SPIKE 2: before-network gives a zero window by construction; locked root closes sulogin

Findings only — no script, profile or build file changed; no ISO built, nothing published.
documentation/audits/SPIKE-universal-iso-2-2026-07-31.md

BOTH Tier 0 boxes went offline mid-session (remote site, 12:28 CEST; four routes tried, our
tailscale pod healthy). Q1/Q2/Q3 each keep a part needing a nested VM: those are BLOCKED, not
answered. DooPlex was NOT used as a fallback — Tier 2, and this task did not authorise it.

Established without them:

- STRUCTURAL: ordering='before-network' maps to proxmox-first-boot-network-pre.service
  (Before=network-pre.target, Type=oneshot) — it completes before ANY interface is configured,
  so a rotation there has a zero-length window BY CONSTRUCTION, not by being fast.
- R-148: the stub does not need 'fully-up'. stub-first-boot.sh has no pvesh/pct/pveum/qm call
  (grep rc=1); that usage is in felhom-bootstrap.sh under its own After=network-online unit.
  answer.toml.tmpl:27 justifies the current ordering with a dependency that does not exist.
- R-149: the ordering enum has THREE values (before-network, network-online, fully-up), not two.
- MECHANISM (container, not PVE): locked root closes sulogin — 'the root account is locked' for
  both '*' and '!', with a working control. So 'discard' and 'lock' are the SAME outcome for
  recovery, making the escrow decision binary.
- R-150: all four proxmox-first-boot-* units are Condition-guarded; a failed condition is a SKIP,
  so a hook that never ran looks identical to one that succeeded.
- R-151: demo-felhom was installed from an UNCOMMITTED profile — a Tier 0 reference box is not
  reproducible from main.
- Q4: four gates in iso-repack.sh enforce the single-entry menu; default/timeout already settable.

The first mechanism probe was invalid (uid 0 bypassed pam_unix; sulogin had no tty) and a teardown
error (shredding the control plaintext) are both recorded as failures, not massaged.

demo-hp teardown is INCOMPLETE and named as such; the command is recorded, not claimed done.

scripts/CHANGELOG.md

@@ -1,3 +1,39 @@
+## SPIKE 2 (no code change) — before-network gives a zero window by construction; locked root closes sulogin (2026-07-31)
+
+**No script, profile or build file was modified.** Findings:
+`documentation/audits/SPIKE-universal-iso-2-2026-07-31.md`. Opens R-148..R-151.
+
+**Both Tier 0 boxes went offline mid-session** (remote site, 12:28 CEST; four routes tried, our
+tailscale pod healthy). Q1/Q2/Q3 each retain a part that needs a nested VM and those parts are
+**BLOCKED, not answered**. The fixture is staged with Spike 1's two defects already corrected.
+
+Established without them:
+
+- **STRUCTURAL — `ordering = "before-network"` maps to `proxmox-first-boot-network-pre.service`
+  (`proxmox-first-boot` 9.2.5), which is `Before=network-pre.target` + `Type=oneshot`.** It therefore
+  runs to completion before any interface is configured — a credential rotation there has a
+  **zero-length window by construction**, not by being fast. Stronger than the timing number Spike 1
+  failed twice to obtain.
+- **STRUCTURAL — the stub does not need `fully-up`.** `stub-first-boot.sh` contains no
+  `pvesh`/`pct`/`pveum`/`qm` call (grep rc=1); that usage is in `felhom-bootstrap.sh`, which runs under
+  its own `After=network-online.target ... pveproxy.service` unit. So `answer.toml.tmpl:27` justifies
+  the current ordering with a dependency that does not exist. **R-148.**
+- **The ordering enum has THREE values** — `before-network`, `network-online`, `fully-up`. Spike 1
+  recorded two; the middle one has never been evaluated. **R-149.**
+- **MECHANISM (container, not PVE) — a locked root closes `sulogin`:** `Cannot open access to console,
+  the root account is locked.` for both `*` and `!`, with a working control (correct password ->
+  SU_OK, wrong -> Authentication failure). So "discard" and "lock" are the SAME outcome for recovery,
+  which makes the escrow decision binary.
+- **All four `proxmox-first-boot-*` units are `Condition*`-guarded, and a failed condition is a SKIP,
+  not a failure** — a hook that never ran looks exactly like one that succeeded. **R-150.**
+- Q4: the single-entry menu is enforced by **four** gates in `iso-repack.sh` (`:153-155`, `:156`,
+  `:160-164`, `:314-319`), so restoring an interactive entry is a gate change, not a template edit —
+  but the banned-token gate would pass unchanged for a stock Graphical entry. `default`/`timeout` are
+  already settable in `grub/grub.cfg.tmpl`.
+
+The first mechanism probe was invalid (ran as uid 0, so `su` never invoked pam_unix; `sulogin` had no
+tty) and is recorded as failed, not massaged.
+
 ## SPIKE (no code change) — a universal ISO needs a different disk strategy and a locked root (2026-07-31)
 
 **No script, profile or build file was modified.** Findings only: