# REPORT — R-1285: the BYO SSH clean-up in the same update — committed, NOT released (2026-10-26 afternoon)

**Plain words first.** A BYO box coming from 0.164.0 kept our SSH file one release too long: in the normal update the
OLD agent installs the config bundle, so the new agent's clean-up pass never ran on it. Now the new agent runs that pass
once, right after its self-update commits. Not released today (operator: „not today"); its live proof needs a BYO box on
0.164.0, which rides the next agent release.

## The fix (`b1bc63d`, CI 2363 ✓)

- `internal/selfupdate/commit.go`: `Manager.SetOnCommitted` — a hook run once after „update committed".
- `internal/osupdate/bundle.go`: `ConfigUpdateExecutor.PolicyPassAfterUpdate` (the wrapper's `bundle-policy` mode, host
  layer, no envelope); `cmd/felhom-agent/main.go` `wireBundlePolicyAfterCommit` hooks it on.
- The smaller of the two fixes: agent-only — holding the bundle job until the commit would need new hub queue logic.

## Proof

- `cmd/felhom-agent/r1285_policy_after_commit_test.go`, in the real order: a pending marker for the running version →
  `commit`, then exactly one `bundle-policy` plan; no marker / a mismatched marker → nothing. Red-proved (the hook call
  removed → commit only, no pass — the demo-hp symptom of 2026-10-26).
- **Not live:** only a box coming FROM 0.164.0 can show it (0.165.0's wrapper already applies D43 at plan time), which
  needs a signed downgrade chain on a BYO box.