host-install v1.16.0 (FELHOM_ESCROW via canonical sudoers fetch; hub hostInstallVersion synced, no deploy) + RUNBOOK-escrow-ceremony rewrite: controller wizard PRIMARY, CLI operator fallback, F1 threat-model paragraph (R over CF tunnel accepted 2026-07-13), stale-blob/supersede/void semantics

hub/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Felhom Hub — Changelog
 
+## (unreleased) hostInstallVersion 1.16.0 (2026-07-13)
+
+Display-const bump only, keeping `scripts/hostinstall_gates.py` green with the installer's
+v1.16.0 (FELHOM_ESCROW via the canonical sudoers fetch — see scripts/CHANGELOG.md). No behavior
+change; rides the next hub image train (no deploy for this).
+
 ## v0.53.0 — closing bundle: F-14 gated auto-Reissue + dead-host roll-up honesty + bearer out of git (2026-07-13)
 
 The last engineering items on the pre-tester board. Two operator rulings in force (CONTEXT.md):

hub/internal/web/configs.go

@@ -25,7 +25,7 @@ var validCustomerID = regexp.MustCompile(`^[a-zA-Z0-9.\-]+$`)
 // only ever emits flags this version parses. Display-only (the Option-1 command downloads the served
 // script, which is always current); bump when the generator's flag surface follows a new script.
 // Drift is now gated: scripts/hostinstall_gates.py asserts this const == SCRIPT_VERSION (drill F-1).
-const hostInstallVersion = "1.15.0"
+const hostInstallVersion = "1.16.0"
 
 // validSemver matches a bare X.Y.Z controller version (the floor format). Empty is also accepted by
 // the floor handlers (clears the override).