From 1c737db4f425661db1803db791028726ba3cc871 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 17 Jul 2026 09:53:15 +0200 Subject: [PATCH] docs: N100 F5/F6/F7 dispositions (fixed), capability map (fresh-USB wizard PROVEN-LIVE), ROADMAP (R-16 doc-drift closed, R-24 guest-resources-as-desired-state), iso README BIOS G3 note, REPORT/CONTEXT --- CONTEXT.md | 9 ++ REPORT.md | 89 ++++++++----------- .../architecture/00-capability-map.md | 2 +- documentation/backlog/ROADMAP.md | 3 +- .../VALIDATION-n100-baremetal-2026-07-16.md | 6 +- scripts/iso/README.md | 3 + 6 files changed, 54 insertions(+), 58 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 0deabfc..2b913be 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -3,6 +3,15 @@ > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub), > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`. +- **2026-07-17 — N100 polish (F5 scripts + F6/F7 controller).** F5 (host-install v1.17.0): + appliance mode auto-sizes the guest (RAM=clamp(host-4096,min 4096,max host-2048,ceil host-1024) + + cores=host-1 min 2) when no explicit cap; explicit `--memory`/`--cores` win. Harness red-proof + (8/16/32 GB). Same commit: the stale "EMPTY by default" operator-key comment fixed (R-16 doc-drift, + keys are PINNED). F6/F7 landed in controller v0.141.0 (LIVE on demo; fresh-USB wizard enroll+format + now PROVEN-LIVE — see the felhom-controller REPORT). New ROADMAP R-24 (guest resources as + desired-state / live resize = F5 follow-on). Operator sidebar #1 (BIOS State-After-G3→Power-On) + added to `scripts/iso/README.md`. See REPORT.md. + - **2026-07-16 — DIRECTION-2a AGENT-PLANE POKE SHIPPED: hub v0.59.0 (LIVE).** The agent-plane sibling of the v0.58.0 wait channel: `internal/poke` — a pinned-host-key SSH sender (wgsync sibling) + fire-and-forget `Notifier` (`PokeHost`/`PokeAllHosts`, nil-safe, detached) that nudges a diff --git a/REPORT.md b/REPORT.md index d5fb6f3..ef6b68f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -2,60 +2,43 @@ > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md). -## Direction-2a agent-plane immediate-sync — poke sender + ep0 felhom-poke surface (hub v0.59.0) — 2026-07-16 +## N100 polish — F5 guest auto-sizing (host-install v1.17.0) + docs — 2026-07-17 -**Baseline:** hub v0.58.0 → **v0.59.0** (LIVE on prod, ArgoCD Synced/Healthy). Pairs with felhom-agent -v0.89.0 (the poke listener). Green gate `go build ./... && go vet ./... && go test ./...` passes. -Design contract: `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md` option (a). +Closes `documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md` **F5 (MEDIUM)**. Companion to the +controller v0.141.0 F6/F7 fixes (see the felhom-controller REPORT). `bash -n` + the mode harness pass. -### What shipped -- **`internal/poke`** — the SSH poke SENDER (third sibling of `internal/wgsync`/`internal/tenantsync`): - a pinned-host-key (algorithm-pinned `ssh.FixedHostKey`) in-process client reusing the peersync - endpoint + host key, its OWN forced-command key. `Client.Poke(ctx, boxWGIP)` refuses any target - outside `10.77.0.0/24` BEFORE dialing, then SSHes to ep0's `felhom-poke` with the box WG /32 as the - command string (→ `$SSH_ORIGINAL_COMMAND`) which sends one empty UDP datagram to `:51822`. - `Notifier.PokeHost`/`PokeAllHosts` are fire-and-forget (detached goroutine, nil-receiver-safe) — a - poke never blocks or fails the operator save; a missing peer / SSH error is logged, the report cycle - reconciles. Tests: resolved-IP send, no-peer / store-error no-send, nil no-op, `Poke` pre-dial - non-WG refusal. -- **Wiring:** `Server.SetPoke`; `applyPBSDR` fires `PokeHost(host.HostID)` after each generation-bumping - descriptor save; `handleSetArtifacts` (MinAgent-floor save) fires `PokeAllHosts()`. `cmd/hub/main.go` - env-configures the sender (`POKE_SSH_KEY_FILE`, reusing `WG_ENDPOINT_SSH_ADDR`/`_HOSTKEY`/user). -- **ep0 