrakeAllows` — every supervisor restart passes it; `recordSupervisorRestart` puts one on the record + R-539's slow counter); R-1344 (2026-10-30): a RUNNING controller whose Docker health reads „unhealthy" is alarmed at 6 sweeps and restarted at 10 (`restartUnresponsive`: the controller's busy file, then the brake); record rides the report as `controller_supervisor` (the hub mints the events — the agent has no event channel) |
+| `Server.OnEnvelope` / `OperatorActionResults` (operator actions) | internal/localapi/opactions.go | `OnEnvelope(ctx, env)`, `OperatorActionResults() []hub.OperatorActionResult` | 2026-10-29: the operator's actions for THIS agent from the host-report reply — a CLOSED list (`restart_controller`, `reboot_guest` since D65 — `TestOpActions_AgentClosedList`), once per id, the result re-sent until the reply stops listing it, the report requested at once (`SetOperatorActionTrigger`). The restart is the supervisor's act with its guards; the 3-in-15-min brake counts operator restarts too (30-min refusal, `opBrakeUntil`). A new verb is an operator decision AND a hub `store.hostOperatorActionNames` entry in the same release |
 | `MemoryOps` + `Server.readMemoryBounds` | internal/localapi/guestmemory.go | `readMemoryBounds(ctx, vmid) (memoryBounds, err)` | guest RAM resize (v0.90.0, R-24): GET/POST /guest/memory | NEW narrow seam (never extend `GuestAPI` — it breaks every fake); the AGENT is the boundary — bounds recomputed FRESH per request (min 2048 / max host_total−2048 / shrink floor max(2048, usage+512)); §8 UNITS TRAP (config `memory`=MB, status/node=bytes); verify maxmem==target after `SetConfig` before claiming success; SetConfig NEVER called on a refusal path |
 
 ### Proxmox client / hub / PBS / provisioning

cmd/felhom-agent/main.go

@@ -521,6 +521,66 @@ type storeGrantRepairer struct {
 	mu       sync.Mutex
 	last     map[string]time.Time // target id → last ATTEMPT (success or failure)
 	repaired map[string]time.Time // target id → last CONFIRMED repair (drives the report latch)
+	// seenPath (R-1302) is the file that remembers which tiers have EVER held the grant: only those can LOSE it. "" = no
+	// memory, so every missing grant reads as a loss — the old, loud behaviour.
+	seenPath string
+}
+
+// everHeld reports whether this tier's grant was ever seen on this box (R-1302). The direction of a doubt is „yes": an
+// unreadable or corrupt file keeps the loss ERROR, so a real loss is never quietened by a broken record.
+func (r *storeGrantRepairer) everHeld(target string) bool {
+	if r == nil || r.seenPath == "" {
+		return true
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	seen, err := readGrantSeen(r.seenPath)
+	return err != nil || seen[target]
+}
+
+// noteHeld records that this tier holds the grant. A write that fails is logged and costs one false „first grant" at most
+// after a restart — the old file, or none, stands.
+func (r *storeGrantRepairer) noteHeld(target string) {
+	if r == nil || r.seenPath == "" {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	seen, err := readGrantSeen(r.seenPath)
+	if err != nil {
+		seen = map[string]bool{} // a corrupt file is replaced by what is true now
+	}
+	if seen[target] {
+		return
+	}
+	seen[target] = true
+	b, _ := json.Marshal(seen)
+	tmp := r.seenPath + ".tmp"
+	if werr := os.WriteFile(tmp, b, 0o600); werr == nil {
+		werr = os.Rename(tmp, r.seenPath)
+		if werr == nil {
+			return
+		}
+		err = werr
+	} else {
+		err = werr
+	}
+	repairLogger(r).Warn("store-grant: could not record that this tier holds its grant (R-1302)", "target", target, "err", err)
+}
+
+func readGrantSeen(path string) (map[string]bool, error) {
+	b, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		return map[string]bool{}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	seen := map[string]bool{}
+	if err := json.Unmarshal(b, &seen); err != nil {
+		return nil, err
+	}
+	return seen, nil
 }
 
 // noteRepaired latches a confirmed repair so it is reported for storeGrantRepairReportWindow.
@@ -631,6 +691,7 @@ func storeGrantStatus(ctx context.Context, px *proxmox.Client, targetID string,
 		// host-report has certainly carried it. Without this latch the repairing probe may be a
 		// log-only one and the hub never learns anything happened (measured live, see the window's
 		// comment).
+		repair.noteHeld(targetID) // R-1302: a tier that holds its grant can lose it from now on
 		return storeGrantHealthyVerdict(targetID, critical, s, repair.recentlyRepaired(targetID, time.Now()))
 	}
 
@@ -679,8 +740,25 @@ func storeGrantStatus(ctx context.Context, px *proxmox.Client, targetID string,
 	// produces exactly one alert pair and the operator learns of it. NOTHING NEW WAS BUILT: no wire
 	// change, no hub change, no new event type. The `Feature` text carries the explanation because
 	// that is the field the hub puts in the operator's e-mail (the Reason does not travel).
+	return storeGrantAfterRepair(targetID, critical, repair, s)
+}
+
+// storeGrantAfterRepair is the verdict once a repair is confirmed (split out for the tests). R-1302: the FIRST grant of a
+// tier that never held one is no loss — on a fresh install the whole-guest tier is armed before its storage exists, so
+// every new box logged „investigate the loss" and a DEGRADED capability at its first start, which teaches the reader to
+// skip the line. That grant logs INFO and reports healthy. A tier seen holding its grant, or one this box cannot tell
+// about, keeps R-190's ERROR and its one degraded cycle. Pinned by TestR1302_*.
+func storeGrantAfterRepair(targetID string, critical bool, repair *storeGrantRepairer, healthy capability.Status) capability.Status {
+	if !repair.everHeld(targetID) {
+		repair.noteHeld(targetID)
+		repairLogger(repair).Info("store-grant: granted — the first grant of this tier, nothing was lost (R-1302)",
+			"target", targetID, "privilege", storeGrantRequiredPriv,
+			"action", "felhom-backup-target-apply grant "+targetID, "confirmed_by", "re-read")
+		healthy.Status, healthy.Reason = capability.StatusOK, ""
+		return healthy
+	}
 	repair.noteRepaired(targetID, time.Now())
-	s = storeGrantRepairedVerdict(targetID, critical)
+	s := storeGrantRepairedVerdict(targetID, critical)
 	repairLogger(repair).Error("store-grant: GRANT WAS MISSING AND HAS BEEN SELF-REPAIRED — investigate the loss (R-190)",
 		"target", targetID, "privilege", storeGrantRequiredPriv,
 		"action", "felhom-backup-target-apply grant "+targetID, "confirmed_by", "re-read")
@@ -853,8 +931,9 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	// The runner is the DIRECT one for the same reason the sudo prober uses it: the wrapper is
 	// invoked through the privileged path, which prepends sudo itself.
 	grantRepairer := &storeGrantRepairer{
-		run: (&proxmox.ExecRunner{Mode: proxmox.RunnerMode(cfg.Privileged.Mode)}).Run,
-		log: logger,
+		run:      (&proxmox.ExecRunner{Mode: proxmox.RunnerMode(cfg.Privileged.Mode)}).Run,
+		log:      logger,
+		seenPath: filepath.Join(agentStateDir(cfg), "store-grant-seen.json"), // R-1302
 	}
 	// R-973: the local-API backup cadence cap's refusals ride the report as a CRITICAL status, so the hub's
 	// operator-only whole_guest_backup_refused event (hub v0.159.0, R-1150) tells the operator. Late-bound like
@@ -1267,6 +1346,17 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 	}
 	localSrv := buildLocalAPIServer(cfg, px, backupStore, heavyOps, observer, driveKnown, hostOps, gate, collector, client, intentRec, guestBindStore, formatJobStore, logRing, escrowCeremonyCfg, logger, &localTokens)
 	if localSrv != nil {
+		// 2026-10-29 (operator brief, Part 1): the operator's actions for THIS agent ride the host report's reply — the
+		// closed list (localapi/opactions.go). The server joins the observer chain; its results ride the next report,
+		// which it requests at once through the same cap-1 trigger the storage watchdog uses.
+		localSrv.SetOperatorActionTrigger(func() {
+			select {
+			case storageTrigger <- struct{}{}:
+			default:
+			}
+		})
+		collector.SetOperatorActionResults(localSrv.OperatorActionResults)
+		loop.SetEnvelopeObserver(hub.MultiObserver(desiredSyncer, jobsRunner, localSrv))
 		backupCapRefusal = localSrv.BackupCapRefusal // R-973
 		internalPlaceExec.SetEnsure(localSrv.EnsureInternalPlace)
 		// R-998 (doc 14): POST /host/poweroff — guest shutdown, then host power-off; guards in hostpoweroff.go.

cmd/felhom-agent/opactions_wiring_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"testing"
+)
+
+// 2026-10-29 (operator brief, Part 1): the agent's operator actions are unit-green in localapi; main.go must also put
+// the server in the report loop's observer chain, give the collector its results and give the server the report
+// trigger — an inert seam otherwise (the „seam built but never wired" class). Asserted from the AST.
+// RED-PROOF: seen failing before the wiring existed (all three false).
+func TestMainWiresTheAgentOperatorActions(t *testing.T) {
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "main.go", nil, 0)
+	if err != nil {
+		t.Fatalf("parse main.go: %v", err)
+	}
+	var observed, results, trigger bool
+	ast.Inspect(f, func(n ast.Node) bool {
+		call, ok := n.(*ast.CallExpr)
+		if !ok {
+			return true
+		}
+		fn, ok := call.Fun.(*ast.SelectorExpr)
+		if !ok {
+			return true
+		}
+		switch fn.Sel.Name {
+		case "MultiObserver":
+			for _, a := range call.Args {
+				if id, ok := a.(*ast.Ident); ok && id.Name == "localSrv" {
+					observed = true
+				}
+			}
+		case "SetOperatorActionResults":
+			if len(call.Args) == 1 {
+				if sel, ok := call.Args[0].(*ast.SelectorExpr); ok && sel.Sel.Name == "OperatorActionResults" {
+					results = true
+				}
+			}
+		case "SetOperatorActionTrigger":
+			trigger = true
+		}
+		return true
+	})
+	if !observed || !results || !trigger {
+		t.Fatalf("operator actions wiring: observer=%v results=%v trigger=%v — all three must be wired in main.go", observed, results, trigger)
+	}
+}

cmd/felhom-agent/storegrant_test.go

@@ -1,11 +1,14 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"go/ast"
 	"io"
 	"log/slog"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -415,3 +418,101 @@ func TestGrantRepair_TransitionSurvivesALaterProbe(t *testing.T) {
 			"be missed entirely", storeGrantRepairReportWindow)
 	}
 }
+
+// ── R-1302 — the first grant of a tier is no loss ──────────────────────────────────────
+//
+// A fresh install arms the whole-guest tier before its storage exists, so its first probe found no grant, repaired it and
+// logged „GRANT WAS MISSING … investigate the loss" with a DEGRADED capability — on every new box (VM 9375, 2026-10-26).
+//
+// RED-PROOF (2026-11-02): seen failing before storeGrantAfterRepair existed (build), and with its first-grant branch removed
+// TestR1302_TheFirstGrantIsNoLoss fails on „a first grant must not report a loss".
+func r1302Repairer(t *testing.T, path string) (*storeGrantRepairer, *bytes.Buffer) {
+	t.Helper()
+	var buf bytes.Buffer
+	return &storeGrantRepairer{run: (&fakeRepairRunner{}).Run, seenPath: path,
+		log: slog.New(slog.NewTextHandler(&buf, nil))}, &buf
+}
+
+func TestR1302_TheFirstGrantIsNoLoss(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "store-grant-seen.json")
+	r, buf := r1302Repairer(t, path)
+	healthy := capability.Status{Name: "pve:store-grant:felhom-pbs", Status: capability.StatusDegraded, Reason: "missing", Critical: true}
+	s := storeGrantAfterRepair("felhom-pbs", true, r, healthy)
+	if s.Status != capability.StatusOK || s.Reason != "" {
+		t.Fatalf("a first grant must not report a loss: status %q reason %q", s.Status, s.Reason)
+	}
+	got := buf.String()
+	if strings.Contains(got, "investigate the loss") || strings.Contains(got, "level=ERROR") {
+		t.Fatalf("a first grant must not log the loss ERROR: %s", got)
+	}
+	if !strings.Contains(got, "level=INFO") || !strings.Contains(got, "granted") || !strings.Contains(got, "felhom-pbs") {
+		t.Fatalf("a first grant says so at INFO: %s", got)
+	}
+	if r.recentlyRepaired("felhom-pbs", time.Now()) {
+		t.Fatal("a first grant must not arm the loss report's latch")
+	}
+}
+
+func TestR1302_AGrantThatExistedAndVanishedKeepsTheError(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "store-grant-seen.json")
+	first, _ := r1302Repairer(t, path)
+	first.noteHeld("felhom-pbs") // a healthy probe, in an earlier run of the agent
+
+	r, buf := r1302Repairer(t, path) // the agent restarted: the memory is the file, not the process
+	s := storeGrantAfterRepair("felhom-pbs", true, r, capability.Status{})
+	if s.Status != capability.StatusDegraded || !strings.Contains(s.Feature, "R-190") {
+		t.Fatalf("a grant that existed and vanished must keep its degraded cycle; got %q / %q", s.Status, s.Feature)
+	}
+	if got := buf.String(); !strings.Contains(got, "level=ERROR") || !strings.Contains(got, "investigate the loss") {
+		t.Fatalf("a grant that existed and vanished must keep its ERROR: %s", got)
+	}
+	if !r.recentlyRepaired("felhom-pbs", time.Now()) {
+		t.Fatal("the loss must arm the report's latch, or the hub may never hear it")
+	}
+}
+
+// After a first grant the tier counts as held: the NEXT disappearance is a loss.
+func TestR1302_AfterTheFirstGrantALossIsALoss(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "store-grant-seen.json")
+	r, _ := r1302Repairer(t, path)
+	storeGrantAfterRepair("felhom-pbs", true, r, capability.Status{})
+	s := storeGrantAfterRepair("felhom-pbs", true, r, capability.Status{})
+	if s.Status != capability.StatusDegraded {
+		t.Fatalf("the second disappearance is a loss; got %q", s.Status)
+	}
+}
+
+// The direction of a doubt: a broken record, a repairer with no record, or no repairer at all keep the loud way.
+func TestR1302_ADoubtKeepsTheError(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "store-grant-seen.json")
+	if err := os.WriteFile(path, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	r, _ := r1302Repairer(t, path)
+	if s := storeGrantAfterRepair("felhom-pbs", true, r, capability.Status{}); s.Status != capability.StatusDegraded {
+		t.Fatalf("a corrupt record must not quieten a loss; got %q", s.Status)
+	}
+	noMemory, _ := r1302Repairer(t, "")
+	if s := storeGrantAfterRepair("felhom-pbs", true, noMemory, capability.Status{}); s.Status != capability.StatusDegraded {
+		t.Fatalf("no record must not quieten a loss; got %q", s.Status)
+	}
+	if s := storeGrantAfterRepair("felhom-pbs", true, nil, capability.Status{}); s.Status != capability.StatusDegraded {
+		t.Fatalf("no repairer must not quieten a loss; got %q", s.Status)
+	}
+}
+
+// The wiring, read from the source: production names the file, and a healthy probe records the tier.
+func TestR1302_TheMemoryIsWired(t *testing.T) {
+	b, err := os.ReadFile("main.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	src := string(b)
+	if !strings.Contains(src, `seenPath: filepath.Join(agentStateDir(cfg), "store-grant-seen.json")`) {
+		t.Fatal("main.go must give the repairer its file, or every first grant reads as a loss")
+	}
+	start := strings.Index(src, "func storeGrantStatus(")
+	if start < 0 || !strings.Contains(src[start:start+3000], "repair.noteHeld(targetID)") {
+		t.Fatal("a healthy probe must record the tier, or a real loss would read as a first grant")
+	}
+}

configs/felhom-agent.sudoers

@@ -139,6 +139,8 @@ Cmnd_Alias FELHOM_INTERMEDIARY = \
 #   docker inspect -f *         — container running/health/image (read-only; `*` spans the -f template
 #                                 + container across spaces, spike-confirmed)
 #   systemctl restart <fixed unit> — re-run the golden's bootstrap (the only state change)
+#   cat <the controller's busy file> — D65 (2026-10-29): before an operator reboot of the guest, is the controller
+#                                 running a backup, a restore, an off-site run or an app update? (read-only, one path)
 #   felhom-priv-apply controller-image <vmid> — WRITE the ref (R-861 (a) A1, `09` §3 decision 165): the ref goes on
 #                                 STDIN to the ROOT wrapper, which requires our registry + repository + an x.y.z tag
 #                                 and writes the guest file itself. The agent's own `tee` grant is GONE: before, a
@@ -149,6 +151,7 @@ Cmnd_Alias FELHOM_CONTROLLERSWAP = \
   /usr/sbin/pct ^exec [0-9]+ -- docker image inspect gitea\.dooplex\.hu/admin/felhom-controller\:[0-9]+\.[0-9]+\.[0-9]+$, \
   /usr/sbin/pct ^exec [0-9]+ -- docker inspect -f .+ (felhom-controller|cloudflared)$, \
   /usr/sbin/pct ^exec [0-9]+ -- systemctl restart felhom-controller-bootstrap\.service$, \
+  /usr/sbin/pct ^exec [0-9]+ -- cat /var/lib/docker/volumes/felhom-controller-data/_data/data/ctl/busy$, \
   /usr/local/sbin/felhom-priv-apply ^controller-image [0-9]+$
 
