felhom-host-install.sh 1.36.0 (pushed, NOT published — the tag waits for the operator's yes): the uninstall removes the root-SSH drop-in, a failed reload warns (R-982, D4, reviewed v2 patch)

scripts/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2026-10-23 — felhom-host-install.sh 1.36.0 (pushed; the tag `installer-v1.36.0` waits for the operator's yes): the uninstall removes the root-SSH drop-in (R-982, D4)
+
+The agent's config bundle (next agent release) gives the host's own sshd `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf`
+(`PermitRootLogin prohibit-password`, operator ruling D4 2026-10-22). The uninstall gives the host back as Proxmox set it
+up: when the file exists it is removed and sshd is reloaded with `systemctl try-reload-or-restart ssh`; a failed reload
+is a `log_warn` (the file is gone, sshd reads it at its next start). Idempotent (`-f` guard), honours `--dry-run`.
+`test_hostinstall.py` lists the path in `BUNDLE_DESTS`, so the bundle list and the uninstall stay in step. The patch
+was reviewed on 2026-10-23 night (A5) and proven by hand on a fresh install (felhom.eu `audits/night-2026-10-22/P2-D4/`,
+`audits/night-2026-10-23/P4-testnight/03-…`). Tests 40/40.
+
 ## 2026-10-20 — the status page gate, warn-first until 2026-10-27 (`status_view_gate.py`, R-1174)
 
 New gate `scripts/status_view_gate.py`, registered in `repo_gates.py` (FAST set: pre-push hook and CI). It checks root

scripts/felhom-host-install.sh

@@ -194,7 +194,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.35.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
+SCRIPT_VERSION="1.36.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
                           # The hub used to carry a copy for its Setup tab; R-94 DELETED it
                           # (2026-08-02) because the hub cannot know which version a box runs —
                           # the Setup command fetches this script at run time. scripts/
@@ -1417,6 +1417,12 @@ run_uninstall() {
     if [[ -f /etc/default/grub.d/zz-felhom-kernel-default.cfg ]]; then
         log_info "  kept /etc/default/grub.d/zz-felhom-kernel-default.cfg (the kernel this box booted healthily stays the default)"
     fi
+    # R-982 (operator ruling D4, 2026-10-22; agent bundle after v0.162.0): the host sshd's root-key-only drop-in. The
+    # uninstall gives the host back as Proxmox set it up, so the drop-in goes and sshd is reloaded (open sessions stay).
+    if [[ -f /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf ]]; then
+        run rm -f /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
+        run systemctl try-reload-or-restart ssh 2>/dev/null || log_warn "  sshd was not reloaded — the drop-in is gone, sshd reads it at its next start (R-982)"
+    fi
     # 1.31.0 (R-840): the bundle's previous copies and the wrapper's nonce record.
     if [[ -d /var/lib/felhom-os-apply ]]; then run rm -rf /var/lib/felhom-os-apply; fi
     if [[ -f /var/lib/vz/snippets/felhom-guest-hook.sh ]]; then run rm -f /var/lib/vz/snippets/felhom-guest-hook.sh; fi

scripts/test_hostinstall.py

@@ -60,6 +60,7 @@ BUNDLE_DESTS = [
     "/etc/systemd/system/felhom-sshd.service",
     "/etc/felhom-oob.nft",
     "/etc/systemd/system/felhom-oob-nft.service",
+    "/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf",   # R-982, operator ruling D4 (2026-10-22)
     "/etc/sudoers.d/felhom-op",
     "/etc/sudoers.d/felhom-agent",
 ]