fresh box: the built ISO 1.28.0 installs — every screen read before every keystroke

Twenty-one screendumps from the machine's own console, because there is no browser
here. The install is configured as a household's would be: ext4 on /dev/sda (the
32 GB system disk; the 100 GB data disk is never offered), Europe/Budapest,
tester1@felhom.eu, tester1.enkicsifelhom.hu, DHCP values untouched.

Two mechanisms measured rather than assumed, and written down so the next session
does not re-derive them: arrow keys do NOT cycle a value row — Enter opens a list;
and one Up from <Next> lands on a CHECKBOX, so the hostname is five rows up, not one.

The „automatically reboot" box is left ticked on purpose: a volunteer would leave it,
and the trap it causes is already a documented finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt

@@ -38,3 +38,106 @@ scsihw: virtio-scsi-single
 ##  graphical entry is drivable by keyboard, but reading it blind costs a screenshot per focus move.
 ##  e1-02-installer.png  „Proxmox VE (9.2-1) Installer — END USER LICENSE AGREEMENT (EULA)",
 ##                      `<I agree>` focused (red). Enter accepts.
+##  e1-03-disk.png      „Target harddisk:  /dev/sda (QEMU HARDDISK) (32.00 GiB)", `<Next>` focused,
+##                      with `<Advanced options>` beside it. The box has TWO disks (32 GB system,
+##                      100 GB data); the installer offers the 32 GB one and a PERSON confirms it —
+##                      the image guesses nothing. That is the release gate's disk criterion (G14)
+##                      seen on this build, not inferred from the previous one.
+##  e1-04-country.png   „Country: Hungary · Timezone: Europe/Budapest · Keyboard layout: Hungarian",
+##                      all three PREFILLED, `<Next>` focused. A Hungarian household gets its own
+##                      country and clock without touching anything.
+##                      DEVIATION (declared, same as the 2026-09-16 drill): the walk switches the
+##                      KEYBOARD to U.S. English for TYPING ONLY, because the next screen needs an
+##                      e-mail address and `@` is not reachable by a plain keycode on the Hungarian
+##                      layout. It is a property of driving the console blind, not of the product.
+##  e1-05-focus-check.png  FOCUS VERIFIED BEFORE ACTING: after one Up, the „Keyboard layout" row is
+##                      highlighted (red, value „Hungarian"). This screendump exists because a blind
+##                      value-cycle on the wrong row would have silently changed the COUNTRY or the
+##                      TIMEZONE instead — the installer's rows all cycle with the same arrow keys.
+##  e1-06-keyboard.png  MEASURED: with the „Keyboard layout" row focused, TWENTY `qm sendkey right`
+##                      presses left the value reading „Hungarian". That is ambiguous on its own —
+##                      either the arrow does not cycle this row, or the list wrapped and came back —
+##                      so the next step is ONE press, which tells the two apart. Recorded rather than
+##                      resolved by assumption, because the obvious reading („the key does nothing")
+##                      would send me rebuilding the whole typing approach for no reason.
+##  e1-07-keyboard-one-right.png  SETTLED: ONE `qm sendkey right` on the focused „Keyboard layout" row
+##                      also leaves „Hungarian". So the arrow does not cycle this row at all — the
+##                      twenty presses did nothing, they did not wrap. (The one-press test exists
+##                      precisely because the twenty-press result could not tell those apart.)
+##                      A measured fact about driving THIS installer blind, not about the product.
+##  e1-08-keyboard-enter.png  THE MECHANISM, established by measurement (four screendumps):
+##                      in this text-mode installer the arrow keys do NOT cycle a row's value;
+##                      ENTER on the focused row opens a selection LIST, which is then driven with
+##                      Up/Down + Enter. The list here runs Belgium-French … United Kingdom, with
+##                      „Hungarian" highlighted as the current value and „U.S. English" 15 entries
+##                      below it. Written down so the next session does not spend four screendumps
+##                      re-learning it.
+##  e1-09-keyboard-list.png  „U.S. English" highlighted after exactly 15 Down presses from
+##                      „Hungarian" (Icelandic … Turkish in between, „United Kingdom" one past it).
+##                      Captured BEFORE the confirming Enter — the rule that keeps a blind walk honest.
+##  e1-10-keyboard-set.png  „Keyboard layout: U.S. English" — and Country „Hungary" + Timezone
+##                      „Europe/Budapest" UNCHANGED beside it. Exactly one value moved, which is the
+##                      point of verifying focus first. The layout switch is a TYPING aid for driving
+##                      the console blind (the next screen needs an `@`), declared as a deviation; a
+##                      volunteer at a real keyboard keeps the Hungarian layout.
+##  e1-11-focus-next.png  Focus back on `<Next>` (highlighted) with the row values standing as
+##                      „Hungary / Europe/Budapest / U.S. English". Verified before the Enter that