 # Stale-lock recovery (F2-b, v0.49.0). A host reboot DURING a vzdump backup leaves the guest with a

configs/felhom-os-apply

@@ -97,9 +97,12 @@ OOMCHECK_SETTLE = 2
 # so it belongs with them. Measured 2026-10-09 on demo-hp (Secure Boot on): left in the pve lane, its upgrade pulled
 # shim-signed-common, the whole pve step was refused R6, and the night's kernel step was skipped with it
 # (`audits/kernel-night-2026-10-08/`). Pinned by test_ring0_pending_pve_leaves_the_secure_boot_meta_out.
+# proxmox-grub is GRUB's Proxmox meta-package (it depends on grub-efi-amd64 of the same version); the `grub` above is
+# anchored at the start, so it missed it. Measured 2026-11-05..07 on demo-felhom: its upgrade pulled grub-efi-amd64 and
+# the whole pve step was refused R6 every night. Pinned by test_ring0_pending_pve_leaves_proxmox_grub_out.
 HOST_SLOW_RE = re.compile(r"^(linux-(image|headers|kbuild|modules|base)|proxmox-kernel|proxmox-default-kernel|pve-kernel|"
                           r"pve-firmware|firmware-|grub|shim|systemd-boot|intel-microcode|amd64-microcode|efibootmgr|"
-                          r"proxmox-secure-boot-support)")
+                          r"proxmox-secure-boot-support|proxmox-grub)")
 # restart_needed() leaves out processes whose cgroup line matches (grep basic regex). Host: the LXC guests' own
 # processes (`0::/lxc/<vmid>/...`) -- NOT lxc-start itself, whose cgroup is `0::/lxc.monitor/<vmid>` (measured
 # 2026-10-04 on demo-felhom: the old pattern "lxc" hid lxc-start with 20 deleted maps, so "reboot needed" stayed false

configs/test_felhom_os_apply.py

@@ -1494,6 +1494,24 @@ class PVELane(unittest.TestCase):
         self.assertEqual(sorted(u["name"] for u in rep["upgraded"]), ["pve-manager"])
         self.assertEqual(f.installed["proxmox-secure-boot-support"], "9.0.1")
 
+    # 2026-11-05..07, demo-felhom (EFI): proxmox-grub 2.12-9+pmx2 -> pmx4 depends on grub-efi-amd64 of the same version;
+    # HOST_SLOW_RE's `grub` is anchored at the start, so proxmox-grub fell into the pve plan, the simulation pulled
+    # grub-efi-amd64 and the whole pve step was refused R6 every night. It is a boot-chain package: left out.
+    # RED-PROOF: drop proxmox-grub from HOST_SLOW_RE -> it is in the plan -> this test fails.
+    def test_ring0_pending_pve_leaves_proxmox_grub_out(self):
+        f = pve_fake(ring0=True)
+        f.plan["select"], f.plan["packages"] = "pending-pve", []
+        f.installed.update({"proxmox-grub": "2.12-9+pmx2"})
+        f.pending_sim = [
+            "Inst pve-manager [9.2.2] (9.2.21 Proxmox Debian Repository:stable [amd64])",
+            "Inst proxmox-grub [2.12-9+pmx2] (2.12-9+pmx4 Proxmox Debian Repository:stable [amd64])",
+            "Inst grub-efi-amd64 [2.12-9+pmx2] (2.12-9+pmx4 Proxmox Debian Repository:stable [amd64])",
+        ]
+        rc, rep = run(f)
+        self.assertEqual(rc, 0, rep)
+        self.assertEqual(sorted(u["name"] for u in rep["upgraded"]), ["pve-manager"])
+        self.assertEqual(f.installed["proxmox-grub"], "2.12-9+pmx2")
+
     def test_select_pending_pve_needs_the_pve_layer(self):
         f = Fake()
         f.plan["layer"], f.plan["select"], f.plan["packages"] = "host", "pending-pve", []

internal/capability/manifest.go

@@ -151,6 +151,7 @@ var manifest = []Capability{
 	{"controllerswap-read", "controller-swap / managed auto-update", "/usr/sbin/pct", []string{"exec", "9201", "--", "cat", "/etc/felhom-controller-image"}, true, ""},
 	{"controllerswap-image-inspect", "controller-swap / managed auto-update", "/usr/sbin/pct", []string{"exec", "9201", "--", "docker", "image", "inspect", "gitea.dooplex.hu/admin/felhom-controller:0.0.0"}, true, ""},
 	{"controllerswap-inspect", "controller-swap / managed auto-update", "/usr/sbin/pct", []string{"exec", "9201", "--", "docker", "inspect", "-f", "{{.State.Running}}", "felhom-controller"}, true, ""},
+	{"controller-busy-read", "operator guest reboot (D65)", "/usr/sbin/pct", []string{"exec", "9201", "--", "cat", "/var/lib/docker/volumes/felhom-controller-data/_data/data/ctl/busy"}, false, ""},
 	{"controllerswap-restart", "controller-swap / managed auto-update", "/usr/sbin/pct", []string{"exec", "9201", "--", "systemctl", "restart", "felhom-controller-bootstrap.service"}, true, ""},
 	// R-861 (a) A1 (decision 165): the write goes through the ROOT verb that checks the ref; the agent has no `tee` grant.
 	{"controllerswap-write", "controller-swap / managed auto-update", "/usr/local/sbin/felhom-priv-apply", []string{"controller-image", "9201"}, true, ""},

internal/hub/collect.go

@@ -128,6 +128,7 @@ type Collector struct {
 	wg               WireguardReporter                             // S3: offsite-tunnel status (nil → stanza omitted)
 	pbsdr            PBSDRReporter                                 // slice 2: PBS DR tier bridge state (nil → stanza omitted)
 	ctrlSup          ControllerSupervisorReporter                  // R-523: in-guest controller supervisor (nil → stanza omitted)
+	opResults        func() []OperatorActionResult                 // 2026-10-29: the operator actions' answers (nil → none)
 	guestNet         GuestNetReporter                              // R-54: per-guest network watchdog (nil → stanza omitted)
 	diskTrim         GuestDiskTrimReporter                         // R-444: weekly guest disk trim (nil → stanza omitted)
 	lineTest         LineTestReporter                              // R-1247: weekly upload line test (nil → stanza omitted)
@@ -235,6 +236,12 @@ type ControllerSupervisorReporter interface {
 	ControllerSupervisorStatus(ctx context.Context) *ControllerSupervisorStatus
 }
 
+// SetOperatorActionResults wires the source of the operator actions' answers (2026-10-29; nil → none sent).
+func (c *Collector) SetOperatorActionResults(f func() []OperatorActionResult) *Collector {
+	c.opResults = f
+	return c
+}
+
 // SetControllerSupervisorReporter wires the R-523 controller supervisor as a report source (nil-safe).
 func (c *Collector) SetControllerSupervisorReporter(r ControllerSupervisorReporter) *Collector {
 	c.ctrlSup = r
@@ -432,6 +439,9 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 	if c.ctrlSup != nil {
 		report.ControllerSupervisor = c.ctrlSup.ControllerSupervisorStatus(ctx)
 	}
+	if c.opResults != nil {
+		report.OperatorActionResults = c.opResults()
+	}
 	// R-54: guest-network watchdog state (nil reporter = feature not wired → stanza omitted).
 	if c.guestNet != nil {
 		report.GuestNet = c.guestNet.GuestNetStatus(ctx)

internal/hub/report.go

@@ -172,6 +172,24 @@ type HostReport struct {
 	// byte-stable. The hub parser is pinned by hub/internal/monitor/controller_supervisor_test.go
 	// against the JSON TestControllerSupervisorStanza_WireShape pins here.
 	ControllerSupervisor *ControllerSupervisorStatus `json:"controller_supervisor,omitempty"`
+	// OperatorActionResults (2026-10-29, the operator brief's Part 1): the answers to the operator actions the hub's
+	// replies listed — the controller's shape (`04` §6.1). Re-sent until the reply stops listing the id. omitempty: absent
+	// when there is nothing to answer, so the golden stays byte-stable.
+	OperatorActionResults []OperatorActionResult `json:"operator_action_results,omitempty"`
+}
+
+// OperatorAction is ONE entry of the reply's operator_actions (hub store.OperatorActionDirective, field-exact).
+type OperatorAction struct {
+	ID     int64  `json:"id"`
+	Action string `json:"action"`
+	Arg    string `json:"arg,omitempty"`
+}
+
+// OperatorActionResult is one answer (hub api.hostOperatorActionResult, field-exact): outcome done | refused | failed.
+type OperatorActionResult struct {
+	ID      int64  `json:"id"`
+	Outcome string `json:"outcome"`
+	Message string `json:"message"`
 }
 
 // ControllerSupervisorStatus is the R-523 stanza. Carries no secret.
@@ -195,6 +213,17 @@ type ControllerSupervisorGuest struct {
 	Restarts24h        int    `json:"restarts_24h"`
 	SlowCrashloop      bool   `json:"slow_crashloop"`
 	SlowCrashloopSince string `json:"slow_crashloop_since,omitempty"` // RFC3339
+	// R-1344 (2026-10-29) — the controller RUNS but Docker's health check has read „unhealthy" on several consecutive
+	// sweeps. ALARM ONLY: the agent does not restart it for this (the measurement must first show a busy night never
+	// looks like it). UnresponsiveSince is the episode's start; the hub keys on it MOVING (controller_unresponsive).
+	Unresponsive      bool   `json:"unresponsive"`
+	UnresponsiveSince string `json:"unresponsive_since,omitempty"` // RFC3339
+	// R-1344 restart (decided 2026-10-30 from the night's measurement): UnresponsiveRestartAfterS is how long after the
+	// alarm the agent restarts a controller that still does not answer (0 / absent = an older agent: alarm only — the
+	// hub's message says which). UnresponsiveRestartAt is the last such restart; the hub keys on it MOVING
+	// (controller_unresponsive_restart) and it equals LastRestartAt for that act.
+	UnresponsiveRestartAfterS int    `json:"unresponsive_restart_after_s,omitempty"`
+	UnresponsiveRestartAt     string `json:"unresponsive_restart_at,omitempty"` // RFC3339
 }
 
 // PBSDRStatus is the per-heartbeat PBS-DR-tier bridge state (slice 2). States:
@@ -631,6 +660,9 @@ type ControlEnvelope struct {
 	// NEXT heartbeat carries it in log_tail (the report-channel log_tail_requests mirror).
 	// Absent/false on an old hub → nothing happens.
 	LogTailRequested bool `json:"log_tail_requested"`
+	// OperatorActions (2026-10-29): the operator's pending actions for THIS host's agent — a CLOSED list on both sides
+	// (`04` §6.1). Absent on an older hub.
+	OperatorActions []OperatorAction `json:"operator_actions,omitempty"`
 }
 
 // LogTail is the heartbeat's on-demand agent log tail (see HostReport.LogTail).

internal/localapi/controllersupervisor.go

@@ -3,6 +3,7 @@ package localapi
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
@@ -83,6 +84,20 @@ const (
 	// controllerSlowCounterFile holds the 24-hour restart times and the last raise, per guest, beside
 	// the parked marker.
 	controllerSlowCounterFile = "controller-restarts-24h.json"
+
+	// R-1344 (operator brief 2026-10-29, Part 2) — a controller that RUNS but does not answer. Docker's own HEALTHCHECK
+	// (`curl -f localhost:8080/api/health`, every 30 s, timeout 5 s) reads „unhealthy" only after 3 failed probes (~90 s);
+	// controllerUnresponsiveConfirm more sweeps (3 minutes) make it an episode: logged, carried by the stanza, mailed by
+	// the hub (controller_unresponsive). Not counted during a swap, a parked guest, a locked guest or a vzdump.
+	controllerUnresponsiveConfirm = 6
+	// controllerUnresponsiveRestart (decided 2026-10-30 from the measurement): at this many consecutive unhealthy sweeps
+	// (5 minutes after Docker's „unhealthy", ~6.5 minutes after the first failed probe; 2 minutes after the alarm) the
+	// agent restarts the controller — the not-running restart's guards and brake, plus the controller's busy file. The
+	// numbers: Tester 1 and demo-hp, 2026-10-29 11:12 → 2026-10-30 07:00 UTC, 4 733 probes through the night chain (a
+	// PBS and a local vzdump, the DB dumps, tier-2, the off-site push, a restore test, two controller updates): no failed
+	// probe, slowest 303 ms against the 5 s timeout. A busy night never came near even ONE failed probe; ten sweeps is
+	// the margin. Pinned by TestSupervisor_UnresponsiveIsAlarmedThenRestarted.
+	controllerUnresponsiveRestart = 10
 )
 
 // controllerSupState is one guest's supervisor record. In-memory on purpose (the guest-power
@@ -103,6 +118,18 @@ type controllerSupState struct {
 	// on the other hand, would hide exactly the box it exists for (one whose agent restarts too).
 	restarts24h        []time.Time
 	slowCrashloopSince time.Time // the last raise; kept after it ages out, the hub keys on it MOVING
+
+	// opBrakeUntil (2026-10-29): an operator restart refused by the brake refuses every press until then (30 min).
+	opBrakeUntil time.Time
+
+	// R-1344: consecutive running-but-unhealthy sweeps, and the current episode (since kept after it ends).
+	unhealthySeen     int
+	unresponsive      bool
+	unresponsiveSince time.Time
+	// unresponsiveRestartAt: the last restart for not answering (kept; the hub keys on it MOVING). unrespRefusal: the
+	// last reason the restart was refused, so a refusal is logged once per change, not every sweep.
+	unresponsiveRestartAt time.Time
+	unrespRefusal         string
 }
 
 type controllerSupervisor struct {
@@ -238,6 +265,10 @@ func (s *Server) ControllerSupervisorTick(ctx context.Context) {
 		if !s.provisionedGuest(g.VMID) {
 			continue
 		}
+		if s.rebooting(g.VMID) { // D65: the operator's reboot owns the guest until it is up again
+			s.resetNotRunning(g.VMID)
+			continue
+		}
 		evaluated++
 		if !s.superviseOneController(ctx, g.VMID, g.Status) {
 			down++
@@ -293,6 +324,7 @@ func (s *Server) superviseOneController(ctx context.Context, vmid int, guestStat
 	if running {
 		st.notRunningSeen = 0
 		s.ctrlSup.mu.Unlock()
+		s.observeControllerHealth(ctx, vmid, parked)
 		return true
 	}
 	st.notRunningSeen++
@@ -333,9 +365,27 @@ func (s *Server) superviseOneController(ctx context.Context, vmid int, guestStat
 		return false
 	}
 
