# REPORT — D50 retention gate, R-1280, R-1285: committed, not released (2026-10-25 night)

**Plain words first.** Three agent changes are on `main`. None is released. The release (v0.166.0) is Monday's and
waits for the operator's vouch (felhom.eu `STATUS.md`, the Monday list).

## Each change, before → after

| Row | Commit | Before | After | Proof |
|---|---|---|---|---|
| R-1290 (D50 = A) | `feaaa0e` | the published-versions gate knew no keep rule | it asserts the newest 5 released versions plus the pinned MinAgent floor (0.158.1) and the day-0 agent (0.165.0) in `scripts/retention-policy.json`; a pin with no tag fails | decoys seen failing; CI 2339 ✓ |
| R-1280 | `d912307` | a signed job's window could be any length | at most 24 h — the verifier (`ErrWindowTooLong`), the root wrapper (`MAX_WINDOW_S`) and `felhom-opsign -ttl`; exactly 24 h is accepted | red-proof; unit tests; not live |
| R-1285 | `abcc1e6` | a BYO host upgraded from an old wrapper kept our SSH drop-in until its NEXT bundle (the old wrapper planned the new bundle) | after every bundle install the agent runs the new wrapper's `bundle-policy` pass; the file is removed in one update; a failing `sshd -t` puts it back | red-proof; live on a BYO test VM: one signed run gave `BUNDLE POLICY REMOVED`; the test package was deleted after (204, then 404) |

## CI (by commit hash, `jobs` endpoint)

`feaaa0e` 2339 ✓ · `d912307` 2344 ✓ · `abcc1e6` 2345 ✓ — all `run_attempt` 1.

## Teardown

The BYO test VM (demo-hp 9372) was uninstalled through the product and destroyed. Its hub host record needs the
operator's delete (felhom.eu `STATUS.md`).

## Evidence

felhom.eu `documentation/audits/night-2026-10-25/` (`redproof-d50.txt`, `redproof-r1280.txt`, `redproof-r1285.txt`,
`rig/r1285-live.txt`).