docs: N100 F5/F6/F7 dispositions (fixed), capability map (fresh-USB wizard PROVEN-LIVE), ROADMAP (R-16 doc-drift closed, R-24 guest-resources-as-desired-state), iso README BIOS G3 note, REPORT/CONTEXT

CONTEXT.md

@@ -3,6 +3,15 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-17 — N100 polish (F5 scripts + F6/F7 controller).** F5 (host-install v1.17.0):
+  appliance mode auto-sizes the guest (RAM=clamp(host-4096,min 4096,max host-2048,ceil host-1024) +
+  cores=host-1 min 2) when no explicit cap; explicit `--memory`/`--cores` win. Harness red-proof
+  (8/16/32 GB). Same commit: the stale "EMPTY by default" operator-key comment fixed (R-16 doc-drift,
+  keys are PINNED). F6/F7 landed in controller v0.141.0 (LIVE on demo; fresh-USB wizard enroll+format
+  now PROVEN-LIVE — see the felhom-controller REPORT). New ROADMAP R-24 (guest resources as
+  desired-state / live resize = F5 follow-on). Operator sidebar #1 (BIOS State-After-G3→Power-On)
+  added to `scripts/iso/README.md`. See REPORT.md.
+
 - **2026-07-16 — DIRECTION-2a AGENT-PLANE POKE SHIPPED: hub v0.59.0 (LIVE).** The agent-plane
   sibling of the v0.58.0 wait channel: `internal/poke` — a pinned-host-key SSH sender (wgsync
   sibling) + fire-and-forget `Notifier` (`PokeHost`/`PokeAllHosts`, nil-safe, detached) that nudges a

REPORT.md

@@ -2,60 +2,43 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## Direction-2a agent-plane immediate-sync — poke sender + ep0 felhom-poke surface (hub v0.59.0) — 2026-07-16
+## N100 polish — F5 guest auto-sizing (host-install v1.17.0) + docs — 2026-07-17
 
-**Baseline:** hub v0.58.0 → **v0.59.0** (LIVE on prod, ArgoCD Synced/Healthy). Pairs with felhom-agent
-v0.89.0 (the poke listener). Green gate `go build ./... && go vet ./... && go test ./...` passes.
-Design contract: `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md` option (a).
+Closes `documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md` **F5 (MEDIUM)**. Companion to the
+controller v0.141.0 F6/F7 fixes (see the felhom-controller REPORT). `bash -n` + the mode harness pass.
 