-	// Backoff.
+	if !s.supervisorBrakeAllows(vmid, now) {
+		return false
+	}
+
+	reason := "controller container " + status + " on " + strconv.Itoa(controllerSupervisorConfirm) + " consecutive sweeps"
+	s.logger.Warn("controller-supervisor: controller is NOT running — restarting the bootstrap unit",
+		"vmid", vmid, "status", status, "unit", bootstrapUnit)
+	if _, err := s.guestExec.GuestExec(ctx, vmid, "systemctl", "restart", bootstrapUnit); err != nil {
+		s.logger.Error("controller-supervisor: bootstrap restart failed", "vmid", vmid, "err", err)
+		reason += "; restart FAILED: " + err.Error()
+	}
+	s.recordSupervisorRestart(vmid, now, reason, nil)
+	return false
+}
+
+// supervisorBrakeAllows is the brake every supervisor restart passes (the not-running one and R-1344's): a crash-loop
+// pause in force refuses; controllerCrashloopMax restarts inside controllerCrashloopWindow start one (logged, carried by
+// the stanza, mailed by the hub as controller_crashloop) and refuse.
+func (s *Server) supervisorBrakeAllows(vmid int, now time.Time) bool {
 	s.ctrlSup.mu.Lock()
-	st = s.supState(vmid)
+	st := s.supState(vmid)
 	if !st.crashloopSince.IsZero() {
 		if now.Sub(st.crashloopSince) < controllerCrashloopPause {
 			s.ctrlSup.mu.Unlock()
@@ -358,22 +408,23 @@ func (s *Server) superviseOneController(ctx context.Context, vmid int, guestStat
 		return false
 	}
 	s.ctrlSup.mu.Unlock()
+	return true
+}
 
-	reason := "controller container " + status + " on " + strconv.Itoa(controllerSupervisorConfirm) + " consecutive sweeps"
-	s.logger.Warn("controller-supervisor: controller is NOT running — restarting the bootstrap unit",
-		"vmid", vmid, "status", status, "unit", bootstrapUnit)
-	if _, err := s.guestExec.GuestExec(ctx, vmid, "systemctl", "restart", bootstrapUnit); err != nil {
-		s.logger.Error("controller-supervisor: bootstrap restart failed", "vmid", vmid, "err", err)
-		reason += "; restart FAILED: " + err.Error()
-	}
+// recordSupervisorRestart puts a restart the supervisor performed on the record: the brake's window, the totals, the
+// reason, and R-539's slow counter (persisted; raised at most once per 24 hours — the hub mails on the raise MOVING).
+// mark, when set, runs under the same lock (R-1344 stamps its own record there).
+func (s *Server) recordSupervisorRestart(vmid int, now time.Time, reason string, mark func(st *controllerSupState)) {
 	s.ctrlSup.mu.Lock()
-	st = s.supState(vmid)
+	st := s.supState(vmid)
 	st.restarts = append(st.restarts, now)
 	st.restartsTotal++
 	st.lastRestartAt = now
 	st.lastReason = reason
 	st.notRunningSeen = 0
-	// R-539: the slow counter. Raise at most once per 24 hours — the hub mails on the raise MOVING.
+	if mark != nil {
+		mark(st)
+	}
 	st.restarts24h = append(pruneBefore(st.restarts24h, now.Add(-controllerSlowCrashloopWindow)), now)
 	n24 := len(st.restarts24h)
 	raised := false
@@ -389,7 +440,101 @@ func (s *Server) superviseOneController(ctx context.Context, vmid int, guestStat
 		s.logger.Warn("controller-supervisor: SLOW CRASH-LOOP — the controller keeps dying; still restarting it, raising controller_slow_crashloop",
 			"vmid", vmid, "restarts_24h", n24, "window", controllerSlowCrashloopWindow.String(), "threshold", controllerSlowCrashloopMax)
 	}
-	return false
+}
+
+// observeControllerHealth is R-1344's count for a RUNNING controller: Docker's health status, one read per sweep over
+// the swap's `docker inspect -f` grant. Anything but „unhealthy" — healthy, starting, no health check, a read that
+// fails — resets the count; so do a swap, a parked guest, a locked guest and a vzdump (each is someone else's moment).
+func (s *Server) observeControllerHealth(ctx context.Context, vmid int, parked bool) {
+	s.swapMu.Lock()
+	swapping := s.swapInFlight[vmid]
+	s.swapMu.Unlock()
+	unhealthy := false
+	if !parked && !swapping {
+		if out, err := s.guestExec.GuestExec(ctx, vmid, "docker", "inspect", "-f", opHealthTemplate, controllerContainer); err == nil {
+			f := strings.SplitN(strings.TrimSpace(out), "|", 2)
+			unhealthy = len(f) == 2 && f[0] == "true" && f[1] == "unhealthy"
+		}
+	}
+	if unhealthy {
+		if lock, _, err := s.staleLock.Lock(ctx, vmid); err != nil || lock != "" {
+			unhealthy = false
+		} else if busy, berr := s.staleLock.BackupRunning(ctx, vmid); berr != nil || busy {
+			unhealthy = false
+		}
+	}
+	now := s.clock()
+	s.ctrlSup.mu.Lock()
+	st := s.supState(vmid)
+	if !unhealthy {
+		was := st.unresponsive
+		st.unhealthySeen, st.unresponsive = 0, false
+		s.ctrlSup.mu.Unlock()
+		if was {
+			s.logger.Info("controller-supervisor: the controller answers its health check again", "vmid", vmid)
+		}
+		return
+	}
+	st.unhealthySeen++
+	seen := st.unhealthySeen
+	start := seen >= controllerUnresponsiveConfirm && !st.unresponsive
+	if start {
+		st.unresponsive, st.unresponsiveSince = true, now
+	}
+	since := st.unresponsiveSince
+	s.ctrlSup.mu.Unlock()
+	if start {
+		s.logger.Error("controller-supervisor: the controller RUNS but does not answer its health check — raising controller_unresponsive; restarting it if it stays so",
+			"vmid", vmid, "unhealthy_sweeps", seen, "interval", controllerSupervisorInterval.String(),
+			"restart_after_sweeps", controllerUnresponsiveRestart)
+	}
+	if seen >= controllerUnresponsiveRestart {
+		s.restartUnresponsive(ctx, vmid, seen, since, now)
+	}
+}
+
+// restartUnresponsive is R-1344's restart (decided 2026-10-30): the controller's busy file (fresh = a backup, a
+// restore, an update or an export is running; unreadable = cannot be ruled out) refuses, then the brake every
+// supervisor restart passes. The swap, the parked marker, the lock and the vzdump never reach here — they reset the
+// count. A refusal keeps the alarm and is logged once per reason; the next sweep asks again.
+func (s *Server) restartUnresponsive(ctx context.Context, vmid, seen int, since, now time.Time) {
+	refuse := func(why string) {
+		s.ctrlSup.mu.Lock()
+		st := s.supState(vmid)
+		changed := st.unrespRefusal != why
+		st.unrespRefusal = why
+		s.ctrlSup.mu.Unlock()
+		if changed {
+			s.logger.Warn("controller-supervisor: the controller does not answer, but the restart is refused — the alarm stays",
+				"vmid", vmid, "why", why, "unhealthy_sweeps", seen)
+		}
+	}
+	busy, what, err := s.controllerBusy(ctx, vmid)
+	if err != nil {
+		refuse("the controller's busy file cannot be read: " + err.Error())
+		return
+	}
+	if busy {
+		refuse("the controller is busy: " + what)
+		return
+	}
+	if !s.supervisorBrakeAllows(vmid, now) {
+		refuse("the restart brake")
+		return
+	}
+	reason := fmt.Sprintf("the controller ran but did not answer its health check for %d sweeps (since %s)",
+		seen, since.UTC().Format(time.RFC3339))
+	s.logger.Warn("controller-supervisor: the controller does not answer — restarting the bootstrap unit",
+		"vmid", vmid, "unhealthy_sweeps", seen, "since", since.UTC().Format(time.RFC3339), "unit", bootstrapUnit)
+	if _, err := s.guestExec.GuestExec(ctx, vmid, "systemctl", "restart", bootstrapUnit); err != nil {
+		s.logger.Error("controller-supervisor: bootstrap restart failed", "vmid", vmid, "err", err)
+		reason += "; restart FAILED: " + err.Error()
+	}
+	s.recordSupervisorRestart(vmid, now, reason, func(st *controllerSupState) {
+		st.unresponsiveRestartAt = now
+		st.unhealthySeen = 0
+		st.unrespRefusal = ""
+	})
 }
 
 func (s *Server) resetNotRunning(vmid int) {
@@ -446,6 +591,14 @@ func (s *Server) ControllerSupervisorStatus(_ context.Context) *hub.ControllerSu
 			g.SlowCrashloopSince = st.slowCrashloopSince.UTC().Format(time.RFC3339)
 			g.SlowCrashloop = now.Sub(st.slowCrashloopSince) < controllerSlowCrashloopWindow
 		}
+		g.Unresponsive = st.unresponsive
+		if !st.unresponsiveSince.IsZero() {
+			g.UnresponsiveSince = st.unresponsiveSince.UTC().Format(time.RFC3339)
+		}
+		g.UnresponsiveRestartAfterS = (controllerUnresponsiveRestart - controllerUnresponsiveConfirm) * int(controllerSupervisorInterval/time.Second)
+		if !st.unresponsiveRestartAt.IsZero() {
+			g.UnresponsiveRestartAt = st.unresponsiveRestartAt.UTC().Format(time.RFC3339)
+		}
 		out.Guests = append(out.Guests, g)
 	}
 	sort.Slice(out.Guests, func(i, j int) bool { return out.Guests[i].VMID < out.Guests[j].VMID })

internal/localapi/guestpower.go

@@ -152,6 +152,11 @@ func (s *Server) recoverOneStoppedGuest(ctx context.Context, g proxmox.Guest) {
 		s.forgetGuestPower(g.VMID) // healthy again: clear any attempt history
 		return
 	}
+	// D65: a guest the operator's reboot has down for a moment is pct reboot's to start, not ours (a racing start
+	// would fail the reboot's own start half).
+	if s.rebooting(g.VMID) {
+		return
+	}
 
 	lock, onboot, err := s.staleLock.Lock(ctx, g.VMID)
 	if err != nil {

internal/localapi/opactions.go

@@ -0,0 +1,258 @@
+package localapi
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+)
+
+// The operator's actions for THIS agent (operator brief 2026-10-29, Part 1; felhom.eu `04` §6.1).
+//
+// THE DOOR IS THE HOST REPORT'S REPLY, the controller's shape: the operator presses a button on the hub's host page, the
+// hub stores a row and pokes the box (the poke's out-of-cycle report gets the reply in seconds; without the tunnel the
+// 15-minute cycle carries it), the reply lists `operator_actions: [{id, action, arg}]`, this agent acts ONCE per id, and
+// the next report answers `operator_action_results: [{id, outcome, message}]` — the agent asks for that report at once.
+// The result is re-sent until the reply stops listing the id.
+//
+// THE LIST IS CLOSED: two verbs, restart_controller <vmid> and (D65 = A, 2026-10-29) reboot_guest <vmid> (opreboot.go). Anything else — a verb, a vmid that does not parse, a guest
+// this agent did not provision — is refused and NOTHING is called. Pinned by TestOpActions_AgentClosedList.
+//
+// THE ACT is the supervisor's own (controllersupervisor.go): `systemctl restart felhom-controller-bootstrap.service` in
+// the guest over the existing grants, with the supervisor's guards — not during a controller swap, not parked, not on a
+// stopped, locked or vzdump-busy guest, not when the guest list or the vzdump state cannot be read — and the thrash brake
+// counts these restarts too: 3 restarts (the supervisor's or the operator's) inside 15 minutes refuse the press, and
+// presses stay refused for 30 minutes. It works with the controller stopped or stuck: the agent does it, not the
+// controller. Every decision is one `audit:` line (the customer-visible audit form of reconcile.SlogAudit).
+
+const (
+	// OpRestartController is the agent's first operator verb.
+	OpRestartController = "restart_controller"
+
+	opOutcomeDone    = "done"
+	opOutcomeRefused = "refused"
+	opOutcomeFailed  = "failed"
+
+	// opBrakeRefusal is how long presses stay refused after the brake refused one.
+	opBrakeRefusal = 30 * time.Minute
+	// opForgetAfter drops a started id the reply no longer lists.
+	opForgetAfter = 24 * time.Hour
+
+	defaultOpHealthPoll = 2 * time.Second
+	// defaultOpHealthWait covers the bootstrap's pull-less rm/run (seconds), Docker's start period (10 s) and its first
+	// probe (30 s interval) with room: the controller's own HEALTHCHECK is the answer.
+	defaultOpHealthWait = 3 * time.Minute
+	// opHealthTemplate reads running + health over the swap's `docker inspect -f` grant.
+	opHealthTemplate = "{{.State.Running}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}"
+)
+
+// operatorActionNames is THE agent's closed list. Adding an entry fails TestOpActions_AgentClosedList by design.
+var operatorActionNames = []string{OpRestartController, OpRebootGuest}
+
+// OperatorActionNames returns the closed list (sorted copy).
+func OperatorActionNames() []string {
+	out := append([]string(nil), operatorActionNames...)
+	sort.Strings(out)
+	return out
+}
+
+type opActionState struct {
+	mu      sync.Mutex
+	started map[int64]time.Time
+	results map[int64]hub.OperatorActionResult
+}
+
+// SetOperatorActionTrigger wires the report loop's out-of-band trigger (the result goes at once, not in 15 minutes).
+func (s *Server) SetOperatorActionTrigger(f func()) { s.opTrigger = f }
+
+// OnEnvelope is the report loop's hook (hub.EnvelopeObserver): it starts each newly listed action once and forgets
+// the ids the reply no longer lists (the hub has their results).
+func (s *Server) OnEnvelope(_ context.Context, env *hub.ControlEnvelope) {
+	if env == nil {
+		return
+	}
+	listed := map[int64]bool{}
+	var start []hub.OperatorAction
+	now := time.Now()
+	s.opActs.mu.Lock()
+	if s.opActs.started == nil {
+		s.opActs.started = map[int64]time.Time{}
+		s.opActs.results = map[int64]hub.OperatorActionResult{}
+	}
+	for _, a := range env.OperatorActions {
+		listed[a.ID] = true
+		if _, ok := s.opActs.started[a.ID]; ok {
+			continue
+		}
+		s.opActs.started[a.ID] = now
+		start = append(start, a)
+	}
+	for id, at := range s.opActs.started {
+		if listed[id] {
+			continue
+		}
+		if _, answered := s.opActs.results[id]; answered || now.Sub(at) > opForgetAfter {
+			delete(s.opActs.started, id)
+			delete(s.opActs.results, id)
+		}
+	}
+	s.opActs.mu.Unlock()
+	for _, a := range start {
+		go s.runOperatorAction(a) // a restart waits for the health answer — never block the report loop
+	}
+}
+
+// OperatorActionResults is the report's answer list, oldest id first.
+func (s *Server) OperatorActionResults() []hub.OperatorActionResult {
+	s.opActs.mu.Lock()
+	defer s.opActs.mu.Unlock()
+	out := make([]hub.OperatorActionResult, 0, len(s.opActs.results))
+	for _, r := range s.opActs.results {
+		out = append(out, r)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
+	return out
+}
+
+func (s *Server) runOperatorAction(a hub.OperatorAction) {
+	limit := s.opWait() + time.Minute
+	if a.Action == OpRebootGuest {
+		limit += opRebootTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), limit)
+	defer cancel()
+	outcome, msg := opOutcomeRefused, fmt.Sprintf("unknown action %q — the agent's list holds restart_controller and reboot_guest only", a.Action)
+	switch a.Action {
+	case OpRestartController:
+		outcome, msg = s.operatorRestartController(ctx, a.ID, a.Arg)
+	case OpRebootGuest:
+		outcome, msg = s.operatorRebootGuest(ctx, a.ID, a.Arg)
+	}
+	s.logger.Warn("audit: operator action", "id", a.ID, "action", a.Action, "arg", a.Arg, "by", "the operator via the hub",
+		"outcome", outcome, "message", msg)
+	s.opActs.mu.Lock()
+	if _, still := s.opActs.started[a.ID]; still {
+		s.opActs.results[a.ID] = hub.OperatorActionResult{ID: a.ID, Outcome: outcome, Message: msg}
+	}
+	s.opActs.mu.Unlock()
+	if s.opTrigger != nil {
+		s.opTrigger()
+	}
+}
+
+func (s *Server) opPoll() time.Duration {
+	if s.opHealthPoll > 0 {
+		return s.opHealthPoll
+	}
+	return defaultOpHealthPoll
+}
+
+func (s *Server) opWait() time.Duration {
+	if s.opHealthWait > 0 {
+		return s.opHealthWait
+	}
+	return defaultOpHealthWait
+}
+
+// operatorRestartController is the press: the supervisor's guards, the brake, the restart, then the wait for the
+// controller's healthy answer. Returns the outcome and the sentence the host page shows.
+func (s *Server) operatorRestartController(ctx context.Context, id int64, arg string) (string, string) {
+	vmid, err := strconv.Atoi(arg)
+	if err != nil || strconv.Itoa(vmid) != arg {
+		return opOutcomeRefused, fmt.Sprintf("refused: %q is not a guest id", arg)
+	}
+	if s.staleLock == nil || s.guestExec == nil {
+		return opOutcomeRefused, "refused: the controller supervisor is not wired on this agent"
+	}
+	if !s.provisionedGuest(vmid) {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is not a guest this agent provisioned", vmid)
+	}
+	guests, err := s.staleLock.Guests(ctx)
+	if err != nil {
+		return opOutcomeRefused, "refused: the guest list cannot be read — ownership unproven, nothing touched"
+	}
+	status := ""
+	for _, g := range guests {
+		if g.VMID == vmid {
+			status = g.Status
+		}
+	}
+	if status != "running" {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is not running (%s) — the guest-power watchdog owns it", vmid, orDash(status))
+	}
+	if s.controllerParked(vmid) {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d's controller is parked (remove the controller-parked marker first)", vmid)
+	}
+	s.swapMu.Lock()
+	swapping := s.swapInFlight[vmid]
+	s.swapMu.Unlock()
+	if swapping {
+		return opOutcomeRefused, "refused: a controller swap (update) is in flight — it owns the controller"
+	}
+	if lock, _, err := s.staleLock.Lock(ctx, vmid); err != nil {
+		return opOutcomeRefused, "refused: the guest lock cannot be read — nothing touched"
+	} else if lock != "" {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is locked (%s) — another operation owns it", vmid, lock)
+	}
+	if busy, berr := s.staleLock.BackupRunning(ctx, vmid); berr != nil || busy {
+		return opOutcomeRefused, "refused: a whole-guest backup (vzdump) may be in flight for the guest"
+	}
+
+	// The brake: every restart counts — the supervisor's and the operator's.
+	now := s.clock()
+	s.ctrlSup.mu.Lock()
+	st := s.supState(vmid)
+	if now.Before(st.opBrakeUntil) {
+		until := st.opBrakeUntil
+		s.ctrlSup.mu.Unlock()
+		return opOutcomeRefused, fmt.Sprintf("refused: 3 restarts in 15 minutes — presses are refused until %s UTC", until.UTC().Format("15:04"))
+	}
+	st.restarts = pruneBefore(st.restarts, now.Add(-controllerCrashloopWindow))
+	if len(st.restarts) >= controllerCrashloopMax {
+		st.opBrakeUntil = now.Add(opBrakeRefusal)
+		until := st.opBrakeUntil
+		s.ctrlSup.mu.Unlock()
+		return opOutcomeRefused, fmt.Sprintf("refused: 3 restarts in 15 minutes — presses are refused until %s UTC", until.UTC().Format("15:04"))
+	}
+	reason := fmt.Sprintf("the operator via the hub (action #%d)", id)
+	st.restarts = append(st.restarts, now)
+	st.restartsTotal++
+	st.lastRestartAt = now
+	st.lastReason = reason
+	st.notRunningSeen = 0
+	s.ctrlSup.mu.Unlock()
+
+	s.logger.Warn("controller-supervisor: RESTARTING the controller on the operator's press", "vmid", vmid, "action_id", id, "unit", bootstrapUnit)
+	began := time.Now()
+	if _, err := s.guestExec.GuestExec(ctx, vmid, "systemctl", "restart", bootstrapUnit); err != nil {
+		return opOutcomeFailed, fmt.Sprintf("the restart of guest %d's controller failed: %v", vmid, err)
+	}
+	for time.Since(began) < s.opWait() {
+		out, err := s.guestExec.GuestExec(ctx, vmid, "docker", "inspect", "-f", opHealthTemplate, controllerContainer)
+		if err == nil {
+			f := strings.SplitN(strings.TrimSpace(out), "|", 2)
+			if len(f) == 2 && f[0] == "true" && (f[1] == "healthy" || f[1] == "none") {
+				secs := int(time.Since(began).Round(time.Second) / time.Second)
+				return opOutcomeDone, fmt.Sprintf("restarted; the controller answered after %d s (Docker's health check: healthy)", secs)
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return opOutcomeFailed, "restarted, but the wait for its answer was cut"
+		case <-time.After(s.opPoll()):
+		}
+	}
+	return opOutcomeFailed, fmt.Sprintf("restarted, but no healthy answer within %s — look at the box", s.opWait().Round(time.Second))
+}
+
+func orDash(s string) string {
+	if s == "" {
+		return "not listed"
+	}
+	return s
+}

