docs: N100 F5/F6/F7 dispositions (fixed), capability map (fresh-USB wizard PROVEN-LIVE), ROADMAP (R-16 doc-drift closed, R-24 guest-resources-as-desired-state), iso README BIOS G3 note, REPORT/CONTEXT

REPORT.md

@@ -2,60 +2,43 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## Direction-2a agent-plane immediate-sync — poke sender + ep0 felhom-poke surface (hub v0.59.0) — 2026-07-16
+## N100 polish — F5 guest auto-sizing (host-install v1.17.0) + docs — 2026-07-17
 
-**Baseline:** hub v0.58.0 → **v0.59.0** (LIVE on prod, ArgoCD Synced/Healthy). Pairs with felhom-agent
-v0.89.0 (the poke listener). Green gate `go build ./... && go vet ./... && go test ./...` passes.
-Design contract: `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md` option (a).
+Closes `documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md` **F5 (MEDIUM)**. Companion to the
+controller v0.141.0 F6/F7 fixes (see the felhom-controller REPORT). `bash -n` + the mode harness pass.
 
-### What shipped
-- **`internal/poke`** — the SSH poke SENDER (third sibling of `internal/wgsync`/`internal/tenantsync`):
-  a pinned-host-key (algorithm-pinned `ssh.FixedHostKey`) in-process client reusing the peersync
-  endpoint + host key, its OWN forced-command key. `Client.Poke(ctx, boxWGIP)` refuses any target
-  outside `10.77.0.0/24` BEFORE dialing, then SSHes to ep0's `felhom-poke` with the box WG /32 as the
-  command string (→ `$SSH_ORIGINAL_COMMAND`) which sends one empty UDP datagram to `<ip>:51822`.
-  `Notifier.PokeHost`/`PokeAllHosts` are fire-and-forget (detached goroutine, nil-receiver-safe) — a
-  poke never blocks or fails the operator save; a missing peer / SSH error is logged, the report cycle
-  reconciles. Tests: resolved-IP send, no-peer / store-error no-send, nil no-op, `Poke` pre-dial
-  non-WG refusal.
-- **Wiring:** `Server.SetPoke`; `applyPBSDR` fires `PokeHost(host.HostID)` after each generation-bumping
-  descriptor save; `handleSetArtifacts` (MinAgent-floor save) fires `PokeAllHosts()`. `cmd/hub/main.go`
-  env-configures the sender (`POKE_SSH_KEY_FILE`, reusing `WG_ENDPOINT_SSH_ADDR`/`_HOSTKEY`/user).
-- **ep0 surface:** `scripts/felhom-poke.sh` v1.0.0 — a NON-root (`felhom-peersync`, no sudoers grant)
-  forced command that validates `$SSH_ORIGINAL_COMMAND` to the WG /24 and sends one empty datagram
-  from wg0. Contentless + confined (the WG kernel refuses non-peer /32s — spike P1 EKEYREJECTED).
-  Runbook `documentation/runbooks/offsite-endpoint.md` §11. Port **51822** = shared cross-repo constant.
-- **`manifests/hub.yaml`:** `POKE_SSH_KEY_FILE` env + optional `Secret/agent-poke` mounted 0400; image
-  tag `0.58.0`→`0.59.0`.
+### F5 — appliance guest auto-sizing (`scripts/felhom-host-install.sh` v1.17.0)
+The golden default (2 GB RAM) reached the guest on a 16 GB host because appliance mode passed no
+`--memory`/`--cores`. Now, in **appliance** mode with no explicit cap, the guest is auto-sized from
+the host: `autosize_guest_caps` runs right after mode validation (before the plan summary + provision)
+and fills `MEM_MIB`/`CPU_CORES`:
+- RAM = `clamp(host-4096, min 4096, max host-2048)` then a hard ceiling `host-1024` (never
+  over-commit). Sizing: 8 GB→4096, 16 GB→12288, 32 GB→28672 MiB; a 4 GB host→3072 (min capped at the
+  ceiling — the edge rule).
+- cores = `host-1, min 2`.
+- An explicit `--memory`/`--cores` ALWAYS wins untouched; byo mode still requires explicit caps (never
+  auto-sized). The values flow into the existing `cap_args` → the agent's `-memory`/`-cores`.
+- Host reads (`MemTotal`/`nproc`) are overridable via `FELHOM_FAKE_MEMTOTAL_MIB`/`FELHOM_FAKE_NPROC`.
+- **Red-proof:** `hostinstall-mode-harness.sh` new F5 section (8/16/32 GB + small-host edge +
+  explicit-flag precedence) — the auto-size log line is emitted before any PVE contact, so it asserts
+  portably; pre-fix (auto-size disabled) FAILs, post-fix PASSes.
 
