felhom.eu/REPORT-backup-close-os-spike-2026-10-04.md

# REPORT — off-site topic closed; operating-system update spike — 2026-10-04 (day)

Architecture read: `07-backup-architecture.md` (Lane 2, §6.1), `_recovery-inventory-2026-07-28.md`, `03-host-agent.md`,
`09` §3/§4, `11-os-updates.md`. Baselines (re-verified): felhom.eu `d07a1a904cbf` (hub 0.128.0), controller
`99a149756070` (0.290.0), agent `d766666ff8cf` (0.138.0), catalog `917a779cca67`. Register 328, highest R-834.
Rulings recorded first as `09` §3 decisions 75–77 and `11` committed verbatim (`3885640`). Evidence:
`documentation/audits/backup-close-2026-10-04/` and `documentation/audits/os-updates-spike-2026-10-04/`.

## The Part table

| Part | Result | Notes |
|---|---|---|
| A — restored guest safe by default (R-834) | **done** | Routes: restore-test (MEASURED safe: onboot 0 and throwaway mp8/mp9 on every poll), DR bring-up (**fixed**: refuses beside a live original — agent v0.139.0, refused live on demo-hp, nothing created), hand route (**new** `scripts/felhom-restore-beside.sh`, proven live on 9298 then destroyed), provisioning (golden, no binds). 4 tests, 2 red-proofs + 1 built-in. **Changed:** no sudoers line — the restore-test sets onboot 0 through the API, and DR refuses rather than degrades. |
| B — clean-up cannot wedge (R-833) | **done** | Hub v0.129.0 deployed. 4 red-proofs. Lab proof on a real restic 0.14.0 repo: 98 → 13 under a raised cap, default refused before, normal after. Live: 4 bad grants refused (400). **Changed:** no valid grant placed on a real customer — a demo box would consume it (brief: lab repo only). No controller change needed. |
| C — returning household (R-726) | **done** | Two options in STATUS; pick A. Nothing built. |
| D — dated check (R-95) | **done** | Due 2026-10-12, four checks named in R-95. |
| E — where we stand | **done** | 5 systems surveyed read-only (throwaway apt indexes). |
| F — exact version later | **done** | madison host + guest; DSA history 3 months; snapshot.debian.org from a throwaway container on 9202. |
| G — guest update on 9202 | **done, one deviation** | **Changed:** 9202 is on `dir` storage and cannot snapshot, so the undo was a backup + restore (73 s); the snapshot rollback is unmeasured (R-837). G3 interrupted the update straight after the undo (the "apply again" happened as G3's repair) — the same update could not be interrupted once applied. |
| H — host update on demo-hp | **done** | Debian lane 108 packages, 60 s, guests up. One-package undo: rsync gone, libpng worked. Kernel: two reboots on the operator's word — new kernel, then fallback to old. Proxmox simulated only. |
| I — design record | **done** | `11` corrected (C1–C12), wrapper draft §5.4.1, answers §7.1, sample list (157 packages) simulated on demo-felhom, Q10 price recorded. Two STATUS decisions. |

## Claims that turned out wrong (named)

1. **"Debian's archives keep only the newest version"** (`11` §5.3) — they keep two: the point-release one and the newest security one; intermediates are gone (C2).
2. **"Proxmox and Docker keep older ones"** — true, measured: 30–66 and 18–46 versions.
3. **"`--next-boot` falls back by itself"** (`11` §5.6) — only after a boot that reaches userspace; on GRUB it is an ordinary default; a hang keeps the new kernel (code-read). And installing a kernel alone makes it the default (C4).
4. **"The guest has no `live-restore`"** — true. But `live-restore` is the answer to Q3, and switching it off again is a trap (C5, R-835).
5. **"The agent may not run `apt` except for `dnsmasq`"** — it may also install `wireguard-tools` (C1).
6. **"The restore-test guest is safe today"** — TRUE, measured (onboot 0, no host bind). The unsafe routes were the DR bring-up and the hand route.
7. Also wrong in `11`: the slow-lane list by name (40 Proxmox packages have plain names, C3); `cloudflared` "on the host" (it is a guest container, C8); approving what ring 0 installed (C9); a fast-lane run is "a service restart at most" — libc leaves PID 1 and `lxc-start` on the old library (C11).

## Found and handled in-session

- My own output filter dropped every line containing "perl" — including "paperless". A false "the app vanished" was caught before acting on it; evidence files were saved unfiltered.
- `pkill -f dpkg-deb` killed my own shell during G3 (the known trap); the kill itself had landed, and the state was read in a fresh command.
- The first Docker probe counted 302/404 answers as down; re-counted from the raw probe files with "no answer" as down.
- A `pgrep` waiter matched itself and never ended (the known trap); it was harmless and killed by its timeout.

## Rows

Closed: **R-833, R-834**. Opened: **R-835** (live-restore off trap), **R-836** (kernel hang keeps new kernel), **R-837**
(snapshot undo unmeasured), **R-838** (cloudflared pinned since June, P2), **R-839** (boot sweep held an app whose
`HDD_PATH` names its folder). Narrowed: **R-812** (spike done), **R-95** (dated check), **R-726** (waiting on the
operator). Register **328 → 331**.

## Teardown, three layers

- **Machines:** scratch VMIDs 990000 (restore-test, torn down by the agent) and 9298 (destroyed); no 9297 was created.
  9202: Debian fully updated, Docker 29.8.2 / containerd 2.3.6 (golden 0.290.0's), `daemon.json` byte-identical to the
  baked one, all apps healthy; its backup deleted; the `debian:trixie` probe image removed. **demo-hp host:** 108 Debian
  packages + kernel `7.0.14-20-pve` installed (110 changes, `partH/H-final-host-packages-after.tsv`); **running
  `7.0.2-6-pve`, next boot `7.0.14-20-pve`, no pins**; 78 Proxmox packages still pending. demo-felhom: read only (its
  agent updated to 0.139.0 by signed job). Helper files removed from every host and guest.
- **Host (DooPlex):** the lab restic repo removed; scratch copies of the hub password and the DSA list shredded. Agent
  0.139.0 released (tag + package, verified by download), not vouched.
- **Hub:** v0.129.0 deployed; no grant left pending; weekly windows unchanged (ON).