internal/localapi/opactions_test.go

@@ -0,0 +1,222 @@
+package localapi
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+)
+
+// Operator brief 2026-10-29, Part 1: „Restart controller" from the hub. The agent's closed list holds one verb; the act
+// is the supervisor's own restart with the supervisor's guards, and the brake counts operator restarts too.
+
+// opExec answers the supervisor's fake plus the health read the operator restart waits on.
+type opExec struct {
+	*supExec
+	health string // what {{.State.Health.Status}} reads after the restart
+}
+
+func (f *opExec) GuestExec(ctx context.Context, vmid int, args ...string) (string, error) {
+	if len(args) >= 5 && args[0] == "docker" && args[1] == "inspect" && args[3] == opHealthTemplate {
+		f.mu.Lock()
+		st := f.status[vmid]
+		f.mu.Unlock()
+		if st == "" {
+			return "", errors.New("pct exec: exit status 1: Error: No such object: felhom-controller")
+		}
+		return map[bool]string{true: "true", false: "false"}[st == "running"] + "|" + f.health + "\n", nil
+	}
+	return f.supExec.GuestExec(ctx, vmid, args...)
+}
+
+func opServer(t *testing.T, status string) (*Server, *opExec, *fakeGuestPowerCtl, *supClock, string, *atomic.Int32) {
+	t.Helper()
+	ex := &opExec{supExec: &supExec{status: map[int]string{9201: status}, onRestart: "running"}, health: "healthy"}
+	ctl := runningGuest(9201)
+	s, clk, dir := supServer(t, nil, ctl, 9201)
+	s.guestExec = ex
+	s.opHealthPoll = time.Millisecond
+	s.opHealthWait = 2 * time.Second
+	var triggered atomic.Int32
+	s.SetOperatorActionTrigger(func() { triggered.Add(1) })
+	return s, ex, ctl, clk, dir, &triggered
+}
+
+func env(acts ...hub.OperatorAction) *hub.ControlEnvelope {
+	return &hub.ControlEnvelope{OperatorActions: acts}
+}
+
+// waitResult waits for the action's result (the act runs in the background).
+func waitResult(t *testing.T, s *Server, id int64) hub.OperatorActionResult {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		for _, r := range s.OperatorActionResults() {
+			if r.ID == id {
+				return r
+			}
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	t.Fatalf("no result for #%d", id)
+	return hub.OperatorActionResult{}
+}
+
+// RED-PROOF: seen failing before the list existed (build failure, then the names).
+func TestOpActions_AgentClosedList(t *testing.T) {
+	if got, want := OperatorActionNames(), []string{"reboot_guest", "restart_controller"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("the agent's operator actions = %v, want exactly %v — a new verb needs the operator's word", got, want)
+	}
+}
+
+// Anything outside the list — and a bad argument — is refused and NOTHING is called.
+func TestOpActions_UnknownOrBadArgIsRefused(t *testing.T) {
+	s, ex, _, _, _, _ := opServer(t, "running")
+	s.OnEnvelope(context.Background(), env(
+		hub.OperatorAction{ID: 1, Action: "reboot_host", Arg: "9201"}, // never on the list: only the guest is rebooted
+		hub.OperatorAction{ID: 2, Action: "restart_controller", Arg: "abc"},
+		hub.OperatorAction{ID: 3, Action: "restart_controller", Arg: "9202"}, // not provisioned here
+	))
+	for _, id := range []int64{1, 2, 3} {
+		if r := waitResult(t, s, id); r.Outcome != "refused" {
+			t.Errorf("#%d: %+v, want refused", id, r)
+		}
+	}
+	if n := ex.count(9201); n != 0 {
+		t.Fatalf("a refused action restarted the controller (%d)", n)
+	}
+}
+
+// The press restarts ONCE, says how long the controller took to answer, asks for a report at once, and re-sends the
+// result until the hub stops listing the id. RED-PROOF: drop the GuestExec restart → restarts 0 → FAILS.
+func TestOpActions_RestartReportsTheAnswerTime(t *testing.T) {
+	s, ex, _, _, _, trig := opServer(t, "running")
+	a := hub.OperatorAction{ID: 7, Action: "restart_controller", Arg: "9201"}
+	s.OnEnvelope(context.Background(), env(a))
+	r := waitResult(t, s, 7)
+	if r.Outcome != "done" || !strings.Contains(r.Message, "answered after") {
+		t.Fatalf("result %+v", r)
+	}
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("restarts = %d, want 1", n)
+	}
+	if trig.Load() == 0 {
+		t.Fatal("the agent did not ask for a report — the result would wait 15 minutes")
+	}
+	s.OnEnvelope(context.Background(), env(a)) // the hub still lists it: re-send, never act again
+	time.Sleep(100 * time.Millisecond)         // a wrong second act runs in the background — give it time to show
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("a re-listed id acted again (%d)", n)
+	}
+	if len(s.OperatorActionResults()) != 1 {
+		t.Fatal("the result must be re-sent while listed")
+	}
+	s.OnEnvelope(context.Background(), env()) // the hub recorded it
+	if left := s.OperatorActionResults(); len(left) != 0 {
+		t.Fatalf("a recorded result is still sent: %+v", left)
+	}
+}
+
+// The point of the agent doing it: a STOPPED controller is restarted too (the controller cannot restart itself).
+func TestOpActions_WorksWithTheControllerStopped(t *testing.T) {
+	s, ex, _, _, _, _ := opServer(t, "exited")
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 8, Action: "restart_controller", Arg: "9201"}))
+	if r := waitResult(t, s, 8); r.Outcome != "done" || ex.count(9201) != 1 {
+		t.Fatalf("result %+v, restarts %d", r, ex.count(9201))
+	}
+}
+
+// Each supervisor guard refuses the press, with the reason. RED-PROOF: drop the lock check → the locked case
+// restarts → FAILS (each guard seen failing by its own mutation).
+func TestOpActions_GuardsRefuse(t *testing.T) {
+	cases := []struct {
+		name, want string
+		setup      func(s *Server, ctl *fakeGuestPowerCtl, dir string)
+	}{
+		{"parked", "parked", func(_ *Server, _ *fakeGuestPowerCtl, dir string) {
+			if err := os.WriteFile(filepath.Join(dir, "9201", ControllerParkedMarker), nil, 0o600); err != nil {
+				panic(err)
+			}
+		}},
+		{"swap", "swap", func(s *Server, _ *fakeGuestPowerCtl, _ string) { s.swapInFlight[9201] = true }},
+		{"locked", "locked", func(_ *Server, ctl *fakeGuestPowerCtl, _ string) { ctl.locks[9201] = "backup" }},
+		{"vzdump", "backup", func(_ *Server, ctl *fakeGuestPowerCtl, _ string) { ctl.backupRun = map[int]bool{9201: true} }},
+		{"vzdump unknown", "backup", func(_ *Server, ctl *fakeGuestPowerCtl, _ string) { ctl.backupErr = errors.New("tasks unreadable") }},
+		{"guest stopped", "not running", func(_ *Server, ctl *fakeGuestPowerCtl, _ string) { ctl.guests[0].Status = "stopped" }},
+		{"guest list", "guest list", func(_ *Server, ctl *fakeGuestPowerCtl, _ string) { ctl.guestsErr = errors.New("api down") }},
+	}
+	for i, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s, ex, ctl, _, dir, _ := opServer(t, "running")
+			tc.setup(s, ctl, dir)
+			id := int64(100 + i)
+			s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: id, Action: "restart_controller", Arg: "9201"}))
+			r := waitResult(t, s, id)
+			if r.Outcome != "refused" || !strings.Contains(strings.ToLower(r.Message), tc.want) {
+				t.Fatalf("result %+v, want refused naming %q", r, tc.want)
+			}
+			if n := ex.count(9201); n != 0 {
+				t.Fatalf("guard %q did not hold: restarted %d", tc.name, n)
+			}
+		})
+	}
+}
+
+// The thrash brake counts operator restarts AND the supervisor's: 3 in 15 minutes → the next press is refused, and
+// presses stay refused for 30 minutes. RED-PROOF: drop the brake → the 4th press restarts → FAILS.
+func TestOpActions_TheBrakeCountsEveryRestart(t *testing.T) {
+	s, ex, _, clk, _, _ := opServer(t, "running")
+	// one restart by the supervisor itself
+	ex.mu.Lock()
+	ex.status[9201] = "exited"
+	ex.mu.Unlock()
+	s.ControllerSupervisorTick(context.Background())
+	s.ControllerSupervisorTick(context.Background())
+	if ex.count(9201) != 1 {
+		t.Fatalf("setup: the supervisor did not restart (%d)", ex.count(9201))
+	}
+	for id := int64(1); id <= 2; id++ {
+		clk.t = clk.t.Add(time.Minute)
+		s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: id, Action: "restart_controller", Arg: "9201"}))
+		if r := waitResult(t, s, id); r.Outcome != "done" {
+			t.Fatalf("press %d: %+v", id, r)
+		}
+	}
+	clk.t = clk.t.Add(time.Minute)
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 3, Action: "restart_controller", Arg: "9201"}))
+	r := waitResult(t, s, 3)
+	if r.Outcome != "refused" || !strings.Contains(r.Message, "3 restarts in 15 minutes") {
+		t.Fatalf("the 4th restart in 15 minutes: %+v", r)
+	}
+	if n := ex.count(9201); n != 3 {
+		t.Fatalf("restarts = %d, want 3", n)
+	}
+	clk.t = clk.t.Add(20 * time.Minute) // the window has passed, but the 30-minute refusal has not
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 4, Action: "restart_controller", Arg: "9201"}))
+	if r := waitResult(t, s, 4); r.Outcome != "refused" {
+		t.Fatalf("inside the 30-minute refusal: %+v", r)
+	}
+	clk.t = clk.t.Add(11 * time.Minute)
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 5, Action: "restart_controller", Arg: "9201"}))
+	if r := waitResult(t, s, 5); r.Outcome != "done" {
+		t.Fatalf("after the refusal: %+v", r)
+	}
+}
+
+// A controller that does not come back healthy is a FAILED press, said plainly.
+func TestOpActions_NoHealthyAnswerIsFailed(t *testing.T) {
+	s, ex, _, _, _, _ := opServer(t, "running")
+	ex.health = "unhealthy"
+	s.opHealthWait = 30 * time.Millisecond
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 9, Action: "restart_controller", Arg: "9201"}))
+	if r := waitResult(t, s, 9); r.Outcome != "failed" || !strings.Contains(r.Message, "no healthy answer") {
+		t.Fatalf("result %+v", r)
+	}
+}

