R-840/R-859/R-860 records: 11 §5.3.1 + §5.4.2, 03, 04, 00; runbooks config-bundle + os-updates-test-waits; register 333→334 (R-840/859/860 closed, R-861/862 opened); STATUS; report; evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/r840-config-bundle-2026-10-04/partB/b5-installer-path-demo-felhom.txt

@@ -0,0 +1,10 @@
+[OK]   verified sha256 8d7273cf5313ef62… matches the hub manifest
+  os-apply: BUNDLE START agent=0.143.0 sha=8d7273cf5313ef62 authority=installer files=22 write=0 same=21 kept=1 skipped=0
+  os-apply: BUNDLE DONE agent=0.143.0 written=0 same=21 self-check=ok signers-created=False
+[OK]   installed every root-owned file from config bundle v0.143.0 (sha 8d7273cf5313ef62…; checked, previous copies kept)
+[OK]   OOB felhom-sshd instance + static belt from the bundle (agent renders config + fills sets once oob.enabled)
+rc=0
+record: 0.143.0 installer 2026-10-04T18:21:38Z
+active
+active
+active

documentation/audits/r840-config-bundle-2026-10-04/partB/b6-demo-hp-change-undo-replay.txt

@@ -0,0 +1,13 @@
+Oct 04 20:34:35 demo-hp felhom-os-apply[586963]: os-apply: BUNDLE START agent=0.143.0 sha=8d7273cf5313ef62 authority=signed files=22 write=1 same=20 kept=1 skipped=0
+Oct 04 20:34:35 demo-hp felhom-os-apply[586964]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (replaced)
+Oct 04 20:34:35 demo-hp felhom-os-apply[587062]: os-apply: BUNDLE DONE agent=0.143.0 written=1 same=20 self-check=ok signers-created=False
+Oct 04 20:34:35 demo-hp felhom-agent[447632]: time=2026-10-04T20:34:35.913+02:00 level=WARN msg="osupdate: config bundle INSTALLED" op=agent_config_update agent_version=0.143.0 bundle="{\"agent_version\": \"0.143.0\", \"authority\": \"signed\", \"kept\": [\"/etc/felhom/crash-guard.conf\"], \"prev_di
+Oct 04 20:34:36 demo-hp felhom-agent[447632]: time=2026-10-04T20:34:36.833+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=71 total=71 degraded=""
+Oct 04 20:34:36 demo-hp felhom-agent[447632]: time=2026-10-04T20:34:36.834+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=6c544b5b813d1d8b op=agent_config_update
+Oct 04 20:34:36 demo-hp felhom-agent[447632]: time=2026-10-04T20:34:36.841+02:00 level=WARN msg="signedjobs: REJECTED signed op — executor not called" job=2a21233745459c0a op=agent_config_update reason=rejected err="authz: replay (nonce already seen): nonce eb8a8219c7ab393e6702dc8a34cc578f"
+
+esac
+b71d869871efae6d13e8dc0809b7ce112d2c0051333e55af0af35d5a4fee506e  /usr/local/sbin/felhom-backup-target-apply
+record: 0.143.0 signed 2026-10-04T18:34:35Z
+20261004T181935Z-before-0.143.0-r840test
+20261004T183435Z-before-0.143.0

documentation/audits/r840-config-bundle-2026-10-04/partD/d2-system-page-after-start.txt

@@ -0,0 +1,17 @@
+ Approved releases 
+ docker : os-docker-20261004-142842 
+ 6 packages · 2026-10-04 14:28 UTC · by operator 
+ Cancelled approvals (last 7 days) 
+ host : os-host-20261004-124133 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ host : os-host-20261004-124034 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-guest-20261004-123933 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-20261004-091417 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ What ring 0 runs now 

documentation/audits/r840-config-bundle-2026-10-04/partE/e8-live-heal-demo-hp-9201.txt

