docs: CAMPAIGN-6D — P-DAY0 CORE PASS (golden 0.136.0 provision drill)

Fresh nested PVE → installer v1.16.0 sha-verified agent 0.88.0 + golden 0.136.0 vs hub manifest
→ Day-0 provision SUCCESS, controller 0.136.0 healthy. Escrow correctly pending (fresh repo
password vs stale hub blob); escrow/offsite deep legs deferred (DR/PBS/WG chain, proven 07-12).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HEPuEwyyGDJdcsXLFsTWJn

documentation/audits/CAMPAIGN-6D-2026-07-15.md

@@ -51,7 +51,7 @@ phases below — none block the core promise.)
 | **P3-DELIVERY** enlarge-block | **PASS** | G4 email restored via real form; a 51 GiB sparse mandatory fixture tripped the gate at the real 50 GiB quota → immich enlargement blocked, unit-only push continues, run OK, EnlargedBlocked=["immich"], notifier edge-fires ONCE, **both operator + customer ("Kedves Ügyfél!") emails delivered**. Reverted (fixture removed, blocked-state cleared, quota untouched). |
 | **P4-DEEP** deep tiers | **PARTIAL** | **Snapshot coherence PASS** (calibre-web + immich snapshot paths == capture set, excludes excluded/optional-ro). F7 timed-cut / restic self-heal-mid-run / restore-to-verify-compare not run (timing-sensitive). |
 | **P5-REST** real crash (⚠) | **PASS** | SIGKILL host-PID mid-offbox → auto-restart ~15 s; journal marked interrupted run failed (no false success); all apps stayed up; post-crash offbox run clean (no stale lock, no marker-without-legs). |
-| **P-DAY0** golden provision | **DEFERRED** | Golden 0.136.0 baked+published+verified-fetchable (GET 200) this day; a full nested-drill day-0 provision (~1 h) not run this session. |
+| **P-DAY0** golden provision | **CORE PASS** | Fresh nested PVE (qm 300 ← pre-day0-clean) → installer v1.16.0 fetched + **sha-verified agent 0.88.0 (9c8daf94…) + golden 0.136.0 (e4b27fee…)** vs the hub manifest → "Day-0 provision SUCCESS vmid=9201 host_id=demo-vm-felhom-2f4b00" → **controller 0.136.0 Up (healthy)**, guest at-floor, scoped ACL, all installer fixes shipped (age/pbs-apply/guarded wrappers), root@pam rotated+vaulted. Snapshot `post_day0_golden136`. **Deferred** (agent-side, proven 07-12, not golden-specific): escrow auto-confirm (correctly PENDING — fresh repo password vs hub's stale blob; ceremony needs the DR/PBS/WG chain) + offsite round-trip (guest claimed → needs the dashboard password; the 0.136.0 offsite engine itself is already proven on the demo in P-IMMICH/P3-DELIVERY). |
 | **P-OBS** aggregate-state | **NOT REPRODUCED** | No Exited(0) container present on the box → the cosmetic condition is absent right now. Observation-only. |
 
 ## 3. Findings (ranked)
@@ -70,16 +70,17 @@ phases below — none block the core promise.)
 Core promise (SQ3 immich + Accept #1) **GREEN**, and the customer-facing **enlarge-block delivery chain
 (P3-DELIVERY) now PASSES** — the "Kedves Ügyfél!" email is proven end-to-end. Friend-alpha's backup-safety
 + customer-notification gates are satisfied on real data, and the **P3-BROWSER** planes (escrow
-typed-back ceremony completed, hub 8-tab ring, cross-tab session) now PASS. Remaining before recruiting
-(nice-to-have, not blocking): the **P-DAY0** golden provision as a final dress rehearsal, plus
-P-TIER2-deep / P4-timing coverage.
+typed-back ceremony completed, hub 8-tab ring, cross-tab session) now PASS. **P-DAY0 CORE also PASSES** —
+golden 0.136.0 + agent 0.88.0 provision a fresh box to a healthy controller 0.136.0 (the friend-alpha
+provisioning dress-rehearsal). Remaining (nice-to-have, not blocking): the P-DAY0 escrow/offsite deep
+legs (DR/PBS/WG chain), plus P-TIER2-deep / P4-timing coverage.
 
 ## 5. Evidence index → `180:~/campaign6/6D/evidence/`
 
 `00-preflight-gate.md`, `01-P-REG.md`, `02-box-state-reality.md`, `03-immich-prestate.manifest`,
 `04-P-FAB-export.md`, `05-P-FAB-byteidentical-diff.txt`, `06-P-FAB-import.md`, `07-P-IMMICH-offsite.md`,
 `08-P-IMMICH-restore-diff.txt`, `09-P-IMMICH-restore.md`, `10-P-PLACE.md`, `11-P5-REST.md`,
-`12-P4-DEEP-coherence.md`, `13-P3-DELIVERY.md`, `14-P3-BROWSER.md`.
+`12-P4-DEEP-coherence.md`, `13-P3-DELIVERY.md`, `14-P3-BROWSER.md`, `15-P-DAY0-install.md`.
 
 ## 6. Box / morning-recovery state
 
@@ -99,7 +100,9 @@ P-TIER2-deep / P4-timing coverage.
 ## 7. Outstanding queue
 
 - **P-TIER2** deep 4 scenarios + **P4-DEEP** timing sub-tests (F7 cut / restic self-heal / restore-verify).
-- **P-DAY0** — full nested-drill provision from golden 0.136.0.
+- **P-DAY0** remainder: escrow auto-confirm + offsite round-trip on the drill guest (needs the DR/PBS/WG
+  chain + the drill dashboard password). Drill VM qm 300 left provisioned (snapshot post_day0_golden136);
+  teardown items: stale/new hub host records for demo-vm-felhom, rotated root@pam.
 - Minor P3-BROWSER remainder: session-expiry/logout re-auth pass.
 - Signed-update train (publish agent/golden to production customers) + Peti's box — out of 6D scope.
 - LOW: duplicate recovery-unit cleanup; campaign6 autofs (host reboot).