internal/localapi/opreboot.go

@@ -0,0 +1,329 @@
+package localapi
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// reboot_guest — the operator reboots a guest from the hub (D65 = A, operator ruling 2026-10-29 15:50; felhom.eu `04`
+// §6.1, `03`). No signature: a reboot destroys nothing (`03`, „healing … non-destructive by construction").
+//
+// WHY: a stuck Docker or a stuck network inside the box is out of reach of „Restart controller" — that restarts one
+// container. The reboot is the existing guest-reboot path (`pct reboot <vmid>`, the household's „A Felhom
+// újraindítása", the same exact sudo vector) — of THAT guest, never the host.
+//
+// THE GUARDS (each refuses with the reason in the result; nothing is called):
+//   - the guest is not one this agent provisioned, is not running, is locked, or its controller is parked;
+//   - a controller swap (update) is in flight;
+//   - a heavy operation holds the host-wide gate (a backup of any tier the agent runs, a restore test, an OS step),
+//     or jobBlocker finds one (an agent backup job, a drive or NAS job, an escrow ceremony, a vzdump of the guest);
+//   - the CONTROLLER says it is busy: a backup, a restore, an off-site run or an app update (its `ctl/busy` file,
+//     read over one exact `pct exec … cat` grant; controllerBusy below). Fails closed on any read error but „no file";
+//   - at most ONE reboot per hour per guest (the record below, persisted — it survives an agent restart);
+//   - the operator restart's brake: a reboot counts as a restart, and the brake's refusal refuses a reboot too.
+// The heavy-operation gate is HELD from the checks until the guest is up again, so no backup, restore test or OS
+// step of this agent can start in between. The guest-power watchdog and the controller supervisor leave the guest
+// alone while the reboot runs (rebootInFlight).
+//
+// AFTER: the result says when the guest was up and when the controller answered (both from the press). The record
+// `<guests>/<vmid>/operator-reboot.json` is written BEFORE the reboot, so the controller that starts after it finds
+// it: GET /guest/operator-reboot hands it to the household's dashboard („Felhom support restarted your box at …",
+// one day). Pinned by opreboot_test.go.
+
+const (
+	// OpRebootGuest is the agent's second operator verb (D65 = A).
+	OpRebootGuest = "reboot_guest"
+
+	// opRebootEvery: at most one operator reboot per guest per hour.
+	opRebootEvery = time.Hour
+	// opRebootNoticeFor: how long the household's dashboard shows the line.
+	opRebootNoticeFor = 24 * time.Hour
+	// opRebootTimeout bounds `pct reboot` (it blocks until the guest is back).
+	opRebootTimeout = 5 * time.Minute
+
+	operatorRebootFile = "operator-reboot.json"
+
+	// ControllerBusyMarkerGuestPath is the controller's busy file as the GUEST sees it: the controller data volume
+	// (`felhom-controller-data`, mounted at /opt/docker/felhom-controller in the container) + data/ctl/busy. One exact
+	// sudo vector reads it (configs/felhom-agent.sudoers, FELHOM_CONTROLLERSWAP). It reads without Docker, so a stuck
+	// Docker does not hide it.
+	ControllerBusyMarkerGuestPath = "/var/lib/docker/volumes/felhom-controller-data/_data/data/ctl/busy"
+	// controllerBusyFresh: the controller rewrites the file every 15 s while busy; an older file is a controller that
+	// stopped writing (stuck or killed) — not a busy one.
+	controllerBusyFresh = 90 * time.Second
+)
+
+// operatorRebootRecord is the persisted record of the last operator reboot of a guest.
+type operatorRebootRecord struct {
+	At               time.Time `json:"at"`
+	ActionID         int64     `json:"action_id"`
+	GuestUpAfterS    int       `json:"guest_up_after_s,omitempty"`
+	ControllerAfterS int       `json:"controller_after_s,omitempty"`
+}
+
+func (s *Server) operatorRebootPath(vmid int) string {
+	return filepath.Join(s.guestsStateDir(), strconv.Itoa(vmid), operatorRebootFile)
+}
+
+// lastOperatorReboot reads the record; ok=false when there is none. A corrupt record is an error (the hourly limit
+// must not silently vanish).
+func (s *Server) lastOperatorReboot(vmid int) (operatorRebootRecord, bool, error) {
+	raw, err := os.ReadFile(s.operatorRebootPath(vmid))
+	if errors.Is(err, os.ErrNotExist) {
+		return operatorRebootRecord{}, false, nil
+	}
+	if err != nil {
+		return operatorRebootRecord{}, false, err
+	}
+	var rec operatorRebootRecord
+	if err := json.Unmarshal(raw, &rec); err != nil {
+		return operatorRebootRecord{}, false, fmt.Errorf("corrupt %s: %w", operatorRebootFile, err)
+	}
+	return rec, !rec.At.IsZero(), nil
+}
+
+func (s *Server) saveOperatorReboot(vmid int, rec operatorRebootRecord) error {
+	raw, err := json.Marshal(rec)
+	if err != nil {
+		return err
+	}
+	p := s.operatorRebootPath(vmid)
+	tmp := p + ".tmp"
+	if err := os.WriteFile(tmp, raw, 0o644); err != nil {
+		return err
+	}
+	return os.Rename(tmp, p)
+}
+
+// rebooting reports whether an operator reboot of the guest is in flight (the watchdogs leave it alone).
+func (s *Server) rebooting(vmid int) bool {
+	s.rebootMu.Lock()
+	defer s.rebootMu.Unlock()
+	return s.rebootInFlight[vmid]
+}
+
+func (s *Server) setRebooting(vmid int, on bool) {
+	s.rebootMu.Lock()
+	defer s.rebootMu.Unlock()
+	if s.rebootInFlight == nil {
+		s.rebootInFlight = map[int]bool{}
+	}
+	if on {
+		s.rebootInFlight[vmid] = true
+	} else {
+		delete(s.rebootInFlight, vmid)
+	}
+}
+
+func (s *Server) rebooter() interface {
+	RebootGuest(ctx context.Context, vmid int) error
+} {
+	if s.opRebooter != nil {
+		return s.opRebooter
+	}
+	if s.guestAttach != nil {
+		return s.guestAttach
+	}
+	return nil
+}
+
+// controllerBusy reads the controller's busy file. busy=true with the controller's reason when the file is fresh;
+// a missing file is „not busy" (an idle controller, or one older than the file); any other read failure is an error
+// (the caller refuses — it cannot prove no backup runs). Two callers: the operator's reboot (D65) and R-1344's restart
+// of a controller that does not answer (controllersupervisor.go restartUnresponsive).
+func (s *Server) controllerBusy(ctx context.Context, vmid int) (bool, string, error) {
+	out, err := s.guestExec.GuestExec(ctx, vmid, "cat", ControllerBusyMarkerGuestPath)
+	if err != nil {
+		if strings.Contains(strings.ToLower(err.Error()+" "+out), "no such file") {
+			return false, "", nil
+		}
+		return false, "", err
+	}
+	lines := strings.SplitN(strings.TrimSpace(out), "\n", 2)
+	at, perr := time.Parse(time.RFC3339, strings.TrimSpace(lines[0]))
+	if perr != nil {
+		return false, "", fmt.Errorf("the controller's busy file does not start with a time: %q", lines[0])
+	}
+	if s.clock().Sub(at) > controllerBusyFresh {
+		s.logger.Info("controller-busy: the controller's busy file is stale — the controller stopped writing it; not busy",
+			"vmid", vmid, "written", at.UTC().Format(time.RFC3339))
+		return false, "", nil
+	}
+	why := "work in progress"
+	if len(lines) == 2 && strings.TrimSpace(lines[1]) != "" {
+		why = strings.TrimSpace(lines[1])
+	}
+	return true, why, nil
+}
+
+// operatorRebootGuest is the press: every guard, then the reboot, then the wait for the guest and the controller.
+func (s *Server) operatorRebootGuest(ctx context.Context, id int64, arg string) (string, string) {
+	vmid, err := strconv.Atoi(arg)
+	if err != nil || strconv.Itoa(vmid) != arg {
+		return opOutcomeRefused, fmt.Sprintf("refused: %q is not a guest id", arg)
+	}
+	rb := s.rebooter()
+	if s.staleLock == nil || s.guestExec == nil || rb == nil {
+		return opOutcomeRefused, "refused: the guest reboot is not wired on this agent"
+	}
+	if !s.provisionedGuest(vmid) {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is not a guest this agent provisioned", vmid)
+	}
+	if s.rebooting(vmid) {
+		return opOutcomeRefused, fmt.Sprintf("refused: a reboot of guest %d is already running", vmid)
+	}
+	guests, err := s.staleLock.Guests(ctx)
+	if err != nil {
+		return opOutcomeRefused, "refused: the guest list cannot be read — ownership unproven, nothing touched"
+	}
+	status := ""
+	for _, g := range guests {
+		if g.VMID == vmid {
+			status = g.Status
+		}
+	}
+	if status != "running" {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is not running (%s) — the guest-power watchdog owns it", vmid, orDash(status))
+	}
+	if s.controllerParked(vmid) {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d's controller is parked (remove the controller-parked marker first)", vmid)
+	}
+	// A controller swap (update) is refused by jobBlocker below, with the agent's other jobs.
+	if lock, _, err := s.staleLock.Lock(ctx, vmid); err != nil {
+		return opOutcomeRefused, "refused: the guest lock cannot be read — nothing touched"
+	} else if lock != "" {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d is locked (%s) — another operation owns it", vmid, lock)
+	}
+
+	// At most one per hour.
+	now := s.clock()
+	last, had, err := s.lastOperatorReboot(vmid)
+	if err != nil {
+		return opOutcomeRefused, "refused: the last reboot's record cannot be read — " + err.Error()
+	}
+	if had && now.Sub(last.At) < opRebootEvery {
+		return opOutcomeRefused, fmt.Sprintf("refused: guest %d was rebooted from the hub at %s UTC — at most one reboot per hour (next from %s UTC)",
+			vmid, last.At.UTC().Format("15:04"), last.At.Add(opRebootEvery).UTC().Format("15:04"))
+	}
+
+	// The brake: a refusal in force refuses a reboot too, and 3 restarts in 15 minutes refuse it.
+	s.ctrlSup.mu.Lock()
+	st := s.supState(vmid)
+	if now.Before(st.opBrakeUntil) {
+		until := st.opBrakeUntil
+		s.ctrlSup.mu.Unlock()
+		return opOutcomeRefused, fmt.Sprintf("refused: 3 restarts in 15 minutes — presses are refused until %s UTC", until.UTC().Format("15:04"))
+	}
+	st.restarts = pruneBefore(st.restarts, now.Add(-controllerCrashloopWindow))
+	if len(st.restarts) >= controllerCrashloopMax {
+		st.opBrakeUntil = now.Add(opBrakeRefusal)
+		until := st.opBrakeUntil
+		s.ctrlSup.mu.Unlock()
+		return opOutcomeRefused, fmt.Sprintf("refused: 3 restarts in 15 minutes — presses are refused until %s UTC", until.UTC().Format("15:04"))
+	}
+	s.ctrlSup.mu.Unlock()
+
+	// The heavy-operation gate, held until the guest is up again.
+	release, busy, ok := s.inFlight.TryAcquire("guest-reboot")
+	if !ok {
+		return opOutcomeRefused, "refused: a backup or another heavy operation runs on the host (" + busy + ")"
+	}
+	defer release()
+	if code, detail := s.jobBlocker(ctx, vmid); code != "" {
+		return opOutcomeRefused, "refused: " + rebootBlockerSentence(code) + " (" + detail + ")"
+	}
+	if cbusy, why, err := s.controllerBusy(ctx, vmid); err != nil {
+		return opOutcomeRefused, "refused: the controller's busy file cannot be read, so a running backup cannot be ruled out — " + err.Error()
+	} else if cbusy {
+		return opOutcomeRefused, "refused: the controller is busy — " + why
+	}
+
+	// The record FIRST: the hourly limit and the household's line both read it.
+	rec := operatorRebootRecord{At: now, ActionID: id}
+	if err := s.saveOperatorReboot(vmid, rec); err != nil {
+		return opOutcomeRefused, "refused: the reboot cannot be recorded — " + err.Error()
+	}
+	s.ctrlSup.mu.Lock()
+	st = s.supState(vmid)
+	st.restarts = append(st.restarts, now)
+	st.restartsTotal++
+	st.lastRestartAt = now
+	st.lastReason = fmt.Sprintf("guest reboot by the operator via the hub (action #%d)", id)
+	st.notRunningSeen = 0
+	s.ctrlSup.mu.Unlock()
+	s.setRebooting(vmid, true)
+	defer s.setRebooting(vmid, false)
+
+	s.logger.Warn("operator reboot: REBOOTING the guest on the operator's press", "vmid", vmid, "action_id", id)
+	began := time.Now()
+	rctx, cancel := context.WithTimeout(ctx, opRebootTimeout)
+	err = rb.RebootGuest(rctx, vmid)
+	cancel()
+	if err != nil {
+		return opOutcomeFailed, fmt.Sprintf("the reboot of guest %d failed: %v — look at the box (the guest-power watchdog starts a stopped guest)", vmid, err)
+	}
+	upS := int(time.Since(began).Round(time.Second) / time.Second)
+	rec.GuestUpAfterS = upS
+	// The controller's own HEALTHCHECK is the answer, as for a restart; the wait starts when the guest is up.
+	for deadline := time.Now().Add(s.opWait()); time.Now().Before(deadline); {
+		out, err := s.guestExec.GuestExec(ctx, vmid, "docker", "inspect", "-f", opHealthTemplate, controllerContainer)
+		if err == nil {
+			f := strings.SplitN(strings.TrimSpace(out), "|", 2)
+			if len(f) == 2 && f[0] == "true" && (f[1] == "healthy" || f[1] == "none") {
+				rec.ControllerAfterS = int(time.Since(began).Round(time.Second) / time.Second)
+				if serr := s.saveOperatorReboot(vmid, rec); serr != nil {
+					s.logger.Warn("operator reboot: the times could not be added to the record", "vmid", vmid, "err", serr)
+				}
+				return opOutcomeDone, fmt.Sprintf("rebooted; the guest was up after %d s, the controller answered after %d s", upS, rec.ControllerAfterS)
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return opOutcomeFailed, fmt.Sprintf("rebooted; the guest was up after %d s, but the wait for the controller was cut", upS)
+		case <-time.After(s.opPoll()):
+		}
+	}
+	_ = s.saveOperatorReboot(vmid, rec)
+	return opOutcomeFailed, fmt.Sprintf("rebooted; the guest was up after %d s, but the controller gave no healthy answer within %s — look at the box", upS, s.opWait().Round(time.Second))
+}
+
+// rebootBlockerSentence names jobBlocker's code in the result's words.
+func rebootBlockerSentence(code string) string {
+	switch code {
+	case PowerOffBackup:
+		return "a backup is running"
+	case PowerOffCtrlUpdate:
+		return "a controller update is running"
+	case PowerOffDrive:
+		return "a drive or network-storage job is running"
+	case PowerOffEscrow:
+		return "an escrow ceremony is running"
+	case PowerOffUnknown:
+		return "the running jobs cannot be read"
+	default:
+		return "the host is busy"
+	}
+}
+
+// handleOperatorRebootNotice — GET /guest/operator-reboot (self-scoped): the last operator reboot of THIS guest, when it
+// is less than a day old, for the household's dashboard line. {"at": ""} when there is none.
+func (s *Server) handleOperatorRebootNotice(w http.ResponseWriter, _ *http.Request, vmid int) {
+	rec, ok, err := s.lastOperatorReboot(vmid)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "the reboot record cannot be read")
+		return
+	}
+	if !ok || s.clock().Sub(rec.At) >= opRebootNoticeFor {
+		writeOK(w, map[string]any{"vmid": vmid, "at": ""})
+		return
+	}
+	writeOK(w, map[string]any{"vmid": vmid, "at": rec.At.UTC().Format(time.RFC3339), "by": "operator"})
+}

