Night 2026-10-19: register 161 -> 161 (closed R-921, R-953, R-986; opened R-1168..R-1170; R-1001/R-1011/R-1010/R-1070/R-1167 READY, R-893 READY with the measured design note -> D20, R-1083 gap); morning list in STATUS; 03/05/07/11 updated; R-893 evidence

documentation/architecture/11-os-updates.md

@@ -724,7 +724,11 @@ Evidence: `audits/os-host-lane-2026-10-04/` (parts A–G).
   skips the host step.
 - **The host health rule** (`HostHealthVerdict`, pinned in `internal/osupdate`): `felhom-agent`, `pveproxy`,
   `pvedaemon`, `pvestatd` and `pve-cluster` are `active`; the customer guest runs; the guest health rule (§8.1)
-  passes; the tunnel is `running` — an `unknown` tunnel does not fail it, `not_running` does. Same 5-minute wait.
+  passes; the tunnel is `running` — `not_running` and `unknown` fail it (CORRECTED 2026-10-19: this line said
+  „an `unknown` tunnel does not fail it"; the code always failed it, which is what Tester4 hit, R-1070). **Since agent
+  Unreleased `56aabc7` (R-1070):** a guest with NO cloudflared container reads `absent` (Docker 29's lower-case
+  „no such object" used to fall through to `unknown`), and `absent` passes when the reading from before the step also
+  listed no cloudflared container (Docker answered) — a box with no tunnel set up. Same 5-minute wait.
 - **Separate approved sets:** host and guest releases are separate (`os-host-…`, `os-guest-…`), each by the same rule
   (24 h, 1 night of THAT layer, every ring-0 box). Ring 1 receives `host_release` beside `release`.
 - **Reboot needed:** reported when PID 1 or `lxc-start` maps a replaced file, with the date of the first scanned