surface:** `scripts/felhom-poke.sh` v1.0.0 — a NON-root (`felhom-peersync`, no sudoers grant) - forced command that validates `$SSH_ORIGINAL_COMMAND` to the WG /24 and sends one empty datagram - from wg0. Contentless + confined (the WG kernel refuses non-peer /32s — spike P1 EKEYREJECTED). - Runbook `documentation/runbooks/offsite-endpoint.md` §11. Port **51822** = shared cross-repo constant. -- **`manifests/hub.yaml`:** `POKE_SSH_KEY_FILE` env + optional `Secret/agent-poke` mounted 0400; image - tag `0.58.0`→`0.59.0`. +### F5 — appliance guest auto-sizing (`scripts/felhom-host-install.sh` v1.17.0) +The golden default (2 GB RAM) reached the guest on a 16 GB host because appliance mode passed no +`--memory`/`--cores`. Now, in **appliance** mode with no explicit cap, the guest is auto-sized from +the host: `autosize_guest_caps` runs right after mode validation (before the plan summary + provision) +and fills `MEM_MIB`/`CPU_CORES`: +- RAM = `clamp(host-4096, min 4096, max host-2048)` then a hard ceiling `host-1024` (never + over-commit). Sizing: 8 GB→4096, 16 GB→12288, 32 GB→28672 MiB; a 4 GB host→3072 (min capped at the + ceiling — the edge rule). +- cores = `host-1, min 2`. +- An explicit `--memory`/`--cores` ALWAYS wins untouched; byo mode still requires explicit caps (never + auto-sized). The values flow into the existing `cap_args` → the agent's `-memory`/`-cores`. +- Host reads (`MemTotal`/`nproc`) are overridable via `FELHOM_FAKE_MEMTOTAL_MIB`/`FELHOM_FAKE_NPROC`. +- **Red-proof:** `hostinstall-mode-harness.sh` new F5 section (8/16/32 GB + small-host edge + + explicit-flag precedence) — the auto-size log line is emitted before any PVE contact, so it asserts + portably; pre-fix (auto-size disabled) FAILs, post-fix PASSes. -### Landmarks as found at source -- **Poke wiring is host-keyed** (`store.GetWGPeerForHost` → the box WG /32), the sibling of the - customer-keyed `internal/intent` long-poll (Direction-2b / controller plane). `SetHostDesired` bumps - the poked host's generation; the poked immediate report carries the advanced envelope generation → - the agent fetches the new descriptor. -- **Spec-vs-source note (source wins):** the MinAgent-floor / artifact-manifest save - (`handleSetArtifacts`) does NOT itself bump per-host desired generation — the agent self-update - dispatches via signed-ops on the next report — so `PokeAllHosts()` there accelerates the next report - cycle where the floor is applied, rather than delivering a desired-state delta. Kept the poke there - (the spec names this handler) and documented the semantics. +**Same commit (R-16 doc-drift leftover, R-20 closure note):** the operator-signing-keys "EMPTY by +default" comment was stale (the keys are PINNED to the real `felhom-op-1`/`felhom-rec-1` ceremony +keypairs) — corrected, comment-only, no behavior. -### Live validation -- **Deployed:** hub 0.59.0 built + pushed on 180, manifest tag bumped + ArgoCD synced (Synced/Healthy, - rollout complete, image `:0.59.0`); after the Secret was created it logs `agent-plane poke enabled`. -- **ep0 poke surface installed live** (additive; `felhom-peersync` authorized_keys 2→3 lines, - peersync/tenantsync UNCHANGED; `/usr/local/bin/felhom-poke` 0755; `Secret/agent-poke` holds the - private key, the build-server copy shredded). -- **ep0 leg live-validated with the poke key:** a valid WG target (`10.77.0.2`) → `poke-fired`; - `8.8.8.8` AND `rm -rf /` as the SSH command → `refused non-WG target` (the forced command NEVER - executes client input, only reads it as an IP candidate). This proves the full hub→ep0→box datagram - path and the credential-theft blast radius (≤ "make a registered box tick"). -- **Fired end-to-end from a REAL operator save (2026-07-17):** the operator's Day-0 manifest save - (`Artifact manifest set: agent=0.89.0 … min_agent=0.89.0`) immediately logged `poke: sync-poke - delivered to 10.77.0.2 via 167.233.158.164:22` + `fleet