internal/localapi/opreboot_test.go

@@ -0,0 +1,306 @@
+package localapi
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/backup"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
+)
+
+// D65 = A (operator 2026-10-29 15:50): „Reboot guest" from the hub. The agent's reboot_guest — the existing
+// `pct reboot` of THAT guest — with its guards, the hourly limit, the brake, and the record the household's line reads.
+
+// rbExec adds the controller's busy file to the operator-restart fake.
+type rbExec struct {
+	*opExec
+	busy    string // the file's content; "" = no file
+	busyErr error  // pct exec itself failed
+}
+
+func (f *rbExec) GuestExec(ctx context.Context, vmid int, args ...string) (string, error) {
+	if len(args) == 2 && args[0] == "cat" && args[1] == ControllerBusyMarkerGuestPath {
+		if f.busyErr != nil {
+			return "", f.busyErr
+		}
+		if f.busy == "" {
+			return "", errors.New("pct exec 9201 [cat ...]: exit status 1: cat: " + ControllerBusyMarkerGuestPath + ": No such file or directory")
+		}
+		return f.busy, nil
+	}
+	return f.opExec.GuestExec(ctx, vmid, args...)
+}
+
+type fakeRebooter struct {
+	mu    sync.Mutex
+	n     int
+	err   error
+	after func()
+}
+
+func (r *fakeRebooter) RebootGuest(context.Context, int) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.n++
+	if r.after != nil {
+		r.after()
+	}
+	return r.err
+}
+
+func (r *fakeRebooter) count() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.n
+}
+
+func rbServer(t *testing.T) (*Server, *rbExec, *fakeRebooter, *fakeGuestPowerCtl, *supClock, string) {
+	t.Helper()
+	s, ox, ctl, clk, dir, _ := opServer(t, "running")
+	ex := &rbExec{opExec: ox}
+	s.guestExec = ex
+	rb := &fakeRebooter{}
+	s.opRebooter = rb
+	s.inFlight = &backup.InFlight{}
+	return s, ex, rb, ctl, clk, dir
+}
+
+func pressReboot(t *testing.T, s *Server, id int64) hub.OperatorActionResult {
+	t.Helper()
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: id, Action: "reboot_guest", Arg: "9201"}))
+	return waitResult(t, s, id)
+}
+
+// The press reboots ONCE and says when the guest was up and when the controller answered; the record is written for
+// the household's line. RED-PROOF: drop the RebootGuest call → reboots 0 → FAILS.
+func TestOpReboot_RebootsAndReportsTheTimes(t *testing.T) {
+	s, _, rb, _, clk, _ := rbServer(t)
+	r := pressReboot(t, s, 1)
+	if r.Outcome != "done" || !strings.Contains(r.Message, "the guest was up after") || !strings.Contains(r.Message, "the controller answered after") {
+		t.Fatalf("result %+v", r)
+	}
+	if rb.count() != 1 {
+		t.Fatalf("reboots = %d, want 1", rb.count())
+	}
+	rec, ok, err := s.lastOperatorReboot(9201)
+	if err != nil || !ok || !rec.At.Equal(clk.t) || rec.ActionID != 1 {
+		t.Fatalf("record %+v ok=%v err=%v", rec, ok, err)
+	}
+	if s.inFlight.Busy() != "" {
+		t.Fatalf("the heavy-operation gate is still held after the reboot: %q", s.inFlight.Busy())
+	}
+	if s.rebooting(9201) {
+		t.Fatal("the reboot-in-flight flag outlived the reboot")
+	}
+}
+
+// Each guard refuses with its reason and NOTHING is rebooted. RED-PROOF: each guard seen failing by deleting it.
+func TestOpReboot_GuardsRefuse(t *testing.T) {
+	fresh := func(clk *supClock) string {
+		return clk.t.Add(-20*time.Second).Format(time.RFC3339) + "\nan off-site backup is running\n"
+	}
+	cases := []struct {
+		name, want string
+		setup      func(s *Server, ex *rbExec, ctl *fakeGuestPowerCtl, clk *supClock, dir string)
+	}{
+		{"parked", "parked", func(_ *Server, _ *rbExec, _ *fakeGuestPowerCtl, _ *supClock, dir string) {
+			if err := os.WriteFile(filepath.Join(dir, "9201", ControllerParkedMarker), nil, 0o600); err != nil {
+				panic(err)
+			}
+		}},
+		{"swap", "swap", func(s *Server, _ *rbExec, _ *fakeGuestPowerCtl, _ *supClock, _ string) { s.swapInFlight[9201] = true }},
+		{"locked", "locked", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl, _ *supClock, _ string) { ctl.locks[9201] = "backup" }},
+		{"stopped", "not running", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl, _ *supClock, _ string) {
+			ctl.guests[0].Status = "stopped"
+		}},
+		{"vzdump", "backup", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl, _ *supClock, _ string) {
+			ctl.backupRun = map[int]bool{9201: true}
+		}},
+		{"vzdump unknown", "cannot be read", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl, _ *supClock, _ string) {
+			ctl.backupErr = errors.New("tasks unreadable")
+		}},
+		{"heavy gate", "backup:felhom-pbs", func(s *Server, _ *rbExec, _ *fakeGuestPowerCtl, _ *supClock, _ string) {
+			s.inFlight.TryAcquire("backup:felhom-pbs")
+		}},
+		{"agent backup job", "a backup is running", func(s *Server, _ *rbExec, _ *fakeGuestPowerCtl, _ *supClock, _ string) {
+			s.jobs = map[backupJobKey]*backupJob{{vmid: 9201, target: "local"}: {JobID: "j1", Phase: PhaseRunning}}
+		}},
+		{"controller busy", "off-site backup", func(_ *Server, ex *rbExec, _ *fakeGuestPowerCtl, clk *supClock, _ string) {
+			ex.busy = fresh(clk)
+		}},
+		{"busy file unreadable", "cannot be ruled out", func(_ *Server, ex *rbExec, _ *fakeGuestPowerCtl, _ *supClock, _ string) {
+			ex.busyErr = errors.New("pct exec 9201: exit status 255: lxc-attach failed")
+		}},
+		{"brake in force", "3 restarts in 15 minutes", func(s *Server, _ *rbExec, _ *fakeGuestPowerCtl, clk *supClock, _ string) {
+			s.ctrlSup.mu.Lock()
+			s.supState(9201).opBrakeUntil = clk.t.Add(10 * time.Minute)
+			s.ctrlSup.mu.Unlock()
+		}},
+		{"not provisioned", "not a guest this agent provisioned", func(_ *Server, _ *rbExec, _ *fakeGuestPowerCtl, _ *supClock, dir string) {
+			if err := os.RemoveAll(filepath.Join(dir, "9201", "bootstrap")); err != nil {
+				panic(err)
+			}
+		}},
+	}
+	for i, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s, ex, rb, ctl, clk, dir := rbServer(t)
+			tc.setup(s, ex, ctl, clk, dir)
+			r := pressReboot(t, s, int64(100+i))
+			if r.Outcome != "refused" || !strings.Contains(r.Message, tc.want) {
+				t.Fatalf("result %+v, want refused naming %q", r, tc.want)
+			}
+			if rb.count() != 0 {
+				t.Fatalf("guard %q did not hold: rebooted", tc.name)
+			}
+			if _, ok, _ := s.lastOperatorReboot(9201); ok {
+				t.Fatal("a refused press wrote the reboot record (the household would read a reboot that never happened)")
+			}
+		})
+	}
+}
+
+// A busy file the controller stopped writing (stuck, killed) is not a busy controller — the reboot exists for exactly
+// that box. RED-PROOF: drop the freshness check → refused → FAILS.
+func TestOpReboot_StaleBusyFileDoesNotBlock(t *testing.T) {
+	s, ex, rb, _, clk, _ := rbServer(t)
+	ex.busy = clk.t.Add(-10*time.Minute).Format(time.RFC3339) + "\na backup is running\n"
+	if r := pressReboot(t, s, 1); r.Outcome != "done" || rb.count() != 1 {
+		t.Fatalf("result %+v, reboots %d", r, rb.count())
+	}
+}
+
+// At most one reboot per hour per guest, and the limit survives an agent restart (the record is on disk).
+// RED-PROOF: drop the hourly check → the second press reboots → FAILS.
+func TestOpReboot_AtMostOncePerHour(t *testing.T) {
+	s, _, rb, ctl, clk, dir := rbServer(t)
+	if r := pressReboot(t, s, 1); r.Outcome != "done" {
+		t.Fatalf("first press: %+v", r)
+	}
+	clk.t = clk.t.Add(59 * time.Minute)
+	if r := pressReboot(t, s, 2); r.Outcome != "refused" || !strings.Contains(r.Message, "at most one reboot per hour") {
+		t.Fatalf("second press inside the hour: %+v", r)
+	}
+	// a restarted agent (a fresh in-memory state over the same guests dir) still refuses
+	s2, ox2, _, _, _, _ := opServer(t, "running")
+	s2.guestsDir, s2.staleLock, s2.now = dir, ctl, clk.now
+	s2.guestExec = &rbExec{opExec: ox2}
+	rb2 := &fakeRebooter{}
+	s2.opRebooter, s2.inFlight = rb2, &backup.InFlight{}
+	if r := pressReboot(t, s2, 3); r.Outcome != "refused" || rb2.count() != 0 {
+		t.Fatalf("after an agent restart, inside the hour: %+v", r)
+	}
+	clk.t = clk.t.Add(2 * time.Minute)
+	if r := pressReboot(t, s, 4); r.Outcome != "done" || rb.count() != 2 {
+		t.Fatalf("after the hour: %+v (reboots %d)", r, rb.count())
+	}
+}
+
+// The brake counts a reboot as a restart: two operator restarts and one reboot inside 15 minutes refuse the next
+// restart press. RED-PROOF: drop the restarts append in operatorRebootGuest → the 4th press restarts → FAILS.
+func TestOpReboot_TheBrakeCountsAReboot(t *testing.T) {
+	s, ex, _, _, clk, _ := rbServer(t)
+	for id := int64(1); id <= 2; id++ {
+		s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: id, Action: "restart_controller", Arg: "9201"}))
+		if r := waitResult(t, s, id); r.Outcome != "done" {
+			t.Fatalf("restart %d: %+v", id, r)
+		}
+		clk.t = clk.t.Add(time.Minute)
+	}
+	if r := pressReboot(t, s, 3); r.Outcome != "done" {
+		t.Fatalf("reboot: %+v", r)
+	}
+	clk.t = clk.t.Add(time.Minute)
+	s.OnEnvelope(context.Background(), env(hub.OperatorAction{ID: 4, Action: "restart_controller", Arg: "9201"}))
+	if r := waitResult(t, s, 4); r.Outcome != "refused" || !strings.Contains(r.Message, "3 restarts in 15 minutes") {
+		t.Fatalf("the 4th restart (2 restarts + 1 reboot) in 15 minutes: %+v", r)
+	}
+	if n := ex.count(9201); n != 2 {
+		t.Fatalf("restarts = %d, want 2", n)
+	}
+}
+
+// A failed `pct reboot` is a FAILED press, said plainly; the gate and the flag are given back.
+func TestOpReboot_FailedRebootIsFailed(t *testing.T) {
+	s, _, rb, _, _, _ := rbServer(t)
+	rb.err = errors.New("pct reboot 9201: exit status 255")
+	if r := pressReboot(t, s, 1); r.Outcome != "failed" || !strings.Contains(r.Message, "failed") {
+		t.Fatalf("result %+v", r)
+	}
+	if s.inFlight.Busy() != "" || s.rebooting(9201) {
+		t.Fatal("the gate or the flag outlived a failed reboot")
+	}
+}
+
+// While the reboot runs, the guest-power watchdog does not start the (momentarily stopped) guest and the supervisor
+// does not restart its controller. RED-PROOF: drop either rebooting() check → a start or a restart → FAILS.
+func TestOpReboot_TheWatchdogsLeaveARebootingGuestAlone(t *testing.T) {
+	s, ex, rb, ctl, _, _ := rbServer(t)
+	var started, restarted int
+	rb.after = func() {
+		ctl.guests[0].Status = "stopped"
+		s.GuestPowerTick(context.Background())
+		ctl.guests[0].Status = "running"
+		ex.mu.Lock()
+		ex.status[9201] = "exited"
+		ex.mu.Unlock()
+		s.ControllerSupervisorTick(context.Background())
+		s.ControllerSupervisorTick(context.Background())
+		started, restarted = len(ctl.started), ex.count(9201)
+		ex.mu.Lock()
+		ex.status[9201] = "running"
+		ex.mu.Unlock()
+	}
+	if r := pressReboot(t, s, 1); r.Outcome != "done" {
+		t.Fatalf("result %+v", r)
+	}
+	if started != 0 || restarted != 0 {
+		t.Fatalf("during the reboot: guest-power started %d, the supervisor restarted %d — both must leave it to pct reboot", started, restarted)
+	}
+}
+
+// The household's line: GET /guest/operator-reboot returns the time for a day, then nothing.
+// RED-PROOF: drop the 24-hour check → the 25-hour read still returns the time → FAILS.
+func TestOpReboot_TheNoticeExpiresAfterADay(t *testing.T) {
+	s, _, _, _, clk, _ := rbServer(t)
+	read := func() string {
+		w := httptest.NewRecorder()
+		s.handleOperatorRebootNotice(w, httptest.NewRequest("GET", "/guest/operator-reboot", nil), 9201)
+		var body struct {
+			Data struct {
+				At string `json:"at"`
+			} `json:"data"`
+			At string `json:"at"`
+		}
+		if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+			t.Fatalf("body %q: %v", w.Body.String(), err)
+		}
+		if body.Data.At != "" {
+			return body.Data.At
+		}
+		return body.At
+	}
+	if got := read(); got != "" {
+		t.Fatalf("no reboot yet, got %q", got)
+	}
+	at := clk.t
+	if r := pressReboot(t, s, 1); r.Outcome != "done" {
+		t.Fatalf("result %+v", r)
+	}
+	clk.t = at.Add(23 * time.Hour)
+	if got := read(); got != at.UTC().Format(time.RFC3339) {
+		t.Fatalf("after 23 h: %q, want %s", got, at.UTC().Format(time.RFC3339))
+	}
+	clk.t = at.Add(25 * time.Hour)
+	if got := read(); got != "" {
+		t.Fatalf("after 25 h the line must be gone, got %q", got)
+	}
+}

internal/localapi/server.go

@@ -411,6 +411,20 @@ type Server struct {
 	guestsDir string
 	ctrlSup   controllerSupervisor
 
+	// 2026-10-29: the operator's actions from the hub's reply (opactions.go). opHealthPoll/opHealthWait bound the wait
+	// for a restarted controller's healthy answer (tests shorten them; zero → the defaults).
+	opActs       opActionState
+	opTrigger    func()
+	opHealthPoll time.Duration
+	opHealthWait time.Duration
+	// D65 = A (2026-10-29): the operator's guest reboot (opreboot.go). opRebooter is a test seam (nil → guestAttach);
+	// rebootInFlight keeps the guest-power watchdog and the controller supervisor off a guest being rebooted.
+	opRebooter interface {
+		RebootGuest(ctx context.Context, vmid int) error
+	}
+	rebootMu       sync.Mutex
+	rebootInFlight map[int]bool
+
 	// Network-storage verify job (SPIKE-nas-verify): the IN-MEMORY single slot + the seams the
 	// detached pipeline runs through (tests inject; production defaults set in NewServer).
 	netVerifyMu  sync.Mutex
@@ -596,6 +610,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /disks/guest-attach", s.withGuest(s.handleDiskGuestAttach))
 	// Guest reboot (slice 10 P2 activation): user-triggered restart to activate pending drive binds.
 	mux.HandleFunc("POST /guest/reboot", s.withGuest(s.handleGuestReboot))
+	// D65 = A: the last operator reboot of THIS guest (< 1 day), for the household's dashboard line (opreboot.go).
+	mux.HandleFunc("GET /guest/operator-reboot", s.withGuest(s.handleOperatorRebootNotice))
 	// Host power-off (R-998, doc 14): the household's „A gép kikapcsolása". Guarded in hostpoweroff.go.
 	mux.HandleFunc("POST /host/poweroff", s.withGuest(s.handleHostPowerOff))
 	// Guest RAM resize (v0.90.0, R-24): read current allocation + bounds, and apply a bounded resize

internal/localapi/stalelock_inflight_test.go

@@ -256,8 +256,10 @@ func TestBackupRunning_AllCallersUseTheOneHelper(t *testing.T) {
 			}
 		}
 	}
-	if callers != 5 {
-		t.Errorf("expected the five known callers (stale-lock, guest-power, power-off, supervisor, the R-1006 cleanup), found %d", callers)
+	// 2026-10-29: +2 deliberate callers — the operator's restart_controller (opactions.go) and R-1344's unresponsive count
+	// (controllersupervisor.go observeControllerHealth). Both through s.staleLock, the one helper.
+	if callers != 7 {
+		t.Errorf("expected the seven known callers (stale-lock, guest-power, power-off, supervisor, the R-1006 cleanup, the operator restart, the unresponsive count), found %d", callers)
 	}
 	b, _ := os.ReadFile("stalelock.go")
 	if !strings.Contains(string(b), "vzdumpInFlight(tasks, vmid, proc)") {

