DRILL-day0-vm 2026-07-12: full report + runbook corrections (F-4/F-6 headline findings)

Audit doc for the Day-0 VM drill: appliance install, floor-at-first-report,
escrow ceremony + auto-confirm FIRST LIVE FIRING (~7.5 min, zero clicks),
offsite backup + restore round-trip, PBS-DR/WG fork (Peti-sequence rehearsal).
Corrects day0-install.md A.2 (git creds optional since v1.11.2, anonymous
fetch is the normal shape) and RUNBOOK-escrow-ceremony.md (identity-only mode
does NOT exist — F-6; age prereq — F-10). REPORT.md overwritten; CONTEXT.md
one-liner added.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

documentation/runbooks/RUNBOOK-escrow-ceremony.md

@@ -18,8 +18,15 @@
 
 ## Prerequisites (check BEFORE scheduling with the customer)
 - **Agent version:** ≥ v0.79.0 (the ceremony records `restic_pw_sha256` — older agents produce a blob
-  auto-confirm can never match). **No-PBS hosts** (BYO without the PBS tier): ≥ **v0.80.0**
-  (identity-only mode; below that the ceremony hard-requires the PBS key and refuses).
+  auto-confirm can never match).
+- **⚠ No-PBS hosts: the ceremony CANNOT run.** The previously documented "identity-only mode
+  (≥ v0.80.0)" was NEVER implemented — v0.80.0's actual feature was seeding `escrow.pbs_storage_id`
+  on PBS hosts. `escrow-create` hard-requires a PBS storage id + its key file (drill-proven
+  2026-07-12, finding F-6 of DRILL-day0-vm-2026-07-12.md). Until identity-only ships, a box MUST
+  have the PBS DR tier (which itself requires the WG tunnel peer first) before any escrow/offsite
+  arc can complete.
+- **Host packages:** `age` must be installed (identity wrap dependency; NOT installed by
+  host-install as of v1.14.0 — drill finding F-10). `apt-get install -y age`.
 - **K gate (PBS hosts):** `escrow.pbs_storage_id` set and the key file present
   (`cfg.Backup.PBSEncKeyPath(<id>)`).
 - **Staged secret (offsite):** offsite enabled → `EscrowState="pending"` on the controller and the staged
@@ -31,8 +38,9 @@
 ```bash
 felhom-agent --selftest=escrow-create --upload
 ```
-- `--storage <pbs-storage-id>` only if `escrow.pbs_storage_id` isn't configured. No-PBS hosts (agent
-  ≥0.80.0): omit — identity-only engages automatically.
+- `--storage <pbs-storage-id>` only if `escrow.pbs_storage_id` isn't configured (the PBS DR
+  apply-bridge seeds it automatically). No-PBS hosts: see the prerequisite warning above — the
+  ceremony refuses without a PBS key; identity-only mode does not exist yet.
 - What it does, in order: generates a fresh **R** (EFF-wordlist passphrase; entropy printed) → seals K
   (if present, via proxmox-backup-client re-key) and the IdentityBundle (age-under-R; the staged restic
   password auto-injected; the live WG key auto-captured if present) → **self-verifies by recovering its