# REPORT — v0.174.0 released, vouched and delivered to the three test boxes (2026-11-14, attended)

**Plain words first.** A box now removes its old kernels by itself, and it reloads its security profiles after it
starts on another kernel. Version 0.174.0 is released and runs on Tester 1, demo-hp and the N100. The operator vouched
it at 15:21 CET. The N100's time service runs again; the product repaired it, with no hand step.

The full report of the run is in `felhom.eu`: `REPORT-release-2a-2026-11-14.md`.

## What a reader must know

1. **The clean-up runs on a box with the root-owned ring-0 mark only.** Tester 1 has no mark, so the program answers
   „not run" there. For the proof the operator allowed the mark on Tester 1 for some minutes; it is back as before.
2. **The real removal on Tester 1 was started by hand**, with the agent's own command line. The night leg cannot be
   started by day: it follows only the night's own backup (R-899). So „the step by the agent at night" is **not proven
   yet**; the N100's and demo-hp's night of 2026-11-15 is the proof.
3. **The profile refresh was spiked first** on demo-hp (felhom.eu `audits/profile-refresh-spike-2026-11-14/`). Three
   things it found are built in: a stale copy is told by the cached file changing, not by the kernel's hash; one
   profile never compiles the same twice; a refresh hides other kernel audit lines for a few seconds.
4. **A clock step makes the controller read a new boot** (felhom.eu R-1395, a controller row): on the N100 it
   recreated three apps once.

| | |
|---|---|
| Version | 0.174.0, sha256 `6efbb97809135483bc446d71d1321f9e2f7fc3268fe9b20e7fe742a2eb13db92`, bundle `7d87d0584dee79eee766f01c27b9e89273d39c89a14b0725a6e5564a55b3ec5f`, Go 1.27.4 |
| Code commit, CI | `cc63dd5`, run id 2641 success |
| Tests | wrapper 191 (42 new), agent `internal/osupdate` green; 30 mutations, each seen red (felhom.eu `audits/release-2a-2026-11-14/A`, `B`) |
| Tester 1 | 3 kernels → 2, 1.12 GB gained, 8.5 s; second run: nothing; one restart, same kernel, healthy, clean stop |
| demo-hp | nothing to remove; refusals P1, P2, P3 by dry run |
| The N100 | time service repaired (offset −32.55 s → +0.18 s); tonight it removes 6 of 8 kernels |
| Vouch | the operator, 2026-11-14 15:21:45 CET; `pinned.day0_agent` = 0.174.0 |
| Not proven | the step at night by the agent; a fell-back box and a self-revert into the kept kernel on a box; K1 on a box |