@@ -0,0 +1,49 @@
+perl: warning: Setting locale failed.
+perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
+live-restore=true
+containers: 21
+T0 18:23:33 systemctl restart docker.socket
++11s controller->docker=
+BLIND traefik_inode=18453 host=41134
++16s controller->docker=
+BLIND traefik_inode=18453 host=41134
++21s controller->docker=
+BLIND traefik_inode=18453 host=41134
++26s controller->docker=
+BLIND traefik_inode=18453 host=41134
++31s controller->docker=
+BLIND traefik_inode=18453 host=41134
++37s controller->docker=
+BLIND traefik_inode=18453 host=41134
++42s controller->docker=
+BLIND traefik_inode=18453 host=41134
++47s controller->docker=
+BLIND traefik_inode=18453 host=41134
++52s controller->docker=
+BLIND traefik_inode=18453 host=41134
++57s controller->docker=
+BLIND traefik_inode=18453 host=41134
++62s controller->docker=
+BLIND traefik_inode=18453 host=41134
++68s controller->docker=
+BLIND traefik_inode=18453 host=41134
++73s controller->docker=
+BLIND traefik_inode=18453 host=41134
++78s controller->docker=
+BLIND traefik_inode=18453 host=41134
++83s controller->docker=
+BLIND traefik_inode=18453 host=41134
++88s controller->docker=29.8.2 traefik_inode=18453 host=41134
++94s controller->docker=29.8.2 traefik_inode=18453 host=41134
++99s controller->docker=29.8.2 traefik_inode=18453 host=41134
++104s controller->docker=29.8.2 traefik_inode=18453 host=41134
++109s controller->docker=29.8.2 traefik_inode=18453 host=41134
++114s controller->docker=29.8.2 traefik_inode=18453 host=41134
++120s controller->docker=29.8.2 traefik_inode=41134 host=41134
+HEALED
+== ids before vs after (empty = none changed)
+containers after: 21
+2026/10/04 18:23:43 sockheal.go:118: [WARN] [sockheal] Docker refuses the socket (dial unix /var/run/docker.sock: connect: connection refused) — exiting after 1m0s of refusals so Docker restarts this controller on the current socket (R-860)
+2026/10/04 18:24:58 sockheal.go:123: [ERROR] [sockheal] Docker has refused the socket for 1m15s (dial unix /var/run/docker.sock: connect: connection refused) — the socket file was re-created and this container holds the old one; EXITING (code 75) so Docker's restart policy brings it back on the current socket (R-860)
+2026/10/04 18:25:29 sockheal.go:155: [WARN] [sockheal] traefik holds an old docker socket (inode 18453, current 41134) — restarting it (R-860)
+2026/10/04 18:25:30 sockheal.go:160: [INFO] [sockheal] traefik restarted onto the current docker socket

documentation/audits/r840-config-bundle-2026-10-04/partG/g5-wgsync-after.txt

@@ -0,0 +1,4 @@
+2026/10/04 20:25:03 [INFO] wgsync: pushed 4 peers to 167.233.158.164:22
+2026/10/04 20:30:03 [INFO] wgsync: pushed 4 peers to 167.233.158.164:22
+2026/10/04 20:35:03 [INFO] wgsync: pushed 4 peers to 167.233.158.164:22
+wg_peers BEFORE the delete (hub DB copy 16:55 UTC): 5 ['10.77.0.2', '10.77.0.250', '10.77.0.3', '10.77.0.4', '10.77.0.5']

documentation/audits/r840-config-bundle-2026-10-04/partH/h1-vouch.txt

@@ -0,0 +1,2 @@
+Location: /configuration?flash=artifacts_set
+2026/10/04 20:21:14 [INFO] Artifact manifest set: agent=0.143.0 golden=0.293.0 min_agent="0.131.0" wrapper_sha=false bundle_sha="8d7273cf5313ef62b867cb6f831c631923a436452d6f90b8ff7f0771170396ba"

documentation/audits/r840-config-bundle-2026-10-04/partH/h2-install-manifest.json

@@ -0,0 +1,14 @@
+{
+    "agent": {
+        "version": "0.143.0",
+        "sha256": "41c0d3060013dfda795262147454248149bee0888c0935170fdb85de6e7a35da"
+    },
+    "golden": {
+        "version": "0.293.0",
+        "sha256": "e7966872abeb38db320e7b26bd9baf6527e87270ed2faf3f0e53763bfc4764b7"
+    },
+    "bundle": {
+        "version": "0.143.0",
+        "sha256": "8d7273cf5313ef62b867cb6f831c631923a436452d6f90b8ff7f0771170396ba"
+    }
+}