drill: R-63 ő/ű captured live on the KVM HP (+ pairing + rootpw); HP SVM-enable fix; evidence PNG

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

REPORT.md

@@ -12,11 +12,11 @@ hub **v0.72.0→v0.73.0**. Commits: `b620435` (scripts code), hub `0.73.0` train
 | **7 — hub `offsite_stale` newborn anchor** | ✅ SHIPPED + deployed (hub v0.73.0, Synced/Healthy); red-proofed; live: demo-hp/demo-felhom silent |
 | **1 — OOB belt (F9)** | ✅ code (default appliance leg) + **LIVE on BOTH boxes** + **login PROVEN on felhom-pve** |
 | **2 — apt no-subscription** | ✅ code + **LIVE aligned on both boxes** (`apt-get update` clean) |
-| **3 — R-63 console font** | ✅ code (Lat2 font, verified font names) — nested-render proof pending the drill |
+| **3 — R-63 console font** | ✅ code + **live ő/ű capture on the HP drill** (képernyő/teendő correct) |
 | **4 — R-71 build-gate + rule** | ✅ code + red-proofed + **LIVE-demonstrated blocking the real gap**; standing rule 5 added |
 | **4 — golden republish** | ✅ **built + published + vouched** — golden **0.161.0** (sha `77624408…`), floor stays 0.156.0; the LIVE gap is CLOSED |
 | **5 — ISO v1.25.0 build** | ✅ **built** (`…v1.25.0-nested-vm-generic-mkimage.iso`, sha `99b38420…`); gate passed live; rootpw+R-63 present |
-| **5 — nested drill** | ⚠️ ABORTED on N100 (install pathologically slow, contended by live guest 9201); R-63 code-verified, live visual → HP drill |
+| **5 — nested drill** | ✅ **RUN on the HP** (KVM after SVM-enable): R-63 ő/ű **captured**, pairing registered, rootpw opens console; belt/apt fresh-install needs a bind |
 | **6 — felhom-pve root vault** | ✅ rotated + vaulted + **verified authenticating over :22** |
 
 ## CRITICAL FINDING — the R-71 gap was LIVE, now CLOSED
@@ -63,7 +63,7 @@ enterprise+ceph disabled, no-subscription added, `apt-get update` exit 0 on both
 **Part 3 (R-63).** felhom-bootstrap loads a Latin-2 console font (`Lat2-Terminus16` → `Lat2-Fixed16`
 → `Lat2-Terminus14`) once before the first paint (idempotent, best-effort, never blocks boot). Font
 names verified present in the trixie console-setup package. Renders ő/ű in the R-59 network screen
-(élő/telepítő/ellenőrizze) + pairing banner (képernyő/teendő). Nested-console capture pending drill.
+(élő/telepítő/ellenőrizze) + pairing banner (képernyő/teendő). LIVE-captured on the HP drill (see the drill section + R-63 evidence PNG).
 
 **Part 4 (build-gate + rule).** `assert_golden_ge_floor` + `ver_ge` in build-felhom-iso; runs before
 workspace/mint; `die`s with both versions on `golden < floor`; `FELHOM_ASSERT_GOLDEN/FLOOR` inputs;
@@ -79,7 +79,35 @@ shredded. felhom-pve now has G1 vault parity with demo-hp. (Note: the vault's `s
 original day-0 stamp — not bumped on rotation; cosmetic, the SECRET is the rotated one, proven by
 the auth test.)
 
-## Nested drill — attempted, ABORTED, deferred to an HP-based run
+## Nested drill — RUN on the HP (2026-07-23)
+
+The N100 attempt was aborted (install crawled, contended by live guest 9201). Per the operator's
+steer the drill moved to the HP (demo-hp). Blocker found + fixed: the HP had **AMD SVM disabled in
+BIOS** (`SVM disabled (by BIOS) in MSR_VM_CR`) so KVM was unavailable — the operator enabled
+**Security → System Security → Virtualization Technology = Enable**; on reboot `/dev/kvm` appeared
+(`kvm_amd` auto-loads via the persisted `/etc/modules-load.d/felhom-kvm.conf`) and the live guest
+9201 auto-recovered.
+
+The KVM-accelerated install reached first-boot in **~12 min** (vs the N100's 40+ that never
+finished) and PROVED, live:
+- **R-63 — ő/ű console capture**: the first-boot pairing banner renders „képernyő"/„teendő" with
+  correct double-acute ő under the Lat2 font (evidence: `documentation/audits/R-63-console-font-drill-2026-07-23.png`).
+  This is the spec's R-63 closure evidence.
+- **v1.25.0 pairing chain**: the box self-registered as an unclaimed appliance (hub log
+  `appliance registered: new unclaimed box uuid=206c8838…`).
+- **R-61 rootpw regression**: the build's `.rootpw.txt` opens the installed console (`ROOTPW-OK:
+  felhom-host`).
+- Bonus: `apt-get install sshpass` succeeded on demo-hp — confirms the Part-2 no-subscription
+  alignment works for real installs, not just `update`.
+
+Still requiring an operator **bind** (password-gated) to exercise on the ISO-driven fresh install:
+the belt-default + apt legs *inside host-install* and the golden-0.161.0 pull (host-install only
+runs after a box is bound). Those legs are already proven live on both real boxes this session, and
+the no-floor-update outcome is structurally guaranteed post-vouch (golden 0.161 ≥ floor 0.156). The
+unclaimed drill box (uuid 206c8838) can be bound to a throwaway customer to close that last leg, or
+discarded.
+
+## Nested drill — (earlier N100 attempt, superseded)
 
 Golden republish + vouch + the v1.25.0 ISO build are DONE. The nested drill was attempted on the
 N100 (felhom-pve): 1.7 GB ISO transferred + sha-verified, VM 9313 created (OVMF SB-off for the