internal/localapi/supervisor_unresponsive_test.go

@@ -0,0 +1,156 @@
+package localapi
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+// R-1344 (operator brief 2026-10-29, Part 2; decided 2026-10-30 from the night's measurement): a controller that RUNS
+// but whose Docker health check reads „unhealthy" on controllerUnresponsiveConfirm consecutive sweeps is reported
+// unresponsive (the stanza; the hub raises controller_unresponsive). If it still reads „unhealthy" at
+// controllerUnresponsiveRestart sweeps, the agent restarts it — with the not-running restart's guards and brake, plus
+// the controller's own busy file. RED-PROOF: the restart tests seen failing before the restart existed.
+
+func unrespServer(t *testing.T, health string) (*Server, *rbExec, *fakeGuestPowerCtl, *supClock) {
+	t.Helper()
+	s, ex, ctl, clk, _, _ := opServer(t, "running")
+	ex.health = health
+	rb := &rbExec{opExec: ex}
+	s.guestExec = rb
+	return s, rb, ctl, clk
+}
+
+func sweep(s *Server, n int) {
+	for i := 0; i < n; i++ {
+		s.ControllerSupervisorTick(context.Background())
+	}
+}
+
+func TestSupervisor_UnresponsiveIsAlarmedThenRestarted(t *testing.T) {
+	s, ex, _, _ := unrespServer(t, "unhealthy")
+	sweep(s, controllerUnresponsiveConfirm-1)
+	if g := s.ControllerSupervisorStatus(context.Background()).Guests; len(g) != 1 || g[0].Unresponsive {
+		t.Fatalf("unresponsive before %d sweeps: %+v", controllerUnresponsiveConfirm, g)
+	}
+	sweep(s, 1)
+	g := s.ControllerSupervisorStatus(context.Background()).Guests
+	if len(g) != 1 || !g[0].Unresponsive || g[0].UnresponsiveSince == "" {
+		t.Fatalf("after %d unhealthy sweeps: %+v", controllerUnresponsiveConfirm, g)
+	}
+	if g[0].UnresponsiveRestartAfterS != (controllerUnresponsiveRestart-controllerUnresponsiveConfirm)*int(controllerSupervisorInterval/time.Second) {
+		t.Fatalf("the stanza must tell the hub when the restart comes: %+v", g[0])
+	}
+	since := g[0].UnresponsiveSince
+	sweep(s, controllerUnresponsiveRestart-controllerUnresponsiveConfirm-1)
+	if n := ex.count(9201); n != 0 {
+		t.Fatalf("restarted after %d unhealthy sweeps — the restart waits for %d", controllerUnresponsiveRestart-1, controllerUnresponsiveRestart)
+	}
+	if g := s.ControllerSupervisorStatus(context.Background()).Guests; g[0].UnresponsiveSince != since {
+		t.Fatal("unresponsive_since moved while it stayed unresponsive — the hub would mail again")
+	}
+	sweep(s, 1)
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("after %d unhealthy sweeps: %d restarts, want 1", controllerUnresponsiveRestart, n)
+	}
+	g = s.ControllerSupervisorStatus(context.Background()).Guests
+	if g[0].UnresponsiveRestartAt == "" || g[0].UnresponsiveRestartAt != g[0].LastRestartAt || g[0].Restarts24h != 1 ||
+		!strings.Contains(g[0].LastReason, "health check") {
+		t.Fatalf("the restart is not on the record the hub reads: %+v", g[0])
+	}
+	// A restart that did not help (still „unhealthy" on the next sweep) is not repeated at once: the count starts again.
+	sweep(s, 1)
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("restarted again on the sweep after a restart: %d restarts", n)
+	}
+	// The restarted controller starts, then answers: the episode ends, its record stays.
+	ex.health = "starting"
+	sweep(s, 1)
+	if g := s.ControllerSupervisorStatus(context.Background()).Guests; g[0].Unresponsive || g[0].UnresponsiveSince != since {
+		t.Fatalf("after the restart: %+v (unresponsive must clear; since stays as the record)", g[0])
+	}
+	// A second episode needs the whole count again — never a restart on the first unhealthy read after one.
+	ex.health = "unhealthy"
+	sweep(s, controllerUnresponsiveRestart-1)
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("a second episode restarted early: %d restarts", n)
+	}
+}
+
+// Slow but answering (healthy / starting), a swap, a vzdump, a locked or a parked guest never counts — and so is never
+// restarted.
+func TestSupervisor_UnresponsiveGuards(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		setup func(s *Server, ex *rbExec, ctl *fakeGuestPowerCtl)
+	}{
+		{"healthy", func(_ *Server, ex *rbExec, _ *fakeGuestPowerCtl) { ex.health = "healthy" }},
+		{"starting", func(_ *Server, ex *rbExec, _ *fakeGuestPowerCtl) { ex.health = "starting" }},
+		{"swap", func(s *Server, _ *rbExec, _ *fakeGuestPowerCtl) { s.swapInFlight[9201] = true }},
+		{"vzdump", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl) { ctl.backupRun = map[int]bool{9201: true} }},
+		{"locked", func(_ *Server, _ *rbExec, ctl *fakeGuestPowerCtl) { ctl.locks[9201] = "backup" }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s, ex, ctl, _ := unrespServer(t, "unhealthy")
+			tc.setup(s, ex, ctl)
+			sweep(s, controllerUnresponsiveRestart+2)
+			if g := s.ControllerSupervisorStatus(context.Background()).Guests; len(g) == 1 && g[0].Unresponsive {
+				t.Fatalf("%s counted as unresponsive: %+v", tc.name, g[0])
+			}
+			if n := ex.count(9201); n != 0 {
+				t.Fatalf("%s: restarted %d times", tc.name, n)
+			}
+		})
+	}
+}
+
+// At the restart moment: the controller's busy file (fresh, or unreadable) and the brake refuse it; the alarm stays.
+// RED-PROOF: each seen failing by deleting its guard.
+func TestSupervisor_UnresponsiveRestartRefusals(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		setup     func(s *Server, ex *rbExec, clk *supClock)
+		crashloop bool
+	}{
+		{"busy file fresh", func(_ *Server, ex *rbExec, clk *supClock) {
+			ex.busy = clk.t.Add(-20*time.Second).Format(time.RFC3339) + "\na backup, a restore or an off-site run is running\n"
+		}, false},
+		{"busy file unreadable", func(_ *Server, ex *rbExec, _ *supClock) { ex.busyErr = errors.New("pct exec: exit status 255") }, false},
+		{"brake: 3 restarts in 15 minutes", func(s *Server, _ *rbExec, clk *supClock) {
+			st := s.supState(9201)
+			st.restarts = []time.Time{clk.t.Add(-10 * time.Minute), clk.t.Add(-5 * time.Minute), clk.t.Add(-time.Minute)}
+		}, true},
+		{"crash-loop pause in force", func(s *Server, _ *rbExec, clk *supClock) {
+			s.supState(9201).crashloopSince = clk.t.Add(-5 * time.Minute)
+		}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s, ex, _, clk := unrespServer(t, "unhealthy")
+			tc.setup(s, ex, clk)
+			sweep(s, controllerUnresponsiveRestart+3)
+			if n := ex.count(9201); n != 0 {
+				t.Fatalf("%s: restarted %d times", tc.name, n)
+			}
+			g := s.ControllerSupervisorStatus(context.Background()).Guests
+			if len(g) != 1 || !g[0].Unresponsive || g[0].UnresponsiveRestartAt != "" {
+				t.Fatalf("%s: the alarm must stay and no restart be recorded: %+v", tc.name, g)
+			}
+			if tc.crashloop && !g[0].Crashloop {
+				t.Fatalf("%s: the brake did not raise the crash-loop: %+v", tc.name, g[0])
+			}
+		})
+	}
+}
+
+// A busy file the controller stopped writing (older than controllerBusyFresh) is not „busy" — a hung controller must
+// not shield itself with its last word.
+func TestSupervisor_UnresponsiveStaleBusyFileDoesNotShield(t *testing.T) {
+	s, ex, _, clk := unrespServer(t, "unhealthy")
+	ex.busy = clk.t.Add(-10*time.Minute).Format(time.RFC3339) + "\nan app update is running\n"
+	sweep(s, controllerUnresponsiveRestart)
+	if n := ex.count(9201); n != 1 {
+		t.Fatalf("a stale busy file blocked the restart: %d restarts", n)
+	}
+}

internal/selfupdate/commit.go

@@ -128,4 +128,11 @@ func (m *Manager) MaybeCommit(ctx context.Context) {
 	if m.onCommitted != nil {
 		m.onCommitted(ctx)
 	}
+	// R-1368 part 2: the update ended healthy — the folder keeps the running version's binary and no other
+	// (prune.go). A refusal or a failed removal is logged and changes nothing about the commit.
+	if removed, err := pruneStaged(m.stateDir, m.runningVersion, m.logger); err != nil {
+		m.logger.Warn("selfupdate: old staged binaries NOT removed after the commit", "err", err)
+	} else if len(removed) > 0 {
+		m.logger.Info("selfupdate: old staged binaries removed after the commit", "count", len(removed), "kept", "felhom-agent-"+m.runningVersion)
+	}
 }

internal/selfupdate/executor.go

@@ -103,6 +103,9 @@ func (e *Executor) Execute(ctx context.Context, op string, params json.RawMessag
 	}
 	e.logger.Debug("agent_update: op invariants passed (semver + sha format)", "version", p.Version)
 
+	// The staged file is this call's from the download to the hand-off: a prune (prune.go) waits for it.
+	stagingMu.Lock()
+	defer stagingMu.Unlock()
 	dir := stagingDir(e.stateDir)
 	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return fmt.Errorf("agent_update: staging dir: %w", err)

internal/selfupdate/prune.go

@@ -0,0 +1,96 @@
+package selfupdate
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"sync"
+)
+
+// The self-update folder keeps what it needs and no more (R-1368 part 2; space list 2026-11-10, place H12).
+//
+// WHAT WAS WRONG. Execute downloads each new agent to <StateDir>/selfupdate/felhom-agent-<version> and removes that
+// file only when the download or its checksum fails. A good update left it there for ever: measured 2026-11-10, 49 /
+// 48 / 33 binaries = 740 / 724 / 509 MB on demo-hp, demo-felhom and Tester 1 — one for each version the box ever got.
+//
+// WHAT THE FOLDER IS NEEDED FOR. The root wrapper (felhom-os-apply, mode agent_update) reads the staged file ONCE,
+// copies it to its own root-owned folder and flips from that copy. After that hand-off nothing reads the staged file:
+//   - the rollback (felhom-selfupdate-guarded `rollback`) needs two files and neither is a staged binary:
+//     `pending.json` in this folder, and `/usr/local/bin/felhom-agent.prev` outside it;
+//   - the commit needs `pending.json` only.
+//
+// So a staged binary is dead weight as soon as its update ended. Pinned by TestPrune_RollbackReadsNoStagedBinary (the
+// wrapper's text) and TestPrune_RealRollbackStillWorksAfterNUpdates (the wrapper's rollback verb, run for real).
+//
+// THE RULE. After an update ended HEALTHY (the wrapper's `commit` returned success), remove every staged binary but
+// the one of the running version. Nothing is removed:
+//   - while a pending marker exists or cannot be read — an update is in flight, and that is the only time a rollback
+//     can fire;
+//   - after a rollback, or at a plain start — only the commit path calls this, so the binary of a version that failed
+//     stays for the operator to look at until the next good update;
+//   - that is not a regular file with exactly the name Execute gives a staged binary. `pending.json`, a folder, a
+//     symlink, and any name this code does not know are never touched.
+//
+// NOT REACHED BY THIS: `/usr/local/bin/felhom-agent.bak-*` (space list H13). Those files are root-owned, in a folder
+// the agent cannot write, and no code of the agent makes them (a person's copy before a hand deploy). R-1368 part 4.
+
+// stagedNameRe is the exact name Execute gives a staged binary: "felhom-agent-" + a version that versionRe accepts.
+// Kept in step with versionRe by TestPrune_NameShapeFollowsTheVersionRule.
+var stagedNameRe = regexp.MustCompile(`^felhom-agent-([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?)$`)
+
+// stagingMu makes a download and a prune take turns. Without it a prune that runs while Execute downloads the NEXT
+// version would remove that half-written file (its name is a staged binary's and it is not the running version).
+var stagingMu sync.Mutex
+
+// pruneStaged removes the staged binaries the folder no longer needs and returns the names it removed, sorted. It
+// refuses (removes nothing, returns an error) while an update is in flight. A file it cannot remove is logged and
+// skipped: a failed clean-up must never fail the commit that came before it.
+func pruneStaged(stateDir, runningVersion string, logger *slog.Logger) ([]string, error) {
+	logger = orDefaultLogger(logger)
+	stagingMu.Lock()
+	defer stagingMu.Unlock()
+
+	if !versionRe.MatchString(runningVersion) {
+		return nil, fmt.Errorf("selfupdate prune: refusing — running version %q is not a version this code knows; it could not name the file to keep", runningVersion)
+	}
+	pm, err := readPending(stateDir)
+	if err != nil {
+		return nil, fmt.Errorf("selfupdate prune: refusing — the pending marker cannot be read: %w", err)
+	}
+	if pm != nil {
+		return nil, fmt.Errorf("selfupdate prune: refusing — an update to %s is pending (a rollback may still fire)", pm.NewVersion)
+	}
+	dir := stagingDir(stateDir)
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("selfupdate prune: read %s: %w", dir, err)
+	}
+	keep := "felhom-agent-" + runningVersion
+	var removed []string
+	for _, ent := range entries {
+		name := ent.Name()
+		if name == keep || !stagedNameRe.MatchString(name) {
+			continue // the running version's binary, pending.json, or a name this code does not know
+		}
+		if !ent.Type().IsRegular() {
+			logger.Warn("selfupdate prune: a staged-binary name that is not a regular file — left alone", "name", name, "type", ent.Type().String())
+			continue
+		}
+		// name came from ReadDir and matched stagedNameRe, so it holds no path separator: this is one exact file.
+		if err := os.Remove(filepath.Join(dir, name)); err != nil {
+			logger.Warn("selfupdate prune: cannot remove an old staged binary — left for the next good update", "name", name, "err", err)
+			continue
+		}
+		logger.Debug("selfupdate prune: removed an old staged binary", "name", name)
+		removed = append(removed, name)
+	}
+	sort.Strings(removed)
+	logger.Info("selfupdate prune: the self-update folder holds what it needs", "kept", keep, "removed", len(removed))
+	return removed, nil
+}