-### What shipped
-- **`internal/poke`** — the SSH poke SENDER (third sibling of `internal/wgsync`/`internal/tenantsync`):
-  a pinned-host-key (algorithm-pinned `ssh.FixedHostKey`) in-process client reusing the peersync
-  endpoint + host key, its OWN forced-command key. `Client.Poke(ctx, boxWGIP)` refuses any target
-  outside `10.77.0.0/24` BEFORE dialing, then SSHes to ep0's `felhom-poke` with the box WG /32 as the
-  command string (→ `$SSH_ORIGINAL_COMMAND`) which sends one empty UDP datagram to `<ip>:51822`.
-  `Notifier.PokeHost`/`PokeAllHosts` are fire-and-forget (detached goroutine, nil-receiver-safe) — a
-  poke never blocks or fails the operator save; a missing peer / SSH error is logged, the report cycle
-  reconciles. Tests: resolved-IP send, no-peer / store-error no-send, nil no-op, `Poke` pre-dial
-  non-WG refusal.
-- **Wiring:** `Server.SetPoke`; `applyPBSDR` fires `PokeHost(host.HostID)` after each generation-bumping
-  descriptor save; `handleSetArtifacts` (MinAgent-floor save) fires `PokeAllHosts()`. `cmd/hub/main.go`
-  env-configures the sender (`POKE_SSH_KEY_FILE`, reusing `WG_ENDPOINT_SSH_ADDR`/`_HOSTKEY`/user).
-- **ep0 surface:** `scripts/felhom-poke.sh` v1.0.0 — a NON-root (`felhom-peersync`, no sudoers grant)
-  forced command that validates `$SSH_ORIGINAL_COMMAND` to the WG /24 and sends one empty datagram
-  from wg0. Contentless + confined (the WG kernel refuses non-peer /32s — spike P1 EKEYREJECTED).
-  Runbook `documentation/runbooks/offsite-endpoint.md` §11. Port **51822** = shared cross-repo constant.
-- **`manifests/hub.yaml`:** `POKE_SSH_KEY_FILE` env + optional `Secret/agent-poke` mounted 0400; image
-  tag `0.58.0`→`0.59.0`.
+### F5 — appliance guest auto-sizing (`scripts/felhom-host-install.sh` v1.17.0)
+The golden default (2 GB RAM) reached the guest on a 16 GB host because appliance mode passed no
+`--memory`/`--cores`. Now, in **appliance** mode with no explicit cap, the guest is auto-sized from
+the host: `autosize_guest_caps` runs right after mode validation (before the plan summary + provision)
+and fills `MEM_MIB`/`CPU_CORES`:
+- RAM = `clamp(host-4096, min 4096, max host-2048)` then a hard ceiling `host-1024` (never
+  over-commit). Sizing: 8 GB→4096, 16 GB→12288, 32 GB→28672 MiB; a 4 GB host→3072 (min capped at the
+  ceiling — the edge rule).
+- cores = `host-1, min 2`.
+- An explicit `--memory`/`--cores` ALWAYS wins untouched; byo mode still requires explicit caps (never
+  auto-sized). The values flow into the existing `cap_args` → the agent's `-memory`/`-cores`.
+- Host reads (`MemTotal`/`nproc`) are overridable via `FELHOM_FAKE_MEMTOTAL_MIB`/`FELHOM_FAKE_NPROC`.
+- **Red-proof:** `hostinstall-mode-harness.sh` new F5 section (8/16/32 GB + small-host edge +
+  explicit-flag precedence) — the auto-size log line is emitted before any PVE contact, so it asserts
+  portably; pre-fix (auto-size disabled) FAILs, post-fix PASSes.
 
-### Landmarks as found at source
-- **Poke wiring is host-keyed** (`store.GetWGPeerForHost` → the box WG /32), the sibling of the
-  customer-keyed `internal/intent` long-poll (Direction-2b / controller plane). `SetHostDesired` bumps
-  the poked host's generation; the poked immediate report carries the advanced envelope generation →
-  the agent fetches the new descriptor.
-- **Spec-vs-source note (source wins):** the MinAgent-floor / artifact-manifest save
-  (`handleSetArtifacts`) does NOT itself bump per-host desired generation — the agent self-update
-  dispatches via signed-ops on the next report — so `PokeAllHosts()` there accelerates the next report
-  cycle where the floor is applied, rather than delivering a desired-state delta. Kept the poke there
-  (the spec names this handler) and documented the semantics.
+**Same commit (R-16 doc-drift leftover, R-20 closure note):** the operator-signing-keys "EMPTY by
+default" comment was stale (the keys are PINNED to the real `felhom-op-1`/`felhom-rec-1` ceremony
+keypairs) — corrected, comment-only, no behavior.
 
