felhom.eu/REPORT.md

REPORT — the operator's answers built; the kernel lane spiked with real reboots (2026-10-07 day)

Part	Result
A — rulings	09 §3 decisions 162–170 recorded first, plus 171 (reboots without a per-reboot word, never DooPlex). R-822 closed by ruling. R-836 → P2. Shared rule file: no hub build/deploy without the operator (all five copies identical)
B — Proxmox package lane (R-812 A)	built (agent pve layer + /etc/pve write gate; hub candidate/approval/System page), delivered, proven live on demo-felhom: one signed step, 65 packages in 70 s, pve-manager 9.2.2 → 9.2.21, healthy, guest untouched, app 31/31; hub logged it. R-812 closed
C — agent image check (R-861 (a) A1, (b) B2)	built, delivered to the three boxes; on demo-hp: no tee grant, the verb is the route, an alpine ref refused (rc 3, file unchanged), felhom-op's pct lines exact. Not seen: a full managed swap (no newer controller today)
D — RESET purge + clean-up (R-32)	purge through the sub-account's own login built and delivered (hub 0.142.0). The one-time clean-up STOPPED: ~2.7 GB belongs to no live customer, reachable only by the pool box's main account — no such login on DooPlex
E — other-key archives line (R-366 slice 2)	built and delivered; R-366 closed
F — retire the empty fields (R-105)	built and delivered (columns kept, unread); 05/06 corrected; R-105 closed
G — kernel spike (R-836)	24 reboots + 2 power cycles on Tester 1 (VM), demo-felhom, demo-hp (Secure Boot on). ESP one-shot flag: works on all three. UEFI BootNext: works on all three. A watchdog armed by systemd: fails on all three (a reset clears the timer; a frozen kernel needs a person). Design with two operator questions: audits/kernel-spike-2026-10-07/DESIGN-kernel-lane.md. Boxes left clean on a healthily booted default
H — Tester 2 (read only)	the household got 0 mails while the box was off (operator 10); no row

Rows before	Rows after	Opened	Closed
130	126	0	4 (R-822, R-812, R-366, R-105)

Releases (one per repo changed): hub 0.142.0 (live, healthz 200 within 50 s); agent 0.151.0 + bundle on demo-hp, demo-felhom, Tester 1 (probe 68/68 each). The agent vouch was refused by the hub (golden_behind_fleet: golden 0.301.0 is behind the fleet's controller 0.302.0), so new installs keep agent 0.150.0 until the weekly bake. No controller release (no controller code changed). CI: one lost job (felhom.eu run 1497, every step failed with no log) re-run once → success (R-887 count +1).

Helpers: each prompt carried the brief's fences in full (rule 11). Security note on hub/internal/api/handler.go (raised by a background review, no detail): the last three changes log box/customer ids and counts only — nothing fixed.

Teardown: Tester 1 — spike entries, ESP flag, BootNext loader/entry and watchdog config removed; VM 341's test watchdog device removed; default 7.0.2-6 (running). demo-felhom — the same; default 7.0.2-6; Proxmox userspace now 9.2.21. demo-hp — the same; default 7.0.14-20. 7.0.14-20 is installed on Tester 1 and demo-felhom (booted healthily in the spike) but not their default. Hub — nothing provisioned.

Two decisions for you

1. The kernel lane's promise: may a box restart at night for a kernel update, and do we tell the household? My pick: yes, with one line in the household's mail the day before. If you do nothing: kernels stay manual.
2. The pool box clean-up (~2.7 GB): give me the pool box's main-account login for one session, or delete the folders yourself in the Hetzner console. My pick: you delete them in the console (no new credential on DooPlex). If you do nothing: the leftovers stay; nothing reads them.