docs: nested drill aborted on N100 (contention w/ live guest); golden vouched + ISO built; R-63 visual + full drill → HP per operator steer

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

REPORT.md

@@ -16,7 +16,7 @@ hub **v0.72.0→v0.73.0**. Commits: `b620435` (scripts code), hub `0.73.0` train
 | **4 — R-71 build-gate + rule** | ✅ code + red-proofed + **LIVE-demonstrated blocking the real gap**; standing rule 5 added |
 | **4 — golden republish** | ✅ **built + published + vouched** — golden **0.161.0** (sha `77624408…`), floor stays 0.156.0; the LIVE gap is CLOSED |
 | **5 — ISO v1.25.0 build** | ✅ **built** (`…v1.25.0-nested-vm-generic-mkimage.iso`, sha `99b38420…`); gate passed live; rootpw+R-63 present |
-| **5 — nested drill** | ⏳ the last validation leg (R-63 console capture + fresh-install code-path proof) |
+| **5 — nested drill** | ⚠️ ABORTED on N100 (install pathologically slow, contended by live guest 9201); R-63 code-verified, live visual → HP drill |
 | **6 — felhom-pve root vault** | ✅ rotated + vaulted + **verified authenticating over :22** |
 
 ## CRITICAL FINDING — the R-71 gap was LIVE, now CLOSED
@@ -79,17 +79,35 @@ shredded. felhom-pve now has G1 vault parity with demo-hp. (Note: the vault's `s
 original day-0 stamp — not bumped on rotation; cosmetic, the SECRET is the rotated one, proven by
 the auth test.)
 
-## Remaining — the nested drill (last validation leg)
+## Nested drill — attempted, ABORTED, deferred to an HP-based run
 
-Golden republish + vouch + the v1.25.0 ISO build are DONE. The one remaining leg is the
-v1.24.0-style **nested drill** — the deep end-to-end proof of the fresh-install code path:
-belt installed+active by the default appliance leg, apt=no-subscription, **R-63 console capture**
-(the ő/ű closure evidence the spec asks for — ellenőrizze/telepítő rendered), golden boots 0.161.0
-with **NO managed-update firing** (structurally guaranteed now that golden 0.161 ≥ floor 0.156 —
-the drill confirms it live), `.rootpw.txt` opens the console (R-61 regression), and the build-gate
-red-proof in the nest. Heavy (~15–20 min: 1.7 GB ISO transfer + nested install + boot + verify on
-the remote N100); the belt + apt legs are already proven live on the two real boxes, so this drill
-adds the fresh-install-path + R-63-visual proofs specifically.
+Golden republish + vouch + the v1.25.0 ISO build are DONE. The nested drill was attempted on the
+N100 (felhom-pve): 1.7 GB ISO transferred + sha-verified, VM 9313 created (OVMF SB-off for the
+mkimage loader, disk-first boot), auto-install started. It ran **KVM-accelerated** (confirmed:
+`/usr/bin/kvm`, `cpu host,+kvm_pv_eoi…`, `q35+pve0` — not TCG, not memory-starved) but crawled
+pathologically — **~40+ min pegged at 100% of one core, stuck in the kernel/grub/initramfs
+configure at ~87%** — because the N100 was simultaneously running the **live customer guest 9201**
+plus the golden build scratch. **Aborted to protect the live guest** (a runaway install must not
+starve a production customer workload); VM 9313 + the golden scratch (9100 + local vzdump) + the
+drill ISO were destroyed/removed, 9201 untouched, 70 GB freed.
+
+**Operator steer (2026-07-23): future drills/builds move to the HP (demo-hp)** — more RAM, faster
+CPU, and it carries no live customer guest, so a nested install there will be far quicker.
+
+What the drill would have added, and its current standing:
+- **R-63 console ő/ű capture** — the one leg genuinely PENDING a live boot. The font *code* is
+  verified (Lat2-Terminus16/Fixed16/Terminus14 confirmed present in the trixie console-setup
+  package; `set_console_font` correct + embedded in the built ISO's bootstrap payload). The visual
+  screendump rides the next HP-based drill.
+- **belt installed+active + apt=no-subscription (fresh-install path)** — the legs themselves are
+  already **proven live on both real boxes** this session; the ISO-driven path additionally needs
+  an operator **bind** (password-gated, like the v1.24.0 rehearsal's drill customer).
+- **golden 0.161.0 boots with NO managed-update firing** — now **structurally guaranteed** (golden
+  0.161.0 ≥ floor 0.156.0 after the vouch; the update only fires below the floor); a live boot
+  would merely confirm it.
+- **`.rootpw.txt` opens the console** — R-61 regression; rides the HP drill.
+- **build-gate red-proof in the nest** — already demonstrated live on DooPlex against the real gap
+  (`golden 0.153 < floor 0.156` → build refused).
 
 ## Observed / not acted on