felhom.eu/REPORT.md

REPORT — the kernel lane, 2026-10-07 (evening)

Part	Result
Rulings	Decisions 172 (kernel lane yes: A + C, night restarts, household mailed the day before, a freeze needing a person accepted) and 173 (R-32 leftovers left; P2 → P4, blocked on a safe main-account path) recorded FIRST (0c5dbfbf).
A — the one-shot boot	Done. Wrapper layer kernel (agent v0.152.0) + the two GRUB generators in the bundle (option C on the one-shot entry only). Red tests first-class: a box without the ESP flag refused (R20), a kernel outside the set refused (R23), the snippet clears the flag before booting, an install never moves the default. Red-proof audits/kernel-lane-2026-10-07/A/redproof.txt (16 mutations, each red).
B — boot good, the self-revert	Done. Health = the host rule + the hub reached, 20 min (measured: all healthy 68 s after a reboot on demo-felhom, 272 s on demo-hp; the spike's > 6 min Tailscale delay did not recur — no row). A box that never returns raises the hub's existing host_stale at 45 min and host_down at 90 min. One self-revert per step. Crash guard: a step adds at most ONE unclean boot (a panic before userspace adds none) — pinned by KernelStepCannotLeaveTheBoxOff, and seen live (0 counted after the panic).
C — night slot, approval, System page	Done. The kernel step ends the night leg (after a healthy host step, after the backup, trigger night, once per night); ring 1 stages only by a signed job. Hub v0.143.0 (deployed with you attending): due boxes, "Approve kernel set", two System page cells. 11 §5.11 + §8 step 6 written.
D — the household mail	Done. One mail the day before, 09:00–20:00 Budapest, its language, registered address; tonight only after the mail service accepted it (no mail, no step). Sent for real to demo-felhom at 18:12 (Gmail). Parity green (both locales; tests).
E 1 — Tester 1 by hand	PASS ×3 (audits/kernel-lane-2026-10-07/E/RESULT.md): forced panic → back on the old kernel by itself (screens); held guest → judged 20 min → one self-revert; healthy → 7.0.14-22 the default. Tester 1 left on 7.0.14-22 (healthy, default).
E 2 — option C	Unmeasured: the Proxmox kernel has no lockup test module (CONFIG_TEST_LOCKUP not set). No tool built.
E 3 — ring-0 night run	Not yet — next session. Tonight demo-felhom was told about 7.0.14-20 (from last night's report) but its sources now offer 7.0.14-22: the step will refuse (R23) before any change (R-898). demo-hp's lists were a day old. Both demo boxes are due for 7.0.14-22 on the night 2026-10-08→09.
E 4 — Tester 1 as ring 1	Not yet (after E3; Tester 1 already runs 7.0.14-22, so the ring-1 proof needs the next kernel).
Small	R-861 (a): no controller release in this arc — not read back. Tailscale delay: not reproduced → no row.

Rows: 126 before → 128 after. Opened 2 (R-897, R-898). Closed 0.

Releases: agent v0.152.0 (tag d03ab7f; binary 95ff4220…, bundle f0c2cec3…, step bundle 0.152.0-step1 0b71d32b…), delivered by signed jobs to demo-hp, demo-felhom and Tester 1 (binary → step bundle → bundle). Hub v0.143.0 (ab3b7ea2, deployed 0ece2ff7 15:39, Synced/Healthy). The installer's uninstall now knows the two GRUB files (unreleased, no tag cut). Nothing on ep0, Tester 2 or DooPlex's own system; no Docker engine step; no delivery after 02:00.

Read for this report: 11-os-updates.md (§5.3, §5.8–5.10, §8.2 — §5.11 new), 03-host-agent.md, 07 §6.1, audits/kernel-spike-2026-10-07/DESIGN-kernel-lane.md.

Also seen: the hub image was built while one audit text file (outside hub/) was uncommitted; the build copies hub/ only, and hub/ equalled the pushed commit (checked by diff). R-897: after demo-hp's timing reboot, one app's backup failed in the second the agent re-bound the drive.

The household mail (both languages, as sent)

Hungarian — subject: [Felhom] Ma éjjel újraindul a Felhom dobozod

Szia!

Ma éjjel a Felhom dobozod egy biztonsági frissítés miatt újraindul. Ilyenkor az alkalmazásaid néhány percig nem érhetők el, utána maguktól visszajönnek. Neked nem kell semmit tenned.

Ha reggelre a doboz mégsem érhető el: húzd ki a tápkábelét, várj 10 másodpercet, és dugd vissza. A doboz ilyenkor magától a korábbi, bevált rendszerrel indul el.

Ha ez sem segít, válaszolj erre a levélre, és segítünk.

Üdv, Felhom.eu

English — subject: [Felhom] Your Felhom box restarts tonight

Hi,

Tonight your Felhom box restarts for a security update. Your apps will be away for a few minutes, then come back by themselves. You do not need to do anything.

If the box is not back by morning: unplug its power cable, wait 10 seconds, and plug it back in. The box then starts its earlier, proven system by itself.

If that does not help, reply to this e-mail and we will help.

Best, Felhom.eu

Decisions for you

1. Is the mail text right? My pick: keep it. If you do nothing: it goes out as written.
2. Mail time window 09:00–20:00, at most 3 mails per kernel. My pick: keep (decided by me, you may reverse). If you do nothing: it stays.