OS updates guest fast lane: records — 11 §8.1 BUILT, 03 cloudflared corrected, 07 §6.1 OS leg, 00 PARTIAL, monthly runbook infra pins, golden 0.291.0 record + vouch, register 331 -> 333 (R-837/838/726/843 closed; R-840/841/842/844/845 opened), STATUS, report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/11-os-updates.md

@@ -2,7 +2,7 @@
 
 > | | |
 > |---|---|
-> | **Status** | **NOT RATIFIED — a PROPOSAL with one operator ruling, corrected by the 2026-10-04 spike (§7.1, corrections C1–C12 below).** Ratification is Viktor's review, not an editor's. |
+> | **Status** | **NOT RATIFIED — a PROPOSAL with operator rulings, corrected by the 2026-10-04 spike (§7.1, C1–C12); §8 step 2 BUILT 2026-10-04 (§8.1).** Ratification is Viktor's review, not an editor's. |
 > | **Written** | 2026-10-04, by the reviewer (project Claude), before any spike. |
 > | **Verified against** | felhom.eu `d07a1a9` · felhom-controller `99a1497` (v0.290.0) · felhom-agent `d766666` (v0.138.0) · hub v0.128.0 |
 > | **Freshness** | **CURRENT** as of 2026-10-04. The spike `TASK-backup-close-and-os-updates-spike-2026-10-04` adds measurements here as `[FACT]` and corrects every claim it disproves. Mark this file STALE when it falls behind what the product does. |
@@ -403,7 +403,8 @@ not covered: 79 Proxmox + 1 Tailscale on the host (slow lane / not ours), 6 Dock
 Each step returns to the operator for go or no-go.
 
 1. **Spike** (measure Q1–Q10; no product code).
-2. **Guest Debian, fast lane.** Lowest risk: a snapshot undo exists.
+2. **Guest Debian, fast lane.** ~~Lowest risk: a snapshot undo exists.~~ **BUILT 2026-10-04** — agent v0.140.0, hub
+   v0.130.0, installer 1.29.0; §8.1. **There is no snapshot undo** (R-837, measured).
 3. **Host Debian, fast lane** (no kernel, no Proxmox packages).
 4. **Fleet view and alarms** (§5.7).
 5. **Slow lane: Docker engine.**
@@ -412,6 +413,47 @@ Each step returns to the operator for go or no-go.
 
 ---
 
+### 8.1 Step 2 as BUILT (2026-10-04)  `[FACT]`
+
+Evidence: `audits/os-guest-lane-2026-10-04/` (parts A–G). Brief: guest fast lane, decisions 78–80 (`09` §3).
+
+- **The undo (R-837, measured first): none automatic.** PVE refuses ANY snapshot of a customer guest —
+  `PVE/AbstractConfig.pm:755-757` skips non-snapshot mounts only for a snapshot named `vzdump`, and every customer
+  guest carries the host-path binds mp8/mp9. As the agent's token and as root: `snapshot feature is not available`.
+  The token's role HAS `VM.Snapshot` / `VM.Snapshot.Rollback`. So §5.6's first row does not exist: a failed health
+  check stops, reports `health_failed`, and the hub mails the operator; the whole-guest backup taken minutes earlier
+  is the undo, by hand. The choice of a real undo is in STATUS (R-842).
+- **The wrapper** `felhom-os-apply` (agent repo `configs/`), Python 3 stdlib, per §5.4.1 with refusals R1–R13 (R12:
+  the host layer; R13: dpkg still broken after the repair). **Changed from the draft** *(decided by CC unattended —
+  operator may reverse)*: one sudoers entry (`--plan <file>`); the plan's `mode` field (`inventory` / `apply` /
+  `health`) replaces a separate `--repair-only` (the repair runs first on every apply); Python, because a JSON plan
+  cannot be parsed safely in sh. The box's own customer guest is "the guest that binds `/mnt/felhom-drives`" (R10).
+- **The leg** (agent `internal/osupdate`): after a SUCCESSFUL primary whole-guest backup, inside the backup's
+  goroutine before the host-wide heavy-op gate is released (so never beside a backup or a restore-test, C10), 90 s
+  after the backup, at most once per 20 h. *Decided by CC unattended — operator may reverse:* the 90 s settle and the
+  20 h gap; the controller's own self-update (04:30) is not detected — the 5-minute health wait absorbs a restart.
+- **The health rule** (`HealthVerdict`, pinned): docker answers, the guest resolves `deb.debian.org`, the controller's
+  health check is `healthy`, and every container running at the START of the leg runs again (healthy if it was). The
+  baseline merges the inventory's reading with the apply's own — found live: an app stopped between them escaped the
+  first rule. Wait 5 min, poll 15 s.
+- **Rings and the switch** (hub, per box): ring 0 = demo-hp + demo-felhom, everything else ring 1; switch ON by
+  default; OFF → the box reports, installs nothing. A box with no `os_update` block (older hub) = ring 1, ON, no
+  release.
+- **The approval rule (the ruled "1–2 day wait")**: every Debian / Debian-Security package=version that ALL ring-0
+  boxes having it agree on; approved when, since that set was first seen, **24 h** passed with every ring-0 report
+  healthy and every ring-0 box completed **1** post-backup night run (`OS_APPROVE_AFTER`, `OS_APPROVE_NIGHTS`; an
+  override is logged as a TEST configuration). The approval time is the snapshot.debian.org timestamp (decision 79).
+  "Approve now" is an operator event. *The 24 h / 1 night numbers: decided by CC unattended within the ruled 1–2 days.*
+- **The household's line**: hub event `os_update_applied` (info: on the household's hub timeline, never mailed;
+  hu/en in the bundle). There is no surface on the box itself (R-844).
+- **Measured live**: ring 0 — 53 Debian packages on each demo box (18.7–31.7 s inside the wrapper; 174–226 s for the
+  whole leg incl. the inventory), healthy, 6 Docker updates "not covered"; approval — with a 2-minute TEST wait, a
+  272-package release approved automatically, then the ruled values restored; ring 1 — demo-felhom installed exactly
+  the 3 approved versions it lacked (269 already current) and left the newer Docker packages alone; a deliberately
+  stopped app → `health_failed` after 5 min, the operator mailed, the household line recorded.
+- **Not delivered to existing boxes by the product**: the wrapper and the sudoers line reach a box only through the
+  installer; the signed agent update replaces the binary only (R-840). The demo boxes got them BY HAND.
+
 ## 9. Where the rest lives
 
 - The finding: **R-812** (`backlog/OPEN-ITEMS.md`). The intention: **R-808** (`backlog/ROADMAP.md`).