-### Live validation
-- **Deployed:** hub 0.59.0 built + pushed on 180, manifest tag bumped + ArgoCD synced (Synced/Healthy,
-  rollout complete, image `:0.59.0`); after the Secret was created it logs `agent-plane poke enabled`.
-- **ep0 poke surface installed live** (additive; `felhom-peersync` authorized_keys 2→3 lines,
-  peersync/tenantsync UNCHANGED; `/usr/local/bin/felhom-poke` 0755; `Secret/agent-poke` holds the
-  private key, the build-server copy shredded).
-- **ep0 leg live-validated with the poke key:** a valid WG target (`10.77.0.2`) → `poke-fired`;
-  `8.8.8.8` AND `rm -rf /` as the SSH command → `refused non-WG target` (the forced command NEVER
-  executes client input, only reads it as an IP candidate). This proves the full hub→ep0→box datagram
-  path and the credential-theft blast radius (≤ "make a registered box tick").
-- **Fired end-to-end from a REAL operator save (2026-07-17):** the operator's Day-0 manifest save
-  (`Artifact manifest set: agent=0.89.0 … min_agent=0.89.0`) immediately logged `poke: sync-poke
-  delivered to 10.77.0.2 via 167.233.158.164:22` + `fleet nudge sent to 1/2 WG peers` — the
-  `handleSetArtifacts`→`PokeAllHosts()` wiring proven live to the box (the 2nd peer is offline). The
-  MinAgent-floor coupling also fired: `managed floor HELD for demo-felhom: agent 0.88.0 < MinAgent 0.89.0`.
-- **Scenario 3 box-side latency measured** once the demo reached v0.89.0: a poke ep0→box delivered in
-  **~31 ms** and fired the immediate desired-state cycle (see the felhom-agent REPORT). Full save→tick
-  ≈ ~0.45 s (SSH-dominated), well under the ≤2–3 s target. All three live legs (Scenario 4 A/B train,
-  Scenario 1 R-22 self-heal, Scenario 3 latency) are proven-live; the capability-map poke + F4 rows are
-  upgraded to PROVEN-LIVE.
+### NOT live this task
+F5 is validated by harness only — live at the next from-scratch rehearsal (Viktor's planned
+delete/re-create run); stated in the ROADMAP and the VALIDATION disposition.
+
+### Docs updated
+VALIDATION-n100 F5/F6/F7 dispositions → FIXED-in-vX (erratum style); capability map drive-wizard row →
+F6 fresh-USB wizard enroll+format **PROVEN-LIVE**; ROADMAP R-16 (doc-drift bit closed), R-22 & R-13
+already PROVEN-LIVE, new **R-24** (guest resources as hub desired-state / live resize — the F5
+follow-on); operator-sidebar item #1 (BIOS "State After G3 → Power On") added to `scripts/iso/README.md`.
+
+### Operator sidebar (Viktor — CC does NOT do these; recorded verbatim)
+1. **BIOS "State After G3" → "Power On"/"Last State"** before final sign-off — added to
+   `scripts/iso/README.md` hardware-prep notes.
+2. **campaign6 autofs orphan** — clears at the next host reboot.
+3. **tied-CreatedAt flash duplicates** (audiobookshelf/komga/romm) — standing action item.

documentation/architecture/00-capability-map.md

@@ -67,7 +67,7 @@
 
 | Scenario | Components | Status | Evidence | Gap / roadmap |
 |---|---|---|---|---|
-| Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts | controller, agent v0.87 | **PROVEN-LIVE** | `DISPOSITION-ia-finding2-systemdisks-2026-07-13` (legacy EFI+LVM host, root not offered, byte-identical); enroll/format live in `storage-lifecycle-acceptance-2026-06-15` (E10 re-enroll, data intact); agent fence self-test refuses `/dev/sda` | (Cited `CAMPAIGN-2` T-STG-ENROLL/SEC-FORMAT were auth-hollow CSRF-403.) Fresh-USB **wizard enroll+format through the customer UI** remains a supervised leg |
+| Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts | controller, agent v0.87 | **PROVEN-LIVE** | `DISPOSITION-ia-finding2-systemdisks-2026-07-13` (legacy EFI+LVM host, root not offered, byte-identical); enroll/format live in `storage-lifecycle-acceptance-2026-06-15` (E10 re-enroll, data intact); agent fence self-test refuses `/dev/sda` | (Cited `CAMPAIGN-2` T-STG-ENROLL/SEC-FORMAT were auth-hollow CSRF-403.) **Fresh-USB wizard enroll+format through the customer UI PROVEN-LIVE (controller v0.141.0, 2026-07-17):** a 64 GB scratch USB driven through the real `/api/storage/init` endpoints (login+CSRF) → confirm → detached format (~27 s mkfs) → mount → register → mounted+registered at `/mnt/felhom-drives/scratch1`. **F6 (initialize-to-usable) now covered:** the wizard runs the chain as a detached, disconnect-safe, pollable job (3-step progress) with an agent format-status poll for a slow mkfs |
 | Data migration between drives (all / per-app), crash-safe | controller | **PROVEN-LIVE** | `CAMPAIGN-6C` 4P-5 (scope=app round-trip, byte-identical); `storage-lifecycle-acceptance-2026-06-15` (two migrate-all runs via dashboard UI, sha256 byte-identical) | (Cited `CAMPAIGN-2` T-STG-MIGRATE-* were auth-hollow.) "crash-safe" is design-level (copy→verify→remove) — no clean live crash-during-migration PASS |
 | NAS (NFS/SMB-client) verify-before-commit, uid-1000 probe, categorized Hungarian errors, DSM-validated | controller v0.113–117, agent v0.81/84/85 | **PROVEN-LIVE** | `SPIKE-nas-verify-2026-07-11`, `SPIKE-nas-dsm-2026-07-11`, `CAMPAIGN-3-2026-07-11` (boot/reassert fixes) | |
 | USB drive enrollment + unplug detection + recommission | controller, agent | **PROVEN-LIVE** | `storage-lifecycle-acceptance-2026-06-15` E4 (yanked-while-running → agent auto-rebind) + E10 (re-enroll, data intact); `CAMPAIGN-4`/`6A` (3 USB re-establish across device-letter reshuffle) | (Cited `RUNBOOK-usb` could NOT complete a wizard enrollment; `CAMPAIGN-2` legs were auth-hollow.) Fresh-USB **wizard enrollment** specifically still unproven |