-### Landmarks as found at source
-- **Poke wiring is host-keyed** (`store.GetWGPeerForHost` → the box WG /32), the sibling of the
-  customer-keyed `internal/intent` long-poll (Direction-2b / controller plane). `SetHostDesired` bumps
-  the poked host's generation; the poked immediate report carries the advanced envelope generation →
-  the agent fetches the new descriptor.
-- **Spec-vs-source note (source wins):** the MinAgent-floor / artifact-manifest save
-  (`handleSetArtifacts`) does NOT itself bump per-host desired generation — the agent self-update
-  dispatches via signed-ops on the next report — so `PokeAllHosts()` there accelerates the next report
-  cycle where the floor is applied, rather than delivering a desired-state delta. Kept the poke there
-  (the spec names this handler) and documented the semantics.
+**Same commit (R-16 doc-drift leftover, R-20 closure note):** the operator-signing-keys "EMPTY by
+default" comment was stale (the keys are PINNED to the real `felhom-op-1`/`felhom-rec-1` ceremony
+keypairs) — corrected, comment-only, no behavior.
 
-### Live validation
-- **Deployed:** hub 0.59.0 built + pushed on 180, manifest tag bumped + ArgoCD synced (Synced/Healthy,
-  rollout complete, image `:0.59.0`); after the Secret was created it logs `agent-plane poke enabled`.
-- **ep0 poke surface installed live** (additive; `felhom-peersync` authorized_keys 2→3 lines,
-  peersync/tenantsync UNCHANGED; `/usr/local/bin/felhom-poke` 0755; `Secret/agent-poke` holds the
-  private key, the build-server copy shredded).
-- **ep0 leg live-validated with the poke key:** a valid WG target (`10.77.0.2`) → `poke-fired`;
-  `8.8.8.8` AND `rm -rf /` as the SSH command → `refused non-WG target` (the forced command NEVER
-  executes client input, only reads it as an IP candidate). This proves the full hub→ep0→box datagram
-  path and the credential-theft blast radius (≤ "make a registered box tick").
-- **Fired end-to-end from a REAL operator save (2026-07-17):** the operator's Day-0 manifest save
-  (`Artifact manifest set: agent=0.89.0 … min_agent=0.89.0`) immediately logged `poke: sync-poke
-  delivered to 10.77.0.2 via 167.233.158.164:22` + `fleet nudge sent to 1/2 WG peers` — the
-  `handleSetArtifacts`→`PokeAllHosts()` wiring proven live to the box (the 2nd peer is offline). The
-  MinAgent-floor coupling also fired: `managed floor HELD for demo-felhom: agent 0.88.0 < MinAgent 0.89.0`.
-- **Scenario 3 box-side latency measured** once the demo reached v0.89.0: a poke ep0→box delivered in
-  **~31 ms** and fired the immediate desired-state cycle (see the felhom-agent REPORT). Full save→tick
-  ≈ ~0.45 s (SSH-dominated), well under the ≤2–3 s target. All three live legs (Scenario 4 A/B train,
-  Scenario 1 R-22 self-heal, Scenario 3 latency) are proven-live; the capability-map poke + F4 rows are
-  upgraded to PROVEN-LIVE.
+### NOT live this task
+F5 is validated by harness only — live at the next from-scratch rehearsal (Viktor's planned
+delete/re-create run); stated in the ROADMAP and the VALIDATION disposition.
+
+### Docs updated
+VALIDATION-n100 F5/F6/F7 dispositions → FIXED-in-vX (erratum style); capability map drive-wizard row →
+F6 fresh-USB wizard enroll+format **PROVEN-LIVE**; ROADMAP R-16 (doc-drift bit closed), R-22 & R-13
+already PROVEN-LIVE, new **R-24** (guest resources as hub desired-state / live resize — the F5
+follow-on); operator-sidebar item #1 (BIOS "State After G3 → Power On") added to `scripts/iso/README.md`.
+
+### Operator sidebar (Viktor — CC does NOT do these; recorded verbatim)
+1. **BIOS "State After G3" → "Power On"/"Last State"** before final sign-off — added to
+   `scripts/iso/README.md` hardware-prep notes.
+2. **campaign6 autofs orphan** — clears at the next host reboot.
+3. **tied-CreatedAt flash duplicates** (audiobookshelf/komga/romm) — standing action item.