register: 9 closed (R-493/495/496/512/513/514/515/517/523), 9 opened (R-525..R-533), R-509/510/511/518 narrowed; ISO 1.27.1 publish record; website changelog; P1-fixes evidence

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/tests/iso-release-1.27.1-2026-09-14/README.md

@@ -1,7 +1,16 @@
 # ISO release gate — felhom-installer-1.27.1 (2026-09-14)
 
-**NOT PUBLISHED — awaiting the operator's yes.** Built and gated; the proof installs and the first-hour walk are Phase 4 of the
-doorstep task; publishing waits for the operator's yes (task Phase 5 STOP).
+**PUBLISHED 2026-09-15 08:45Z** on the operator's yes (decision 2026-09-15), by the P1-fixes task, from the exact file
+gated here. Round trip over the real URL, 2026-09-15 08:45:55Z: `https://iso.felhom.eu/felhom-installer-1.27.1-pve9.2-1.iso`
+→ **1 705 322 496 B, sha256 `25637007…c053`** (identical to the row below); `.sha256` → 200 (103 B); `.manifest.txt` →
+200 (1 914 B). **Rollback is one link change:** `felhom-installer-1.26.1-pve9.2-1.iso` (+ `.sha256`, manifest) stays online
+and was listed in the bucket before the upload. The download page `https://felhom.eu/letoltes` answered 200 naming 1.27.1
+and the sha at 08:46:41Z. **G11 PASS** (above). **G12 NOT MEASURED:** the object-scoped token cannot read bucket settings
+(`ListBuckets` 403s); `iso.felhom.eu/` and `/index.html` still 404, consistent with no public bucket listing — an
+inference, not a measurement. **No git tag moved:** R-110 governs the host installer (`installer-v*`), which this ISO
+does not change; nothing was re-tagged.
+
+*Previously:* NOT PUBLISHED — awaiting the operator's yes (doorstep task Phase 5 STOP).
 
 | | |
 |---|---|
@@ -26,8 +35,8 @@ against the exact output file, stock ISO `proxmox-ve_9.2-1.iso` for the enumerat
 | G8 postinst | **PASS** | forbidden systemctl verbs `0`, network tools `0`, `set -e` `0`, last line `exit 0` |
 | G9 payload = HEAD | **PASS** | `felhom-bootstrap.sh` `973f0c8f…9dd6` = repo; `.service` `cf2e4678…9af3` = repo |
 | G10 committed | **PASS** | `scripts/iso/` porcelain empty; `HEAD == origin/main` |
-| G11 round trip | *publish-time* | — |
-| G12 bucket private | *publish-time* | — |
+| G11 round trip | **PASS (2026-09-15)** | downloaded bytes sha256 `25637007…c053`, 1 705 322 496 B = built file |
+| G12 bucket private | **NOT MEASURED** | token is object-scoped (`ListBuckets` 403); root and `/index.html` 404 |
 | G13 directories | **PASS** | `./etc/felhom/`, `./usr/local/sbin/`, `./lib/systemd/system/` each `1` |
 | G14 a person chooses the disk | **static half PASS** | no answer file (G1), `filter.` keys `0`; the proof-install half is the walk |
 | G15 console after first boot + reboot | **PASS (live, VM 332)** — first boot Felhom-only (screen `332-b12`); proven reboot (boot 16:14:11Z > `qm reboot` 16:13:56Z); `pvebanner` `masked` → `/dev/null`; `/etc/issue` 0 × `8006`; postinst log shows both acts | `systemctl mask pvebanner.service` present; issue text names `8006` `0`; see `audits/evidence-doorstep-walk-1270-2026-09-14/G15-live-332-iso1271.txt` |