documentation/backlog/ROADMAP.md

@@ -36,7 +36,7 @@
 | R-9 | Uninstaller trio (from 07-15 Peti session): cluster-aware `felhom_guests` guard (node-local `pct list` deletes cluster-wide pveum objects); saferemove detection + time estimate + opt-in `--quick-remove` (never mutate `storage.cfg`); smarter `restore_storage` default for BYO clusters (shared storage, not local-lvm) | M | idea | Second item's rejected alternative (temp-disable-and-restore) stays rejected — crash window silently downgrades cluster wipe policy |
 | R-10 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) | XS | idea | One-line hardening; batch with the next controller task |
 | R-11 | Tester-facing one-pager: what the box does, known limitations, how to report (channel decision: Messenger group?) | S | idea | Pairs with R-3 |
-| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm) | XS | open | Viktor's own action items from 6D/6E |
+| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm) | XS | open (doc-drift bit CLOSED) | Viktor's own action items from 6D/6E. **Doc-drift leftover CLOSED (host-install v1.17.0, 2026-07-17):** the R-20-noted stale "EMPTY by default" operator-key comment corrected (keys are PINNED). Remaining = the two operator items above |
 | R-22 | **PBS-DR pre-check self-grant (F4).** On a non-default storage id the token-auth `GET /storage/<id>` pre-check 403s (no ACL yet) and used to abort before the root-run `grant` that creates it. | S | **SHIPPED + PROVEN-LIVE agent v0.89.0** (2026-07-17) | On a 403 the reconcile self-grants via the root wrapper + re-reads, then converges. Red-proof `TestSelfGrant_PreCheck403DoesNotAbortBeforeGrant`; live-reproduced on the demo (marker aside + ACLs revoked → self-grant → `converged state=adopted` in ~3 s, ACLs restored, offsite active). Origin `tests/VALIDATION-n100-baremetal-2026-07-16.md` F4. |
 | R-17 | Old-box archive (u629193-sub1) retirement decision — 9/9 byte-identical restores verified | XS | awaiting-decision | Viktor ruling |
 | R-19 | Internet-outage customer-experience drill: pull WAN on demo, verify lan_resolver path, document what the customer actually sees/does | S | idea | Flips map row E "LAN access" IMPLEMENTED→PROVEN-LIVE |
@@ -47,6 +47,7 @@
 
