felhom.eu/documentation/audits/day-2026-10-07/B/RESULT.md

Part B live proof — the Proxmox package lane on demo-felhom (2026-10-07 14:15 CEST)

Agent 0.151.0 + its bundle (probe 68/68), hub 0.142.0. One signed os_pve_step (the product's ring-1 path, used by hand outside 02:00–08:30; the debug selftest was NOT used because it also runs the Docker step the brief forbids). The set: 66 packages of origin "Proxmox Debian Repository" from a dry-run (B1, B2-params.json); 14 left out — shim, firmware, proxmox-first-boot, the kernel names (B2-skipped.txt).

• Journal (B6-after.txt): pve step holds the /etc/pve write gate → os-apply: START … layer=pve:9201 lane=slow select=listed packages=66 authority=signed → PLAN upgrade=65 not-installed=1 → NEW proxmox-firewall-data=0.1 (on the pve lane's allow-list) → DONE rc=0 seconds=69.6 upgraded=65 restart-needed=watchdog-mux reboot-needed=no → osupdate: DONE … outcome=applied healthy=true → released the /etc/pve write gate → signed op COMPLETED.
• pveversion: 9.2.2 → 9.2.21; running kernel unchanged (7.0.2-6).
• The guest kept running: every container's StartedAt identical before and after (B3, B6).
• opengist through traefik every 5 s: 31 of 31 answered 302 from 14:14:30 to 14:18:00 (B4-sampler-5s.log).
• Second channel, the hub's log: demo-felhom-8363b5 reported pve run 20261007T121513Z … outcome=applied healthy=true upgraded=65 (B8-hub-log.txt). The System page's pve row still reads „a ring-0 box has not reported a Proxmox step" — by design: the candidate needs every ring-0 box's pve report, and demo-hp has run none (osupdates/service.go:305-313).