internal/selfupdate/prune_test.go

@@ -0,0 +1,373 @@
+package selfupdate
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// R-1368 part 2 — the self-update folder keeps what it needs and no more (prune.go).
+//
+// RED-PROOFS (each observed 2026-11-10, then restored):
+//   - drop the pruneStaged call from MaybeCommit → TestPrune_AfterNUpdatesTheFolderHoldsOneBinary fails with
+//     "after update 1 (0.170.0) the folder holds [… felhom-agent-0.169.0 felhom-agent-0.170.0 …]", and
+//     TestPrune_RealRollbackStillWorksAfterNUpdates fails too;
+//   - drop the pending-marker refusal from pruneStaged → TestPrune_RefusesWhileAnUpdateIsPending fails with
+//     "removed [...] while an update was pending";
+//   - drop the IsRegular check → TestPrune_AfterNUpdatesTheFolderHoldsOneBinary fails with "a symlink with a
+//     staged-binary name was removed".
+
+// committingWrapper is the guarded wrapper's `commit` as far as this package can see it: it clears the pending marker.
+type committingWrapper struct {
+	stateDir string
+	calls    int
+}
+
+func (w *committingWrapper) Run(_ context.Context, _ string, args ...string) ([]byte, []byte, error) {
+	if len(args) == 1 && args[0] == "commit" {
+		w.calls++
+		if err := os.Remove(pendingPath(w.stateDir)); err != nil {
+			return nil, []byte(err.Error()), err
+		}
+	}
+	return []byte("ok"), nil, nil
+}
+
+func stage(t *testing.T, stateDir, version string) {
+	t.Helper()
+	if err := os.MkdirAll(stagingDir(stateDir), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(stagingDir(stateDir), "felhom-agent-"+version), []byte("binary "+version), 0o755); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func folder(t *testing.T, stateDir string) []string {
+	t.Helper()
+	ents, err := os.ReadDir(stagingDir(stateDir))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []string
+	for _, e := range ents {
+		out = append(out, e.Name())
+	}
+	sort.Strings(out)
+	return out
+}
+
+// The consequence: after N good updates the folder holds ONE staged binary — the running version's — and every file
+// that is not a staged binary is still there.
+func TestPrune_AfterNUpdatesTheFolderHoldsOneBinary(t *testing.T) {
+	stateDir := t.TempDir()
+	dir := stagingDir(stateDir)
+	if err := os.MkdirAll(dir, 0o750); err != nil {
+		t.Fatal(err)
+	}
+	// Bystanders: names this code does not know, and two things that carry a staged binary's NAME but are not files.
+	outside := filepath.Join(t.TempDir(), "precious")
+	if err := os.WriteFile(outside, []byte("not ours"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range []string{"notes.txt", "felhom-agent-0.1.0.partial", "felhom-agent.bak-0.139.0"} {
+		if err := os.WriteFile(filepath.Join(dir, n), []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.Mkdir(filepath.Join(dir, "felhom-agent-9.9.9"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(dir, "felhom-agent-8.8.8")); err != nil {
+		t.Fatal(err)
+	}
+	bystanders := []string{"felhom-agent-0.1.0.partial", "felhom-agent-8.8.8", "felhom-agent-9.9.9", "felhom-agent.bak-0.139.0", "notes.txt"}
+
+	versions := []string{"0.170.0", "0.171.0", "0.172.0", "0.172.1", "0.173.0-rc.1", "0.173.0"}
+	prev := "0.169.0"
+	stage(t, stateDir, prev) // what an old agent left behind
+	for i, v := range versions {
+		stage(t, stateDir, v)                                                                                   // Execute downloaded it
+		writePending(t, stateDir, PendingMarker{OldVersion: prev, NewVersion: v, SHA256: "ab", AppliedAt: "t"}) // the wrapper flipped
+		wrap := &committingWrapper{stateDir: stateDir}
+		m := newMgr(t, stateDir, v, wrap, nil)
+		m.MaybeCommit(context.Background())
+		if wrap.calls != 1 {
+			t.Fatalf("update %d (%s): commit calls = %d, want 1", i+1, v, wrap.calls)
+		}
+		want := append([]string{"felhom-agent-" + v}, bystanders...)
+		sort.Strings(want)
+		got := folder(t, stateDir)
+		if strings.Join(got, " ") != strings.Join(want, " ") {
+			if _, err := os.Lstat(filepath.Join(dir, "felhom-agent-8.8.8")); err != nil {
+				t.Fatalf("a symlink with a staged-binary name was removed: %v", err)
+			}
+			t.Fatalf("after update %d (%s) the folder holds %v, want %v", i+1, v, got, want)
+		}
+		prev = v
+	}
+	if b, err := os.ReadFile(outside); err != nil || string(b) != "not ours" {
+		t.Fatalf("the file behind the symlink changed: %q %v", b, err)
+	}
+}
+
+// While an update is pending — the only time a rollback can fire — nothing is removed.
+func TestPrune_RefusesWhileAnUpdateIsPending(t *testing.T) {
+	stateDir := t.TempDir()
+	for _, v := range []string{"0.170.0", "0.171.0", "0.172.0"} {
+		stage(t, stateDir, v)
+	}
+	writePending(t, stateDir, PendingMarker{OldVersion: "0.171.0", NewVersion: "0.172.0", SHA256: "ab", AppliedAt: "t"})
+	before := folder(t, stateDir)
+
+	removed, err := pruneStaged(stateDir, "0.172.0", nil)
+	if err == nil || len(removed) != 0 {
+		t.Fatalf("removed %v while an update was pending (err=%v) — want a refusal", removed, err)
+	}
+	if got := folder(t, stateDir); strings.Join(got, " ") != strings.Join(before, " ") {
+		t.Fatalf("removed %v while an update was pending; folder now %v", before, got)
+	}
+
+	// The same through the commit path: a `commit` that reports success but leaves the marker (fakeWrapper does) must
+	// not lead to a prune.
+	m := newMgr(t, stateDir, "0.172.0", &fakeWrapper{}, nil)
+	m.MaybeCommit(context.Background())
+	if got := folder(t, stateDir); strings.Join(got, " ") != strings.Join(before, " ") {
+		t.Fatalf("the commit path pruned with the marker still there; folder now %v", got)
+	}
+
+	// A marker nobody can read is a refusal too.
+	if err := os.WriteFile(pendingPath(stateDir), []byte("{not json"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if removed, err := pruneStaged(stateDir, "0.172.0", nil); err == nil || len(removed) != 0 {
+		t.Fatalf("an unreadable marker must refuse; removed %v err=%v", removed, err)
+	}
+}
+
+// Only a commit prunes: a plain start, a version mismatch and a failed commit remove nothing — so the binary of a
+// version that was rolled back stays for the operator.
+func TestPrune_OnlyAHealthyCommitPrunes(t *testing.T) {
+	cases := []struct {
+		name    string
+		pending *PendingMarker
+		running string
+		wrap    WrapperRunner
+	}{
+		{"plain start, no marker (also the state after a rollback)", nil, "0.171.0", &fakeWrapper{}},
+		{"marker names another version", &PendingMarker{OldVersion: "0.171.0", NewVersion: "0.172.0"}, "0.171.0", &fakeWrapper{}},
+		{"commit fails", &PendingMarker{OldVersion: "0.171.0", NewVersion: "0.172.0"}, "0.172.0", &fakeWrapper{err: fmt.Errorf("sudo: no")}},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			stateDir := t.TempDir()
+			for _, v := range []string{"0.170.0", "0.171.0", "0.172.0"} {
+				stage(t, stateDir, v)
+			}
+			if c.pending != nil {
+				writePending(t, stateDir, *c.pending)
+			}
+			before := folder(t, stateDir)
+			newMgr(t, stateDir, c.running, c.wrap, nil).MaybeCommit(context.Background())
+			if got := folder(t, stateDir); strings.Join(got, " ") != strings.Join(before, " ") {
+				t.Fatalf("folder changed without a healthy commit: %v → %v", before, got)
+			}
+		})
+	}
+	// A running version this code cannot name a file for: refuse, do not guess.
+	stateDir := t.TempDir()
+	stage(t, stateDir, "0.170.0")
+	if removed, err := pruneStaged(stateDir, "dev", nil); err == nil || len(removed) != 0 {
+		t.Fatalf("running version \"dev\" must refuse; removed %v err=%v", removed, err)
+	}
+}
+
+// The name rule and the version rule say the same thing: every name Execute can write is a name the prune knows, and
+// nothing else is.
+func TestPrune_NameShapeFollowsTheVersionRule(t *testing.T) {
+	for _, v := range []string{"0.70.1", "0.172.1", "10.0.0", "0.70.2-crash", "0.173.0-rc.1"} {
+		if !versionRe.MatchString(v) {
+			t.Fatalf("test input %q is not a version versionRe accepts", v)
+		}
+		if !stagedNameRe.MatchString("felhom-agent-" + v) {
+			t.Errorf("Execute can stage felhom-agent-%s but the prune does not know that name", v)
+		}
+	}
+	for _, n := range []string{"pending.json", "felhom-agent", "felhom-agent-", "felhom-agent-1.2", "felhom-agent-0.1.0.partial",
+		"felhom-agent.bak-0.139.0", "felhom-agent.prev", "felhom-agent-0.1.0/x", "../felhom-agent-0.1.0", "felhom-agent-0.1.0 ", "xfelhom-agent-0.1.0"} {
+		if stagedNameRe.MatchString(n) {
+			t.Errorf("the prune would treat %q as a staged binary", n)
+		}
+	}
+	m := stagedNameRe.FindStringSubmatch("felhom-agent-0.173.0-rc.1")
+	if m == nil || !versionRe.MatchString(m[1]) {
+		t.Fatalf("the version part of a staged name must satisfy versionRe; got %v", m)
+	}
+}
+
+func wrapperText(t *testing.T) string {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("..", "..", "configs", "felhom-selfupdate-guarded"))
+	if err != nil {
+		t.Fatalf("the guarded wrapper is the other half of this proof and must be readable: %v", err)
+	}
+	return string(b)
+}
+
+// The stated dependency, pinned: the wrapper's `rollback` and `commit` read the pending marker and `.prev`, and no
+// staged binary. If either verb starts to read the staging folder, this fails and prune.go's rule must be looked at.
+func TestPrune_RollbackReadsNoStagedBinary(t *testing.T) {
+	s := wrapperText(t)
+	for _, want := range []string{"\nBIN=/usr/local/bin/felhom-agent\n", "\nPREV=$BIN.prev\n", "\nSTAGING=/var/lib/felhom-agent/selfupdate\n", "\nPENDING=$STAGING/pending.json\n"} {
+		if !strings.Contains(s, want) {
+			t.Fatalf("the wrapper no longer holds the line %q — the folder's rule (prune.go) was written against it", strings.TrimSpace(want))
+		}
+	}
+	for _, verb := range []string{"commit", "rollback"} {
+		i := strings.Index(s, "\n"+verb+")\n")
+		if i < 0 {
+			t.Fatalf("no %s) block in the wrapper", verb)
+		}
+		block := s[i:]
+		j := strings.Index(block, "\n    ;;\n")
+		if j < 0 {
+			t.Fatalf("no end of the %s) block", verb)
+		}
+		block = block[:j]
+		if !strings.Contains(block, "$PENDING") {
+			t.Fatalf("%s) does not read $PENDING any more", verb)
+		}
+		code := regexp.MustCompile(`(?m)^\s*#.*$`).ReplaceAllString(block, "")
+		for _, bad := range []string{"STAGING", "staged", "felhom-agent-"} {
+			if strings.Contains(code, bad) {
+				t.Fatalf("%s) now mentions %q — it may read a staged binary, and the prune removes those", verb, bad)
+			}
+		}
+	}
+	if stagedNameRe.MatchString("pending.json") || stagedNameRe.MatchString("felhom-agent.prev") {
+		t.Fatal("the prune would remove a file the rollback needs")
+	}
+}
+
+// The consequence, with the wrapper's own code: after N good updates (each committed by the REAL `commit` verb and
+// pruned), update N+1 goes bad and the REAL `rollback` verb puts the previous binary back. The wrapper runs from a copy
+// whose four fixed paths point into a temp folder; systemctl, logger and chown are stubs.
+func TestPrune_RealRollbackStillWorksAfterNUpdates(t *testing.T) {
+	sh, err := exec.LookPath("sh")
+	if err != nil {
+		t.Skip("no sh on this machine")
+	}
+	root := t.TempDir()
+	stateDir := filepath.Join(root, "state")
+	binDir := filepath.Join(root, "bin")
+	stubs := filepath.Join(root, "stubs")
+	for _, d := range []string{stagingDir(stateDir), binDir, stubs, filepath.Join(root, "rootstaging")} {
+		if err := os.MkdirAll(d, 0o750); err != nil {
+			t.Fatal(err)
+		}
+	}
+	live := filepath.Join(binDir, "felhom-agent")
+	s := wrapperText(t)
+	for old, repl := range map[string]string{
+		"\nBIN=/usr/local/bin/felhom-agent\n":                    "\nBIN=" + live + "\n",
+		"\nSTAGING=/var/lib/felhom-agent/selfupdate\n":           "\nSTAGING=" + stagingDir(stateDir) + "\n",
+		"\nROOT_STAGING=/var/lib/felhom-os-apply/agent-update\n": "\nROOT_STAGING=" + filepath.Join(root, "rootstaging") + "\n",
+	} {
+		if strings.Count(s, old) != 1 {
+			t.Fatalf("the wrapper's path line %q is not there exactly once — this test cannot sandbox it", strings.TrimSpace(old))
+		}
+		s = strings.Replace(s, old, repl, 1)
+	}
+	// Safety: no assignment in the copy may still point at a real system path (PREV and PENDING are built from BIN and
+	// STAGING, so they follow).
+	for _, line := range strings.Split(s, "\n") {
+		if regexp.MustCompile(`^[A-Z_]+=/`).MatchString(line) && !strings.Contains(line, root) {
+			t.Fatalf("the sandboxed wrapper still holds a real path: %q", line)
+		}
+	}
+	script := filepath.Join(root, "wrapper.sh")
+	if err := os.WriteFile(script, []byte(s), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	stubLog := filepath.Join(root, "stub.log")
+	for _, n := range []string{"systemctl", "logger", "chown", "systemd-run"} {
+		body := "#!/bin/sh\necho \"" + n + " $*\" >> '" + stubLog + "'\nexit 0\n"
+		if err := os.WriteFile(filepath.Join(stubs, n), []byte(body), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	run := func(verb string) (string, error) {
+		cmd := exec.Command(sh, script, verb)
+		cmd.Env = []string{"PATH=" + stubs + ":/usr/bin:/bin"}
+		out, err := cmd.CombinedOutput()
+		return string(out), err
+	}
+	// applied is what the wrapper's `apply` leaves behind (it needs root, so the test writes the same four things).
+	applied := func(oldV, newV string) {
+		cur, err := os.ReadFile(live)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(live+".prev", cur, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(live, []byte("binary "+newV), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		writePending(t, stateDir, PendingMarker{OldVersion: oldV, NewVersion: newV, SHA256: "ab", AppliedAt: "t"})
+	}
+	if err := os.WriteFile(live, []byte("binary 0.169.0"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	prev := "0.169.0"
+	for _, v := range []string{"0.170.0", "0.171.0", "0.172.0", "0.172.1"} {
+		stage(t, stateDir, v)
+		applied(prev, v)
+		m := newMgr(t, stateDir, v, runnerFunc(func(args ...string) ([]byte, []byte, error) {
+			out, err := run(args[0])
+			return []byte(out), nil, err
+		}), nil)
+		m.MaybeCommit(context.Background()) // the REAL commit verb, then the prune
+		if got := folder(t, stateDir); len(got) != 1 || got[0] != "felhom-agent-"+v {
+			t.Fatalf("after the good update to %s the folder holds %v", v, got)
+		}
+		prev = v
+	}
+
+	// Update N+1 is applied and goes bad: systemd's OnFailure runs the wrapper's rollback.
+	stage(t, stateDir, "0.173.0")
+	applied("0.172.1", "0.173.0")
+	out, err := run("rollback")
+	if err != nil {
+		t.Fatalf("the real rollback verb failed after the prunes: %v\n%s", err, out)
+	}
+	if b, _ := os.ReadFile(live); string(b) != "binary 0.172.1" {
+		t.Fatalf("after the rollback the live binary is %q, want the previous version's", b)
+	}
+	if p, _ := readPending(stateDir); p != nil {
+		t.Fatal("the rollback left the pending marker")
+	}
+	if b, _ := os.ReadFile(stubLog); !bytes.Contains(b, []byte("systemctl restart felhom-agent.service")) {
+		t.Fatalf("the rollback did not restart the agent; stub log:\n%s", b)
+	}
+	// The rolled-back agent starts: no marker, so no commit and no prune — the bad version's binary stays to be read.
+	newMgr(t, stateDir, "0.172.1", &fakeWrapper{}, nil).MaybeCommit(context.Background())
+	if got := folder(t, stateDir); strings.Join(got, " ") != "felhom-agent-0.172.1 felhom-agent-0.173.0" {
+		t.Fatalf("after the rollback the folder holds %v, want the running version and the one that failed", got)
+	}
+}
+
+// runnerFunc adapts a function to WrapperRunner; it gets the verb arguments only.
+type runnerFunc func(args ...string) ([]byte, []byte, error)
+
+func (f runnerFunc) Run(_ context.Context, _ string, args ...string) ([]byte, []byte, error) {
+	return f(args...)
+}

scripts/retention-policy.json

@@ -24,10 +24,10 @@
   "readers": [
     "scripts/check-published-versions.py — asserts the newest N versions plus every pinned version"
   ],
-  "recorded": "2026-10-27",
-  "recorded_by": "CC 2026-10-27: day0_agent 0.167.0 (operator vouch 2026-10-27, read from the hub: version + agent and bundle sha256 match the release); earlier 0.166.0 (vouch 2026-10-26 10:04:55 CET); D50 = A (operator 2026-10-25); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)",
+  "recorded": "2026-11-10",
+  "recorded_by": "CC 2026-11-10: day0_agent 0.173.0 (operator vouch 2026-11-10 16:29:16 CET, read from the hub log: agent=0.173.0, bundle 51ebc1f4… = the release; the save took 232 ms); earlier 0.172.1 (CC 2026-11-07) (operator vouch 2026-11-07 ~23:00 CET, read from the hub DB with its WAL: artifact_agent_version=0.172.1, bundle 3e7acaee… = the release); earlier 0.172.0 (CC 2026-11-03) (operator vouch 2026-11-03 10:18:10 CET, read from the hub log and DB: agent=0.172.0, bundle cc34b0bc… = the release); earlier 0.171.0 (CC 2026-10-30) (operator vouch 2026-10-30 10:47:36 CET, read from the hub log: agent=0.171.0, bundle 95f977f6… = the release; the save took 132 ms with hub 0.178.0, R-1346); earlier 0.170.0 (operator vouch 2026-10-29 18:57:48 CET, read from the hub log: agent=0.170.0, bundle 03f2ff64… = the release; the save took 38.3 s, R-1346); earlier 0.169.0 (operator vouch 2026-10-29 14:06:09 CET, read from the hub log: agent=0.169.0, bundle 3ca33f9c… = the release; his browser got a 504 but the save went through); earlier 0.168.0 (vouch 10:21:56 CET); 0.167.0 (vouch 2026-10-27); 0.166.0 (vouch 2026-10-26 10:04:55 CET); D50 = A (operator 2026-10-25); earlier history: R-287 (2026-08-09), R-291 (2026-10-05)",
   "pinned": {
     "hub_min_agent": "0.158.1",
-    "day0_agent": "0.167.0"
+    "day0_agent": "0.173.0"
   }
 }