R-858 closed (agent v0.142.1, ruling 95): the Docker step restarts the socket users; incident evidence; STATUS; report addendum

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i4-ring0-mark-off.txt

@@ -0,0 +1,4 @@
+felhom-pve: {"host_id":"demo-felhom-8363b5","ring0_slow_lane":false}
+felhom-pve: 644 root
+demo-hp: {"host_id":"demo-hp-bb76ea","ring0_slow_lane":false}
+demo-hp: 644 root

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i5-wrapper-copied.txt

@@ -0,0 +1,2 @@
+demo-hp wrapper (R-858 fix, pre-release) bdf60f5c79a84db7
+demo-felhom wrapper v0.142.1 bdf60f5c79a84db7

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i6-proof-undo.txt

@@ -0,0 +1,8 @@
+time=2026-10-04T18:02:51.747+02:00 level=WARN msg="signedjobs: AUTHORIZED signed op — executing" job=2f5f79f8a5c22923 op=os_docker_step key_id=felhom-op-1 nonce=f0715c2a4d18668ca2de50258f4ea07c
+os-apply: SOCKET-USERS restarted=felhom-controller,traefik rc=0 (R-858: they held the old docker socket)
+time=2026-10-04T18:04:05.435+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: SOCKET-USERS restarted=felhom-controller,traefik rc=0 (R-858: they held the old docker socket)"
+time=2026-10-04T18:04:05.466+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=2f5f79f8a5c22923 op=os_docker_step
+controller sees engine 29.7.2
+guest socket: 12159  controller: 12159  traefik: 12159
+felhom-controller Up 17 minutes (healthy)
+traefik Up 17 minutes

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i7-redproofs.txt

@@ -0,0 +1,5 @@
+[CAUGHT] socket users restarted after a step: DockerLane.test_step_restarts_only_the_socket_users rc=1
+[CAUGHT] only socket users, not every container: DockerLane.test_step_restarts_only_the_socket_users rc=1
+[CAUGHT] controller reach check in health: DockerLane.test_health_says_when_the_controller_cannot_reach_docker rc=1
+[CAUGHT] health rule fails a blind controller (Go)
+after restore: ok  	gitea.dooplex.hu/admin/felhom-agent/internal/osupdate	0.730s

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i8-proof-forward.txt

@@ -0,0 +1,8 @@
+time=2026-10-04T18:04:05.435+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: SOCKET-USERS restarted=felhom-controller,traefik rc=0 (R-858: they held the old docker socket)"
+time=2026-10-04T18:32:54.303+02:00 level=INFO msg="osupdate: START" run=20261004T163252Z layer=docker vmid=9201 ring=0 trigger=signed enabled=true release=r858-proof-forward
+time=2026-10-04T18:34:03.314+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=r858-proof-forward layer=docker:9201 lane=slow mode=apply select=listed packages=6 authority=signed"
+time=2026-10-04T18:34:03.314+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: SOCKET-USERS restarted=felhom-controller,traefik rc=0 (R-858: they held the old docker socket)"
+controller sees engine 29.8.2
+socket guest=18453 controller=18453 traefik=18453
+2026/10/04 18:04:05 [INFO] osupdates: demo-hp-bb76ea reported docker run 20261004T160251Z: ring=0 mode=apply outcome=applied healthy=true upgraded=6 pending=6 not-covered=0 restart-needed=1 reboot-needed=false wrapper=71.6s
+2026/10/04 18:34:03 [INFO] osupdates: demo-hp-bb76ea reported docker run 20261004T163252Z: ring=0 mode=apply outcome=applied healthy=true upgraded=6 pending=0 not-covered=0 restart-needed=1 reboot-needed=false wrapper=68.9s

documentation/audits/os-docker-crash-2026-10-04/partE-incident/i9-ring0-mark-back-on.txt

@@ -0,0 +1,2 @@
+felhom-pve: {"host_id":"demo-felhom-8363b5","ring0_slow_lane":true}
+demo-hp: {"host_id":"demo-hp-bb76ea","ring0_slow_lane":true}