docs: v0.86.0 live floor-test results — auto-update 0.86.0→0.87.0 (auto-floor)

REPORT/CHANGELOG: dogfood 0.85.1→0.86.0 (Phase 1 endpoint), global floor 0.87.0,
auto-update fired (initiated_by=auto-floor, success), no-flap at floor confirmed,
hub controller_version=0.87.0. Demo left at 0.87.0 / floor 0.87.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

CHANGELOG.md

@@ -24,9 +24,10 @@
   no-floor inert; floor>latest→no chase + warn; no-flap (one swap across repeated reconciles); raised-floor
   honored (Scenario C/E); dev/no-agent→no-op. **Companion red-proof (verified):** making `MaybeAutoUpdate`
   always no-op fails the below-floor test → restored → green.
-- **No agent change** (reuses Phase 1 swap). Live: dogfood-deployed 0.86.0 to demo 9201 via the Phase 1
-  button, then floor set to 0.87.0 → box auto-updated 0.86.0 → 0.87.0 with no click; at/above-floor no-op
-  confirmed (see REPORT.md).
+- **No agent change** (reuses Phase 1 swap). Live (demo 9201): dogfood-deployed 0.86.0 via the Phase 1
+  self-update (the exact endpoint the Settings button invokes), then global floor set to 0.87.0 → the box
+  auto-updated 0.86.0 → 0.87.0 with **no click** (`last_state.initiated_by="auto-floor"`, success);
+  at/above-floor produced **no second update** (no flap). Hub `controller_version`=0.87.0. See REPORT.md.
 
 ### v0.85.1 — version-only build (live self-update validation target) (2026-06-26)
 - No code change vs v0.85.0. Pushed as the registry "latest" so the live e2e self-update path could be

REPORT.md

@@ -39,9 +39,34 @@ nothing, no chasing a non-existent image). Rollback on failure is Phase 1's (the
 - **Companion red-proof (verified):** forcing `MaybeAutoUpdate` to always no-op →
   `TestMaybeAutoUpdate_BelowFloor_UpdatesToFloor` FAILS (pulled "", 0 swaps) → restored → green.
 
-## Live test — floor auto-update 0.86.0 → 0.87.0 on demo 9201
-<!-- LIVE-RESULTS -->
-_(Filled after the live run — see the "Build / deploy / LIVE test" section below.)_
+## Live test — floor auto-update 0.86.0 → 0.87.0 on demo 9201 — PASS
+
+**Sequence (all live on `felhom-pve` guest 9201 + hub on k3s):**
+1. Built/pushed hub `0.15.0` + controller `0.86.0`; deployed hub via ArgoCD.
+2. **Dogfood deploy (Phase 1 still works):** triggered the controller's self-update via the exact
+   endpoint the Settings button invokes (`POST /api/selfupdate/update`, hub-key bearer, in-guest) → the
+   demo went **0.85.1 → 0.86.0** (in-guest pull → agent swap → healthy). This put the floor-reading code
+   on the box.
+3. Built/pushed a trivial **0.87.0** (version-only) as the auto-update target.
+4. **Set the floor:** global floor → **0.87.0** via `DEFAULT_MIN_CONTROLLER_VERSION` on the hub (the
+   implemented global-floor mechanism; the operator-UI form is password-gated, which I'm not permitted to
+   submit — the form handlers are covered by hub unit/render tests). Hub logged
+   `Default controller-version floor: 0.87.0`.
+5. **Auto-update fired (Scenario A):** on the demo's next report (forced immediately by restarting the
+   controller, which performs a startup hub report) the ACK carried `min_controller_version=0.87.0`; the
+   controller saw current `0.86.0 < 0.87.0` and **auto-updated to 0.87.0 with no click**.
+   - Proof (`/api/selfupdate/status` `last_state`): `previous_version=0.86.0`, `target_version=0.87.0`,
+     `status=success`, **`initiated_by="auto-floor"`**, completed 10:15:42Z.
+   - Host-side: container `…:0.87.0 Up (healthy)`; `/etc/felhom-controller-image = 0.87.0`.
+   - Hub-side: `reports.controller_version` for demo-felhom = **0.87.0** (verified via sqlite on the
+     copied DB; temp copy deleted afterwards).
+6. **No flap / at-or-above floor (Scenario B):** forced another report with the box now at 0.87.0
+   (== floor) → **no second update**: image stayed `…:0.87.0` healthy, and `last_state.initiated_at`
+   was **unchanged** (still 10:15:37Z). The floor does not re-trigger when at/above.
+
+**End state (left consistent, per spec):** demo 9201 at **0.87.0**; global floor **0.87.0** persisted in
+`manifests/hub.yaml` (`DEFAULT_MIN_CONTROLLER_VERSION`), hub Synced/Healthy. Only demo-felhom reports
+(peti-felhom is config-only) so the global floor has no other effect.
 
 ## What was NOT done
 - No agent binary change (reuses Phase 1 swap). The customer latest-only button is untouched. No new