docs(v1.24.0): R-59/R-60/R-61 SHIPPED — CHANGELOG, README, ROADMAP (+R-62), runbook, capability map, drill evidence, REPORT

Virgin-ISO nested drill closed the train: dead-NIC install baked the fallback (incl. the dead default gateway), the R-59 screen painted (capture committed beside the spike doc), the cable move healed + registered at the hub in 23s unaided, and the build's rootpw file matched the installed box's shadow hash. R-59 SHIPPED with the recorded deviation (first-boot gate; installer-initrd abort out of scope by operator ack). R-60 SHIPPED (spike + drill cited; F-P9 route-flush fix included). R-61 slice 1 SHIPPED. New R-62 row (hub delete-dialog cosmetics, XS). Capability map: new PROVEN-LIVE row (nested != metal, said so). Cleanup verified: felhom-pve interfaces byte-identical, bridge/VMs/ISO removed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU
2026-07-22 11:45:55 +02:00
parent 699325bd8a
commit a12c6f9730
8 changed files with 218 additions and 87 deletions
@@ -93,12 +93,41 @@ second address on vmbr0; default route unchanged.
  The Part-3 gate makes this moot on the no-network path (the gate holds before register), but it
  is worth knowing the line exists.

-## Cleanup state after the probe
+## Part-4 drill — the shipped v1.24.0 ISO, end to end (same day)

-Nested VM 9310 **stopped** (destroyed in Part 4 after the drill re-uses the rig); `vmbr9` +
-host-side `192.168.100.1/24` still mounted for Part 4; felhom-pve `/etc/network/interfaces`
-untouched throughout (imperative `ip link` bridge only; pre-task copy sha
-`c7ace087183cb72e031ad0cd1974b9239d539747528dd19523d993f8e9c4ec7a` — final diff happens at Part-4
-cleanup). The probe box self-registered at the production hub as an unclaimed appliance while its
-network was up (expected; the record can be discarded, or will simply be superseded by the Part-4
-drill box's registration).
+Two drill rounds on the same rig (both NICs on the dead `vmbr9` from `qm create`, so no lease
+exists at ANY point of the install — the strict demo-hp shape):
+
+**Round 1 (VM 9311, first v1.24.0 build) — reproduced the trap AND caught a real gate defect.**
+The installer baked the fallback (`address 192.168.100.2/24` + **`gateway 192.168.100.1`** +
+first NIC) and completed; the gate diagnosed, swept, painted the R-59 screen and retried — but
+after the cable move the heal FAILED and the gate oscillated: the sweep's candidate leased fine,
+yet the hub probe rode the **baked stale default route** (dhclient-script never replaces an
+existing default route) and failed, so the sweep dutifully restored byte-identically every cycle.
+**F-P9 (fix, shipped in `felhom-bootstrap.sh` before the final build): flush vmbr0's
+addresses+routes after the re-point, before the bounded dhclient — a candidate is judged on the
+lease's OWN addressing/routing.** Fix validated by hot-patching 9311 live: heal + hub
+registration 33 s after unit restart (pairing banner with code on the console).
+
+**Round 2 (VM 9312, virgin final ISO `c25cdbbf…`, zero patching) — the full claim:**
+
+| Leg | Evidence |
+|---|---|
+| (a) dead-NIC install reproduces | installer env on 192.168.100.2 at 11:32; installed box: static fallback + dead gateway + `bridge-ports ens18` baked |
+| R-59 screen renders | console screendump committed beside this doc (`SPIKE-firstboot-nic-sweep-2026-07-22-screen.png`): header, NIC table (név/MAC/kábel/sebesség), fallback-signature explanation naming 192.168.100.2, remedy line |
+| failed-sweep restore is safe | after full sweep cycles (with F-P9 flushes) the runtime had `192.168.100.2/24` back on vmbr0 — `ifreload` re-applies the flushed pristine config; interfaces file byte-shape intact |
+| (b) sweep to the moved cable, unaided | net1 → vmbr0 at 11:35:27; `network self-heal: vmbr0 -> ens19` + **hub registration at 11:35:50 — 23 s, no human action**; persisted `iface vmbr0 inet dhcp` + `bridge-ports ens19`, original in `interfaces.felhom-bak`; runtime 192.168.0.88 with a correct default route |
+| (c) unclaimed appliance at the hub | `registered — appliance token stored (0600)`, pairing code delivered + banner on console; unit `activating` in the normal pairing wait |
+| R-61 lockout closed | the build's `.rootpw.txt` password recomputed against the installed box's `/etc/shadow` root hash (`openssl passwd -6 -salt <shadow-salt>`) → **exact match**; comparison done on the build host, the plaintext never left it |
+
+## Cleanup (verified at the end of the run)
+
+Nested VMs 9310/9311/9312 destroyed (`--purge`); `vmbr9` deleted (its temporary
+`192.168.100.1/24` went with it); the transferred ISO and screendump temp files removed from
+felhom-pve; `brctl show` shows vmbr0 with exactly its original ports (`enp1s0`, `veth9201i0`);
+**felhom-pve `/etc/network/interfaces` diffed byte-identical against the pre-task copy** (sha
+`c7ace087183cb72e031ad0cd1974b9239d539747528dd19523d993f8e9c4ec7a`) — the file was never touched
+(the throwaway bridge lived only as an imperative `ip link` object). Residue by design: **three
+unclaimed-appliance registrations at the production hub** (the probe box, the hot-patched drill
+box, the virgin drill box — all three machines destroyed); the operator can discard them from the
+Unclaimed list at leisure.