fresh box claimed, and it landed on the golden this task published

Login with the new password returns 302 and the dashboard opens: the claim took.
The page reads controller 0.244.0 — so a box installed from the built ISO lands on
the vouched set with no hand upgrade (agent 0.131.0, controller 0.244.0, PBS wrapper
matching).

Recorded alongside: a transport fact (the same claim page 403s to a python client and
200s to curl seconds apart — the edge judging the client, not the box refusing), and
that the drive init's {"started":true} is an attempt, not a result, so nothing is
deployed onto the drive until the mount is observed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt

@@ -215,3 +215,80 @@ status: running
 ## AND THE CLAIM MAIL CAME BY ITSELF at 16:00:58Z: „[Felhom] Új beállító kód — újratelepült a
 ##   szervered … A kód 72 óráig érvényes". The setup code itself is a SECRET: it is held out-of-band
 ##   in a 0600 file for the claim step and appears in no committed file.
+## 2026-09-16T16:17:25Z CLAIM — the household sets its own dashboard password
+Traceback (most recent call last):
+  File "<stdin>", line 8, in <module>
+  File "/usr/lib/python3.13/urllib/request.py", line 495, in open
+    response = meth(req, response)
+  File "/usr/lib/python3.13/urllib/request.py", line 604, in http_response
+    response = self.parent.error(
+        'http', request, response, code, msg, hdrs)
+  File "/usr/lib/python3.13/urllib/request.py", line 533, in error
+    return self._call_chain(*args)
+           ~~~~~~~~~~~~~~~~^^^^^^^
+  File "/usr/lib/python3.13/urllib/request.py", line 466, in _call_chain
+    result = func(*args)
+  File "/usr/lib/python3.13/urllib/request.py", line 613, in http_error_default
+    raise HTTPError(req.full_url, code, msg, hdrs, fp)
+urllib.error.HTTPError: HTTP Error 403: Forbidden
+## 2026-09-16T16:17:03Z THE BOX IS UP AND REACHABLE FROM OUTSIDE (R-510 holds on this box too):
+##   hub: „Guests 1/1 running · VMID 9201 · tester-1 · running · Last Seen just now"
+##   from DooPlex, over the customer's own domain through the tunnel:
+##     https://felhom.enkicsifelhom.hu/       -> 200
+##     https://felhom.enkicsifelhom.hu/claim  -> 200
+##   (the host row still shows „Cloudflared inactive" on the HOST plane — the tunnel that matters for
+##   the customer runs in the GUEST, and it is evidently serving.)
+## 2026-09-16T16:17:50Z CLAIM, retried with curl (a python urllib client got 403 from the edge on the
+##   same page curl reads as 200 — a transport difference, not the box refusing)
+  GET /claim http=200 bytes=2525
+  csrf field present: yes; cookies: felhom_claim_csrf 
+  claim POST http=302
+  page says: 
+  login page token: MISSING
+  login with the NEW password -> http=302   (302 = the claim really took)
+  dashboard -> http=200
+  dashboard says: Indítópult — Felhom.eu Indítópult Vezérlőpult Alkalmazások Tárhely Meghajtók Hálózati tárhely Biztonsági mentés Áttekintés Távoli mentés Alkalmazások Visszaállítás Megosztás Hálózati megosztás Rendszermonitor Debug Beállítások Rendszer Értesítések Biztonság és
+  controller version on the page: 0.244.0
+## THE CLAIM, and a transport fact worth recording:
+##   GET /claim  -> 200 (2525 bytes), one pre-auth cookie `felhom_claim_csrf`, one `_csrf` field.
+##   POST /claim -> 302 — the success shape. Proof that it TOOK is the login below, not this redirect.
+##   A python urllib client got 403 Forbidden from the edge on the SAME page curl reads as 200,
+##   seconds apart. That is the edge judging the client (no browser-ish headers), not the box
+##   refusing — recorded so a future session does not read a 403 there as a product fault.
+##   The setup code came from the mail the hub sent by itself; the new dashboard password is the
+##   household's own and is held out-of-band. Neither appears in any committed file.
+## THE CLAIM TOOK, and the delivery is PROVEN on the fact rather than the redirect:
+##   login with the NEW password -> 302, dashboard -> 200, and the page footer reads
+##   CONTROLLER 0.244.0 — the golden this task baked, published and vouched today.
+##   So a box installed from the built ISO lands on the vouched set with no hand upgrade:
+##     agent 0.131.0 (vouched) · controller 0.244.0 (this task's golden) · PBS wrapper matching.
+## 2026-09-16T16:18:49Z registering the data drive (the app's files need it)
+  csrf: MISSING
+  target: /dev/sdb  (mount name ASCII-only — an accented name is refused, measured 2026-09-16)
+  POST /api/storage/init -> http=403
+{"ok":false,"error":"CSRF token missing or invalid"}
+## THE DRIVE, as the box reports it before anything is done to it:
+##   initialize: /dev/sdb · 107 374 182 400 B · „QEMU HARDDISK" · data_bearing=false · mountable=false
+##   attach:     /dev/mapper/pve-vm--9201--disk--1 · ext4 · already mounted at /mnt/sys_drive
+##   i.e. exactly one disk is offered for initialisation — the 100 GB data disk — and the system
+##   drive is already in place. Nextcloud's files go on the former, which is why it is registered
+##   before any app is deployed.
+## 2026-09-16T16:19:13Z drive init, retried with a token taken from a real authenticated page
+  csrf from the dashboard: present (64 chars)
+  POST /api/storage/init -> http=200
+{"data":{"phase":"formatting","started":true},"ok":true}
+
+  drives as the box reports them now:
+    initialize: ['/dev/sdb']
+    attach:     [('/dev/sdb', '/dev/sdb'), ('/dev/mapper/pve-vm--9201--disk--1', '/mnt/sys_drive')]
+## THE DRIVE INIT — and what its answer does and does not say:
+##   POST /api/storage/init -> 200 {"data":{"phase":"formatting","started":true}}
+##   That is an ATTEMPT, not a result: „started":true means the detached format job was accepted.
+##   The result is the drive coming back MOUNTED under /mnt/felhom-drives with its label, which is
+##   what the wait below watches for. (Presence is not success — this project's standing rule, and
+##   the reason nothing is deployed onto the drive until the mount is observed.)
+##   The mount name is ASCII („adatlemez"); the human label „Adatlemez" carries the accent. An
+##   accented MOUNT name is refused by the API — measured on 2026-09-16, reused here rather than
+##   rediscovered.
+##   First attempt was refused 403 „CSRF token missing or invalid": I had read the token from a page
+##   path that does not exist and the fallback did not follow its redirect. My error, not the box's.