felhom-agent/REPORT.md

REPORT — R-1285: the BYO SSH clean-up in the same update — committed, NOT released (2026-10-26 afternoon)

Plain words first. A BYO box coming from 0.164.0 kept our SSH file one release too long: in the normal update the OLD agent installs the config bundle, so the new agent's clean-up pass never ran on it. Now the new agent runs that pass once, right after its self-update commits. Not released today (operator: „not today"); its live proof needs a BYO box on 0.164.0, which rides the next agent release.

The fix (b1bc63d, CI 2363 ✓)

• internal/selfupdate/commit.go: Manager.SetOnCommitted — a hook run once after „update committed".
• internal/osupdate/bundle.go: ConfigUpdateExecutor.PolicyPassAfterUpdate (the wrapper's bundle-policy mode, host layer, no envelope); cmd/felhom-agent/main.go wireBundlePolicyAfterCommit hooks it on.
• The smaller of the two fixes: agent-only — holding the bundle job until the commit would need new hub queue logic.

Proof

• cmd/felhom-agent/r1285_policy_after_commit_test.go, in the real order: a pending marker for the running version → commit, then exactly one bundle-policy plan; no marker / a mismatched marker → nothing. Red-proved (the hook call removed → commit only, no pass — the demo-hp symptom of 2026-10-26).
• Not live: only a box coming FROM 0.164.0 can show it (0.165.0's wrapper already applies D43 at plan time), which needs a signed downgrade chain on a BYO box.