docs: §13.2 wizard leg COMPLETE (offered/enrolled/formatted via operator UI + GO; pipeline-level teardown, boxes as found) + Day-0 manifest vouched 0.87.0; cross-ref the two controller bugs the leg surfaced (0.126.3/0.126.4)

CONTEXT.md

@@ -16,8 +16,10 @@
   conservatism (any unresolvable slave → ok=false → unchanged all-system path); signature test
   `TestSystemDisks_WalkTopologies` (root-backing disk ALWAYS system — never weaken). §3 spike
   transcripts: drill (legacy) dm-1→sda3→sda; felhom-pve (EFI+LVM) ESP+walk agree on sda →
-  byte-identical regression. OPEN at ship time: §13.2 wizard live leg (hot-added scratch disk,
+  byte-identical regression. §13.2 wizard leg COMPLETE (offered → enrolled → formatted →
-  Viktor session + GO before format) + Day-0 manifest bump to 0.87.0 (operator UI).
+  torn down, boxes as found) + Day-0 manifest vouched to 0.87.0 (operator). The leg also
+  surfaced two CONTROLLER bugs (fixed same-day: v0.126.3 claimed-box wizard CSRF, v0.126.4
+  502-through-CF + native-alert ban).
 
 - **v0.83.0** (2026-07-11, LIVE on felhom-pve; NOT published — Peti stays 0.81.0) — **observability
   pass** (pairs with controller v0.116.1 + hub v0.46.0). `applog.New` → `(logger, *Ring)`: slog

REPORT.md

@@ -80,13 +80,24 @@ Full suite: `go test ./...` green (all packages; recovery-code flake did not fir
   (creds from the 180 docker-config, out-of-band). felhom.eu disposition note:
   `documentation/audits/DISPOSITION-ia-finding2-systemdisks-2026-07-13.md` (commit `74fa61c`).
 
-## STOPPED for Viktor (per the task's STOP)
+## §13.2 wizard live leg — COMPLETE (operator session + GO; finished same day)
 
-1. **13.2 wizard live leg** — hot-add the 5 GB scsi scratch disk to the drill PVE VM (qm 300 on
+- Wizard **OFFERED** the hot-added 5 GB disk (Üres — formázható) on the legacy-boot drill box —
-   felhom-pve), then through YOUR logged-in dashboard session (no gate-lift): wizard OFFERS the
+  the exact pre-fix dead end. Operator enrolled + formatted through the REAL UI flow
-   disk → enroll + format (GO required before format) → unenroll/detach, leave as found.
+  (mount name enroll-test, ext4, default): "A meghajtó sikeresen inicializálva és regisztrálva:
-2. **Day-0 manifest bump** to agent 0.87.0 (hub operator UI, password-gated) + the IA audit doc
+  /mnt/felhom-drives/enroll-test"; storage page showed the drive Active/Default, role
-   finding-2 disposition line (felhom.eu).
+  Felhasználói adat, uuid durable-id. (First attempt hit the controller-side CSRF bug on
+  claimed-box wizard pages → fixed as controller v0.126.3, unrelated to the agent.)
+- **Teardown (leave as found):** decommission attempted through the UI → correctly REFUSED by
+  the controller's M1 guard (last usable drive; the refusal surfaced badly → controller
+  v0.126.4 fixed the 502-through-Cloudflare + native-alert classes). Teardown completed at
+  pipeline level: agent `/disks/decommission` (guest token) → ok (logical retire per design;
+  the raw mount/unit intentionally stays for re-enroll — removed manually as the "physical
+  removal" step), controller registry entry removed (0 storage paths — the pre-enroll state),
+  mount unit stopped + file removed, `qm disk unlink 300 --idlist scsi1 --force` (LV
+  vm-300-disk-1 destroyed). Verified: /proc/mounts clean, candidates empty, drill gate back ON.
+- **Day-0 manifest**: vouched by the operator — agent **0.87.0**, sha `2447d4a3…dc7a`
+  (hub Configuration screenshot; golden 0.120.0 + MinAgent 0.81.0 unchanged).
 
 ## Observations