nudge sent to 1/2 WG peers` — the - `handleSetArtifacts`→`PokeAllHosts()` wiring proven live to the box (the 2nd peer is offline). The - MinAgent-floor coupling also fired: `managed floor HELD for demo-felhom: agent 0.88.0 < MinAgent 0.89.0`. -- **Scenario 3 box-side latency measured** once the demo reached v0.89.0: a poke ep0→box delivered in - **~31 ms** and fired the immediate desired-state cycle (see the felhom-agent REPORT). Full save→tick - ≈ ~0.45 s (SSH-dominated), well under the ≤2–3 s target. All three live legs (Scenario 4 A/B train, - Scenario 1 R-22 self-heal, Scenario 3 latency) are proven-live; the capability-map poke + F4 rows are - upgraded to PROVEN-LIVE. +### NOT live this task +F5 is validated by harness only — live at the next from-scratch rehearsal (Viktor's planned +delete/re-create run); stated in the ROADMAP and the VALIDATION disposition. + +### Docs updated +VALIDATION-n100 F5/F6/F7 dispositions → FIXED-in-vX (erratum style); capability map drive-wizard row → +F6 fresh-USB wizard enroll+format **PROVEN-LIVE**; ROADMAP R-16 (doc-drift bit closed), R-22 & R-13 +already PROVEN-LIVE, new **R-24** (guest resources as hub desired-state / live resize — the F5 +follow-on); operator-sidebar item #1 (BIOS "State After G3 → Power On") added to `scripts/iso/README.md`. + +### Operator sidebar (Viktor — CC does NOT do these; recorded verbatim) +1. **BIOS "State After G3" → "Power On"/"Last State"** before final sign-off — added to + `scripts/iso/README.md` hardware-prep notes. +2. **campaign6 autofs orphan** — clears at the next host reboot. +3. **tied-CreatedAt flash duplicates** (audiobookshelf/komga/romm) — standing action item. diff --git a/documentation/architecture/00-capability-map.md b/documentation/architecture/00-capability-map.md index d68d9cc..2a2fab9 100644 --- a/documentation/architecture/00-capability-map.md +++ b/documentation/architecture/00-capability-map.md @@ -67,7 +67,7 @@ | Scenario | Components | Status | Evidence | Gap / roadmap | |---|---|---|---|---| -| Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts | controller, agent v0.87 | **PROVEN-LIVE** | `DISPOSITION-ia-finding2-systemdisks-2026-07-13` (legacy EFI+LVM host, root not offered, byte-identical); enroll/format live in `storage-lifecycle-acceptance-2026-06-15` (E10 re-enroll, data intact); agent fence self-test refuses `/dev/sda` | (Cited `CAMPAIGN-2` T-STG-ENROLL/SEC-FORMAT were auth-hollow CSRF-403.) Fresh-USB **wizard enroll+format through the customer UI** remains a supervised leg | +| Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts | controller, agent v0.87 | **PROVEN-LIVE** | `DISPOSITION-ia-finding2-systemdisks-2026-07-13` (legacy EFI+LVM host, root not offered, byte-identical); enroll/format live in `storage-lifecycle-acceptance-2026-06-15` (E10 re-enroll, data intact); agent fence self-test refuses `/dev/sda` | (Cited `CAMPAIGN-2` T-STG-ENROLL/SEC-FORMAT were auth-hollow CSRF-403.) **Fresh-USB wizard enroll+format through the customer UI PROVEN-LIVE (controller v0.141.0, 2026-07-17):** a 64 GB scratch USB driven through the real `/api/storage/init` endpoints (login+CSRF) → confirm → detached format (~27 s mkfs) → mount → register → mounted+registered at `/mnt/felhom-drives/scratch1`. **F6 (initialize-to-usable) now covered:** the wizard runs the chain as a detached, disconnect-safe, pollable job (3-step progress) with an agent format-status poll for a slow mkfs | | Data migration between drives (all / per-app), crash-safe | controller | **PROVEN-LIVE** | `CAMPAIGN-6C` 4P-5 (scope=app round-trip, byte-identical); `storage-lifecycle-acceptance-2026-06-15` (two migrate-all runs via dashboard UI, sha256 byte-identical) | (Cited `CAMPAIGN-2` T-STG-MIGRATE-* were auth-hollow.) "crash-safe" is design-level (copy→verify→remove) — no clean live crash-during-migration PASS | | NAS (NFS/SMB-client) verify-before-commit, uid-1000 