 | ID | Item | Size | Status | Notes |
 |----|------|------|--------|-------|
+| R-24 | **Guest resources as hub desired-state (live resize).** F5 (host-install v1.17.0) auto-sizes RAM/cores at INSTALL only. Make guest cores/RAM a per-host `pbs_dr`-sibling descriptor field the agent reconciles (`pct set -memory/-cores`), so the operator can right-size a running box from the hub — and land it in seconds via the agent-plane poke (R-13). | M | idea (F5 follow-on) | Follows F5 (`VALIDATION-n100` — appliance auto-size shipped); the live-resize path reuses the desired-state + poke machinery (agent v0.89 / hub v0.59). Would flip a new map row "operator right-sizes a running guest from the hub" |
 | R-12 | Cluster mode: agent-follows-guest, bind-mount reconciliation on HA migration | XL | idea | Scoped 07-15; interim = HA-group pin to one node. Driven by Peti's two-node cluster |
 | R-13 | OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair | L | **first slice PROVEN-LIVE (poke channel)** | **FIRST SLICE PROVEN-LIVE — the agent-plane poke channel (Direction-2a), agent v0.89.0 + hub v0.59.0 (2026-07-17):** the ep0-relayed contentless poke (hub→ep0 `felhom-poke` forced-cmd→UDP→box WG /32:51822, peer-confined, zero ep0/box infra change) reaches the **agent** and fires an immediate desired-state cycle. Full path live: real operator manifest save → `sync-poke delivered to 10.77.0.2`; box → `poke received → immediate desired-state cycle` (~31 ms ep0→box, save→tick ≈ ~0.45 s). This is ONLY the listener+sender; the rest of the mutual-repair arc (self-heal actions over the channel) stays open. Per `SPIKE-immediate-sync-transport-2026-07-16` P4. The controller-plane Direction-2 wait channel (hub v0.58 / controller v0.140) shipped the config-puller leg separately |
 | R-14 | Headscale/WireGuard spike: Minecraft/gaming port connectivity (CGNAT-proof, sovereign DERP fallback) | M | idea | |

documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md

@@ -91,9 +91,9 @@ boards where USB-grub is broken.
 | **F2** | MEDIUM | No claim-code email on reinstall of an existing customer | claim state (`claim_code_generation:2`, hash, issued 2026-07-13) is **hub/customer-level** and is delivered to the fresh box; an existing code ⇒ no re-issue/re-email. Fresh box has **no password set** | need a **"re-issue claim code"** operator action (bump generation + email). ~~**⚠ also verify** whether the reinstalled *unclaimed* box is properly gated or accidentally **open** (F-4 class)~~ **ERRATUM 2026-07-16 (Viktor):** the ⚠ is RETRACTED — the claim gate WAS presented at felhom.demo-felhom.eu; the customer self-served a new code, claimed, and set a password. F2 is a continuity/UX gap, not a gating hole. **SHIPPED hub v0.57.0** — `claim.ReissueForReenroll` auto-issues a reset code on clean-slate re-enroll (host-enroll mint path). |
 | **F3** | MEDIUM | Offsite target missing on the fresh controller → escrow blocked | offsite transient password is "delivered to the controller **once**" — it went to the *old* box; the fresh controller never got it. Hub showed provisioned + escrow-done → **hub/controller desync** | **"Re-issue offsite credentials"** in the hub restaged it (done during the run; controller picks up next config refresh). Codify: reinstall must re-issue offsite. **SHIPPED hub v0.57.0** — the re-enroll mint path calls the same machinery (`ReissueOffsiteForCustomer`) automatically. |
 | **F4** | MEDIUM | PBS-DR read 403s every tick | agent token `felhom-agent@pve!agent` has `FelhomAgentStore` on `/storage/**felhom-pbs**` only, but the customer's **PVE STORAGE ID is `felhom-offsite`** (non-default, the demo's adopted manual entry) → `GET /storage/felhom-offsite -> 403 (missing Datastore.Allocate)` | ~~install ACL must grant on the **config's storage id**~~ **ERRATUM/DISPOSITION 2026-07-16:** an installer fix is **not feasible** — the DR storage id lives in the agent-domain **pbs_dr descriptor** (`web/pbsdr.go` `StorageID`), provisioned *after* WG registration, so `step_agent_config()` cannot know it at ACL-grant time. The real block is a bootstrap circularity: the agent's reconcile tick does a **token-auth** `GET /storage/<id>` pre-check that 403s and aborts **before** its own root-run `felhom-pbs-apply grant` sets the ACL. Root fix is **agent-side** (proceed to the root-run apply despite the pre-check 403, or run the pre-check as root) — logged as a ROADMAP agent-train item; the demo was unblocked live with a one-shot `pveum` grant on `/storage/felhom-offsite`. Every default-storage-id (all new/Peti installs) already works — F4 only bites non-default ids. |
-| **F5** | MEDIUM | Guest RAM = 2 GB (too low on a 16 GB host) | **golden default**; no `--memory` passed (appliance), no per-customer/host-aware sizing | make guest RAM/cores configurable (hub config or auto-size at provision). Currently only the install `--memory` flag exists and isn't surfaced |
-| **F6** | MEDIUM | Drive "initialize" formats but doesn't mount/attach; UI shows nothing | on confirm, the **format client disconnects** ("mkfs continues detached; poll GET /disks/format/status") — mkfs completes (`storage: formatted device /dev/sdb ext4`) but the **post-mkfs mount+register is aborted** and the UI never polls the status | users reasonably expect *initialize* to also mount+register. Fix the confirm→poll flow so the wizard finishes the mount+attach and reports progress/completion. (Viktor recovered by re-running the *attach* flow manually → `hdd_1` at `/mnt/hdd_1`) |
-| **F7** | LOW | "Vissza" (Back) on `/storage/init` and `/storage/attach` routes to `/settings` | frontend route bug | point Back → `/storage` |
+| **F5** | MEDIUM | Guest RAM = 2 GB (too low on a 16 GB host) | **golden default**; no `--memory` passed (appliance), no per-customer/host-aware sizing | make guest RAM/cores configurable (hub config or auto-size at provision). Currently only the install `--memory` flag exists and isn't surfaced | **FIXED — host-install v1.17.0 (2026-07-17):** appliance mode auto-sizes RAM=clamp(host-4096, min 4096, max host-2048, ceil host-1024) + cores=host-1 (min 2) when no explicit cap; explicit `--memory`/`--cores` win. Harness red-proof (8/16/32 GB). Live at the next from-scratch rehearsal. |
+| **F6** | MEDIUM | Drive "initialize" formats but doesn't mount/attach; UI shows nothing | on confirm, the **format client disconnects** ("mkfs continues detached; poll GET /disks/format/status") — mkfs completes (`storage: formatted device /dev/sdb ext4`) but the **post-mkfs mount+register is aborted** and the UI never polls the status | users reasonably expect *initialize* to also mount+register. Fix the confirm→poll flow so the wizard finishes the mount+attach and reports progress/completion. (Viktor recovered by re-running the *attach* flow manually → `hdd_1` at `/mnt/hdd_1`) | **FIXED — controller v0.141.0 (2026-07-17):** init runs as a DETACHED job (survives disconnect) the wizard polls (`GET /api/storage/init/status`, 3-step progress); a slow mkfs is followed via the agent's `/disks/format/status`; register is marker-last. Live-validated on a 64 GB scratch USB → mounted+registered at `/mnt/felhom-drives/scratch1`. |
+| **F7** | LOW | "Vissza" (Back) on `/storage/init` and `/storage/attach` routes to `/settings` | frontend route bug | point Back → `/storage` | **FIXED — controller v0.141.0 (2026-07-17):** both Vissza anchors → `/storage` (test-guarded). |
 
 **Non-findings / notes:** the HDD initially not showing under "attach" was **CC's leftover read-only
 canary mount** (fixed, not a product bug). BIOS **State After G3 = S5** — the box stays *off* after a

scripts/iso/README.md

@@ -115,6 +115,9 @@ udev filter, not `disk-list`:**
    signature — a disk with a previous Linux/Proxmox install aborts at "cannot init physical volume"
    (spike S2b). Wipe first: `blkdiscard -f /dev/<disk>` (or `wipefs -a` + zero the PV region).
 4. UEFI + Secure Boot: no caveat — installs and boots under SB enforcing, no MOK/keypress (spike S2b).
+5. **BIOS "State After G3" → "Power On" (or "Last State")** before final sign-off — so the mini-PC
+   auto-powers-on after a mains loss (a managed appliance must come back without a physical press).
+   Set it in the BIOS power/ACPI menu; it is board-specific and cannot be scripted (operator step).
 
 ## Validation status (nested VM 310, 2026-07-16)