+##                      leaves the screen — on this installer Enter on a VALUE row reopens its list
+##                      instead of advancing, so „press Enter to continue" is only true from a button.
+##  e1-12-password.png  „Root password [at least 8 characters]" (focused, empty), „Confirm root
+##                      password", „Administrator email" PREFILLED with `mail@example.invalid`.
+##                      The installer asks for exactly what a household must decide and nothing else.
+##                      The root password used here is a THROWAWAY for a VM that gets destroyed at
+##                      teardown; it is held out-of-band and appears in no committed file.
+##                      The administrator e-mail is replaced with tester1@felhom.eu — the address the
+##                      customer record already uses.
+##  e1-13-password-filled.png  VERIFIED BEFORE ADVANCING: both password fields show 12 masked
+##                      characters (the typed length), and „Administrator email" reads exactly
+##                      `tester1@felhom.eu` — the `@` landed, which is the whole reason the keyboard
+##                      layout was switched. Focus on `<Next>`. The placeholder was cleared with
+##                      End + 26 backspaces before typing, so no remnant of `mail@example.invalid`
+##                      survives (a remnant would be invisible in a masked-looking field later).
+##  e1-14-network.png   „Management interface: nic0 (bc:24:11:45:0c:96, virtio_net)",
+##                      „Hostname (FQDN): pve.example.invalid"  <- the only value a household must change,
+##                      „IP address (CIDR): 192.168.0.101 / 24", „Gateway: 192.168.0.1",
+##                      „DNS server: 192.168.0.250", „[X] Pin network interface names", focus `<Next>`.
+##                      The network came from DHCP and is already correct; note the address is .101
+##                      here, where the 2026-09-16 drill box got .128 — nothing may key off a
+##                      remembered address.
+##  e1-15-network-focus.png  ROW ORDER on the network screen, measured rather than guessed: one Up
+##                      from `<Next>` lands on the „[X] Pin network interface names" CHECKBOX — not on
+##                      a text field. Upward from there: DNS, Gateway, IP address, Hostname. So the
+##                      hostname is five Ups from the button, and a walk that assumed „Up = previous
+##                      text field" would have typed the hostname into the IP address.
+##                      The checkbox stays ticked; no space is sent while it holds focus.
+##  e1-16-hostname-focus.png  Focus VERIFIED in the „Hostname (FQDN)" field (the caret sits at the end
+##                      of `pve.example.invalid`; the checkbox is no longer highlighted and no other
+##                      field shows a cursor). Only then is anything typed.
+##  e1-17-hostname-typed.png  „Hostname (FQDN): tester1.enkicsifelhom.hu" — the placeholder is fully
+##                      gone (End + 26 backspaces before typing), and the IP `192.168.0.101/24`,
+##                      gateway `192.168.0.1`, DNS `192.168.0.250` and the ticked „Pin network
+##                      interface names" are all untouched. One field changed, deliberately.
+##  e1-18-network-next.png  Focus verified on `<Next>` with „tester1.enkicsifelhom.hu" standing and
+##                      the DHCP values unchanged. Five Downs from the hostname field reach the button
+##                      (IP, gateway, DNS, checkbox, `<Next>`) — the same row order measured earlier,
+##                      now walked in the other direction.
+##  e1-19-summary.png   THE SUMMARY, verbatim — what this box is about to become:
+##      Bootdisk filesystem   ext4
+##      Bootdisk(s)           /dev/sda            <- the 32 GB system disk; the 100 GB data disk is NOT touched
+##      Timezone              Europe/Budapest
+##      Keyboard layout       U.S. English        <- the declared typing deviation
+##      Administrator email   tester1@felhom.eu
+##      Management interface  nic0
+##      Hostname              tester1.enkicsifelhom.hu
+##      Host IP (CIDR)        192.168.0.101/24 · Gateway 192.168.0.1 · DNS 192.168.0.250
+##      [X] Automatically reboot after successful installation
+##  THE REBOOT BOX IS LEFT TICKED ON PURPOSE. A volunteer would leave it, and the trap it causes —
+##  the machine re-enters the installer because a guest reboot reuses the running QEMU process's boot
+##  order — is already a measured finding from 2026-09-16. Unticking it would quietly change the path
+##  being walked; the trap is handled afterwards the documented way (cold stop, detach CD, boot disk).
+## 2026-09-16T15:47:53Z INSTALL STARTED (Enter on <Install>, every value verified on e1-19/e1-20)
+##  e1-21-installing.png  25 s after Enter the installer is at „58 %", „extracting
+##                      libjs-extjs_7.0.0-5_all.deb", with only `<Abort>` on screen — the install is
+##                      really running, not a form that silently refused. Captured deliberately early:
+##                      „it started" is a fact worth holding before an eight-minute wait, because a
+##                      stalled form and a running install look identical from outside.