probe, categorized Hungarian errors, DSM-validated | controller v0.113–117, agent v0.81/84/85 | **PROVEN-LIVE** | `SPIKE-nas-verify-2026-07-11`, `SPIKE-nas-dsm-2026-07-11`, `CAMPAIGN-3-2026-07-11` (boot/reassert fixes) | | | USB drive enrollment + unplug detection + recommission | controller, agent | **PROVEN-LIVE** | `storage-lifecycle-acceptance-2026-06-15` E4 (yanked-while-running → agent auto-rebind) + E10 (re-enroll, data intact); `CAMPAIGN-4`/`6A` (3 USB re-establish across device-letter reshuffle) | (Cited `RUNBOOK-usb` could NOT complete a wizard enrollment; `CAMPAIGN-2` legs were auth-hollow.) Fresh-USB **wizard enrollment** specifically still unproven | diff --git a/documentation/backlog/ROADMAP.md b/documentation/backlog/ROADMAP.md index 08d0e8a..59dbc52 100644 --- a/documentation/backlog/ROADMAP.md +++ b/documentation/backlog/ROADMAP.md @@ -36,7 +36,7 @@ | R-9 | Uninstaller trio (from 07-15 Peti session): cluster-aware `felhom_guests` guard (node-local `pct list` deletes cluster-wide pveum objects); saferemove detection + time estimate + opt-in `--quick-remove` (never mutate `storage.cfg`); smarter `restore_storage` default for BYO clusters (shared storage, not local-lvm) | M | idea | Second item's rejected alternative (temp-disable-and-restore) stays rejected — crash window silently downgrades cluster wipe policy | | R-10 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) | XS | idea | One-line hardening; batch with the next controller task | | R-11 | Tester-facing one-pager: what the box does, known limitations, how to report (channel decision: Messenger group?) | S | idea | Pairs with R-3 | -| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm) | XS | open | Viktor's own action items from 6D/6E | +| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm) | XS | open (doc-drift bit CLOSED) | Viktor's own action items from 6D/6E. **Doc-drift leftover CLOSED (host-install v1.17.0, 2026-07-17):** the R-20-noted stale "EMPTY by default" operator-key comment corrected (keys are PINNED). Remaining = the two operator items above | | R-22 | **PBS-DR pre-check self-grant (F4).** On a non-default storage id the token-auth `GET /storage/` pre-check 403s (no ACL yet) and used to abort before the root-run `grant` that creates it. | S | **SHIPPED + PROVEN-LIVE agent v0.89.0** (2026-07-17) | On a 403 the reconcile self-grants via the root wrapper + re-reads, then converges. Red-proof `TestSelfGrant_PreCheck403DoesNotAbortBeforeGrant`; live-reproduced on the demo (marker aside + ACLs revoked → self-grant → `converged state=adopted` in ~3 s, ACLs restored, offsite active). Origin `tests/VALIDATION-n100-baremetal-2026-07-16.md` F4. | | R-17 | Old-box archive (u629193-sub1) retirement decision — 9/9 byte-identical restores verified | XS | awaiting-decision | Viktor ruling | | R-19 | Internet-outage customer-experience drill: pull WAN on demo, verify lan_resolver path, document what the customer actually sees/does | S | idea | Flips map row E "LAN access" IMPLEMENTED→PROVEN-LIVE | @@ -47,6 +47,7 @@ | ID | Item | Size | Status | Notes | |----|------|------|--------|-------| +| R-24 | **Guest resources as hub desired-state (live resize).** F5 (host-install v1.17.0) auto-sizes RAM/cores at INSTALL only. Make guest cores/RAM a per-host `pbs_dr`-sibling descriptor field the agent reconciles (`pct set -memory/-cores`), so the operator can right-size a running box from the hub — and land it in seconds via the agent-plane poke (R-13). | M | idea (F5 follow-on) | Follows F5 (`VALIDATION-n100` — appliance auto-size shipped); the live-resize path reuses the desired-state + poke machinery (agent v0.89 / hub v0.59). Would flip a new map row "operator right-sizes a running guest from the hub" | | R-12 | Cluster mode: agent-follows-guest, bind-mount reconciliation on HA migration | XL | idea | Scoped 07-15; interim = HA-group pin to one node. Driven by Peti's two-node cluster | | R-13 | OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair | L | **first slice PROVEN-LIVE (poke channel)** | **FIRST SLICE PROVEN-LIVE — the agent-plane poke channel (Direction-2a), agent v0.89.0 + hub v0.59.0 (2026-07-17):** the ep0-relayed contentless poke (hub→ep0 `felhom-poke` forced-cmd→UDP→box WG /32:51822, peer-confined, zero ep0/box infra change) reaches the **agent** and fires an immediate desired-state cycle. Full path live: real operator manifest save → `sync-poke delivered to 10.77.0.2`; box → `poke received → immediate desired-state cycle` (~31 ms ep0→box, save→tick ≈ ~0.45 s). This is ONLY the listener+sender; the rest of the mutual-repair arc (self-heal actions over the channel) stays open. Per `SPIKE-immediate-sync-transport-2026-07-16` P4. The controller-plane Direction-2 wait channel (hub v0.58 / controller v0.140) shipped the config-puller leg separately | | R-14 | Headscale/WireGuard spike: Minecraft/gaming port connectivity (CGNAT-proof, sovereign DERP fallback) | M | idea | | diff --git a/documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md b/documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md index 4021861..a562af0 100644 --- a/documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md +++ b/documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md @@ -91,9 +91,9 @@ boards where USB-grub is broken. | **F2** | MEDIUM | No claim-code email on reinstall of an existing customer | claim state (`claim_code_generation:2`, hash, issued 2026-07-13) is **hub/customer-level** and is delivered to the fresh box; an existing code ⇒ no re-issue/re-email. Fresh box has **no password set** | need a **"re-issue claim code"** operator action (bump generation + email). ~~**⚠ also verify** whether the reinstalled *unclaimed* box is properly gated or accidentally **open** (F-4 class)~~ **ERRATUM 2026-07-16 (Viktor):** the ⚠ is RETRACTED — the claim gate WAS presented at felhom.demo-felhom.eu; the customer self-served a new code, claimed, and set a password. F2 is a continuity/UX gap, not a gating hole. **SHIPPED hub v0.57.0** — `claim.ReissueForReenroll` auto-issues a reset code on clean-slate re-enroll (host-enroll mint path). | | **F3** | MEDIUM | Offsite target missing on the fresh controller → escrow blocked | offsite transient password is "delivered to the controller **once**" — it went to the *old* box; the fresh controller never got it. Hub showed provisioned + escrow-done → **hub/controller desync** | **"Re-issue offsite credentials"** in the hub restaged it (done during the run; controller picks up next config refresh). Codify: reinstall must re-issue offsite. **SHIPPED hub v0.57.0** — the re-enroll mint path calls the same machinery (`ReissueOffsiteForCustomer`) automatically. | | **F4** | MEDIUM | PBS-DR read 403s every tick | agent token `felhom-agent@pve!agent` has `FelhomAgentStore` on `/storage/**felhom-pbs**` only, but the customer's **PVE STORAGE ID is `felhom-offsite`** (non-default, the demo's adopted manual entry) → `GET /storage/felhom-offsite -> 403 (missing Datastore.Allocate)` | ~~install ACL must grant on the **config's storage id**~~ **ERRATUM/DISPOSITION 2026-07-16:** an installer fix is **not feasible** — the DR storage id lives in the agent-domain **pbs_dr descriptor** (`web/pbsdr.go` `StorageID`), provisioned *after* WG registration, so `step_agent_config()` cannot know it at ACL-grant time. The real block is a bootstrap circularity: the agent's reconcile tick does a **token-auth** `GET /storage/` pre-check that 403s and aborts **before** its own root-run `felhom-pbs-apply grant` sets the ACL. Root fix is **agent-side** (proceed to the root-run apply despite the pre-check 403, or run the pre-check as root) — logged as a ROADMAP agent-train item; the demo was unblocked live with a one-shot `pveum` grant on `/storage/felhom-offsite`. Every default-storage-id (all new/Peti installs) already works — F4 only bites non-default ids. | -| **F5** | MEDIUM | Guest RAM = 2 GB (too low on a 16 GB host) | **golden default**; no `--memory` passed (appliance), no per-customer/host-aware sizing | make guest RAM/cores configurable (hub config or auto-size at provision). Currently only the install `--memory` flag exists and isn't surfaced | -| **F6** | MEDIUM | Drive "initialize" formats but doesn't mount/attach; UI shows nothing | on confirm, the **format client disconnects** ("mkfs continues detached; poll GET /disks/format/status") — mkfs completes (`storage: formatted device /dev/sdb ext4`) but the **post-mkfs mount+register is aborted** and the UI never polls the status | users reasonably expect *initialize* to also mount+register. Fix the confirm→poll flow so the wizard finishes the mount+attach and reports progress/completion. (Viktor recovered by re-running the *attach* flow manually → `hdd_1` at `/mnt/hdd_1`) | -| **F7** | LOW | "Vissza" (Back) on `/storage/init` and `/storage/attach` routes to `/settings` | frontend route bug | point Back → `/storage` | +| **F5** | MEDIUM | Guest RAM = 2 GB (too low on a 16 GB host) | **golden default**; no `--memory` passed (appliance), no per-customer/host-aware sizing | make guest RAM/cores configurable (hub config or auto-size at provision). Currently only the install `--memory` flag exists and isn't surfaced | **FIXED — host-install v1.17.0 (2026-07-17):** appliance mode auto-sizes RAM=clamp(host-4096, min 4096, max host-2048, ceil host-1024) + cores=host-1 (min 2) when no explicit cap; explicit `--memory`/`--cores` win. Harness red-proof (8/16/32 GB). Live at the next from-scratch rehearsal. | +| **F6** | MEDIUM | Drive "initialize" formats but doesn't mount/attach; UI shows nothing | on confirm, the **format client disconnects** ("mkfs continues detached; poll GET /disks/format/status") — mkfs completes (`storage: formatted device /dev/sdb ext4`) but the **post-mkfs mount+register is aborted** and the UI never polls the status | users reasonably expect *initialize* to also mount+register. Fix the confirm→poll flow so the wizard finishes the mount+attach and reports progress/completion. (Viktor recovered by re-running the *attach* flow manually → `hdd_1` at `/mnt/hdd_1`) | **FIXED — controller v0.141.0 (2026-07-17):** init runs as a DETACHED job (survives disconnect) the wizard polls (`GET /api/storage/init/status`, 3-step progress); a slow mkfs is followed via the agent's `/disks/format/status`; register is marker-last. Live-validated on a 64 GB scratch USB → mounted+registered at `/mnt/felhom-drives/scratch1`. | +| **F7** | LOW | "Vissza" (Back) on `/storage/init` and `/storage/attach` routes to `/settings` | frontend route bug | point Back → `/storage` | **FIXED — controller v0.141.0 (2026-07-17):** both Vissza anchors → `/storage` (test-guarded). | **Non-findings / notes:** the HDD initially not showing under "attach" was **CC's leftover read-only canary mount** (fixed, not a product bug). BIOS **State After G3 = S5** — the box stays *off* after a diff --git a/scripts/iso/README.md b/scripts/iso/README.md index bcfff70..a88a55c 100644 --- a/scripts/iso/README.md +++ b/scripts/iso/README.md @@ -115,6 +115,9 @@ udev filter, not `disk-list`:** signature — a disk with a previous Linux/Proxmox install aborts at "cannot init physical volume" (spike S2b). Wipe first: `blkdiscard -f /dev/` (or `wipefs -a` + zero the PV region). 4. UEFI + Secure Boot: no caveat — installs and boots under SB enforcing, no MOK/keypress (spike S2b). +5. **BIOS "State After G3" → "Power On" (or "Last State")** before final sign-off — so the mini-PC + auto-powers-on after a mains loss (a managed appliance must come back without a physical press). + Set it in the BIOS power/ACPI menu; it is board-specific and cannot be scripted (operator step). ## Validation status (nested VM 310, 2026-07-16)