morning 2026-10-22: ISO 1.30.0 published (W1, W7; gate + proof installs on both entries); download pages point at it; rows 184 -> 178 (closed R-1192, R-1177, R-1178, R-1180, R-1195, R-1199, R-1210; opened R-1216 the host-swap check too strict); STATUS, CONTEXT, report

2026-10-22 10:51:24 +02:00
parent 115f15c89e
commit a92837410a
26 changed files with 316 additions and 39 deletions
@@ -16,6 +16,18 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.


+> **2026-10-22 morning — the operator's five yeses, carried out.** Controller **0.338.0** released (image
+> `sha256:e8a529f3…`, MinAgent 0.158.1): Tester 1, demo-hp, demo-felhom through per-customer floors, checks green
+> (https-only 28/28, 0 unhealthy, 0 errors), then the global floor 0.338.0 (read back with the WAL). Agent **0.162.0**
+> released (`5fd7a23b…` = the soak's bytes) and delivered by signed job to the same three; **the vouch is the
+> operator's**. Hub **0.164.0** deployed (only `Deployment/hub` synced). ISO **1.30.0** (W1, W7) built, gated (G1–G16,
+> G12 not re-read) and proof-installed from both menu entries on demo-hp, published, round trip `590d7b9b…`; both
+> download pages point at it and carry the W2 button. Operator answer: Tester 2's laptop was installed with our
+> installer (R-1207). **Found:** the host-swap check (agent WARN, hub `host_swap_short`, the controller's install
+> sentence) compares host swap with the guests' WHOLE swap allowance, so every box with a guest above ~8 GB trips it
+> (demo-hp, demo-felhom mailed) though the soak burst used 2.7 GB — R-1216, decision D28. The runbook's G16 command
+> was stale (now `scripts/iso_bootstrap_gate.py`). Record: `REPORT-morning-2026-10-22.md`.
+
 > **2026-10-21 night (unattended; nothing released, deployed, published or vouched).** Operator rulings recorded:
 > **D22 = yes (20:05)** — D20's put-back extended to the local unit restore, the second-drive restores and a restore cut by
 > a power loss (`07` §6.3, the 2026-10-21 `[DESIGN]` paragraph; controller `d582feb`, proven on 9202 with 0.338.0-rc.1:
@@ -0,0 +1,61 @@
+# REPORT — the morning of 2026-10-22: the operator's five yeses
+
+**Operator answers:** release controller 0.338.0 — yes; release and vouch agent 0.162.0 — yes; deploy hub 0.164.0 — yes
+(Tester4 host deleted); Tester 2's laptop — installed with our installer; publish items — yes, all. Design read:
+`07` §6.3 (restore put-back), `03` §9 (guest sizing), the felhom-build-deploy runbooks, `runbooks/iso-release-gate.md`.
+
+## Decisions taken by CC
+
+None new. The night's R-1199 decision (a box with no saved notification choice pushes its page's default list) now
+ships in controller 0.338.0 — *operator may reverse*.
+
+## What was done
+
+| | what | result |
+|---|---|---|
+| agent | `release-agent.sh 0.162.0` from a clean clone at `b310773` | sha256 `5fd7a23bfe319cb521c4bc399612d5fb3413f1e695f79bc663c386f69c757928` (= the soak's bytes), bundle `ac772967…60b5a5`, tag `v0.162.0`, round trip OK |
+| agent | one signed `agent_update` per box: demo-hp, Tester 1, demo-felhom (07:41 UTC) | all three `update committed`, `ok=76 total=76`, `guest-swap: raised` for 9201 (512 MB → RAM); `pct config` swap = memory on all three |
+| hub | manifest `0.163.0 → 0.164.0` (`0b7a5ab3`), only `Deployment/hub` synced | running `sha256:931594e3…` (= the night's build), log `felhom-hub 0.164.0 starting` |
+| controller | `build.sh 0.338.0 --push` from `7900a32` | `sha256:e8a529f395bfe8c0e7b87d5d98929a6f8e9834aa13c0ab77bd214ee9e7e53433` |
+| controller | per-customer floors (tester-1, demo-hp, demo-felhom), MinAgent 0.158.1 | all three on 0.338.0 within 10 s (agent `controller-swap: new controller healthy`); https-only 28/28 + control; 10/24/9 containers, 0 unhealthy, 0 restarting; 0 `level=ERROR` |
+| controller | global floor 0.338.0 / MinAgent 0.158.1 with CC's hub token | `303 → flash=floor_set`; hub DB (with WAL): `min_controller_version=0.338.0`, `0.338.0=0.158.1`; the three per-customer floors cleared |
+| website | the W2 patch (`6b391a63`), site gates OK | live on felhom.eu/letoltes.html and /en/download |
+| ISO | 1.30.0 `--release` from `115f15c8` | `590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1`, 1 705 324 544 B; gate G1–G16 PASS (G12 not re-read); proof installs from BOTH entries (VMs 9341, 9342), first boot + one reboot; W1 seen on screen; published, round trip identical; both download pages point at 1.30.0 |
+
+Evidence: `documentation/audits/morning-2026-10-22/release/`, `documentation/tests/iso-release-1.30.0-2026-10-22/`.
+
+## What broke
+
+- **The host-swap check is too strict (R-1216, D28).** Within minutes of agent 0.162.0 demo-hp (host swap 8191 MB vs
+  guests 25898 MB) and demo-felhom (8191 vs 12288) warned and the hub mailed `host_swap_short`. The check compares host
+  swap with the guests' whole swap allowance; the installer gives at most 8 GB, the soak's burst used 2.7 GB. The same
+  comparison drives the controller's install-page sentence. Not fixed: the threshold is the operator's pick.
+- **A stale runbook command (fixed).** `iso-release-gate.md` G16 mounted `scripts/iso` as `/work`; the harness needs
+  `golden/` and `postinst` staged, so 10 checks failed on a correct tree. Now names `scripts/iso_bootstrap_gate.py`
+  (73 checks green). My first run with the old line left harness scratch files in `scripts/iso/` (root-owned); removed
+  by name before any commit.
+
+## Rows
+
+Before 184, after 178. Opened 1 (R-1216). Closed 7: R-1192, R-1177, R-1178, R-1180, R-1195, R-1199, R-1210. Updated:
+R-1194 (released; WATCHING for the next fresh install; owner CC), R-1207 (Tester 2 = our installer). Section headers
+recounted (Backup & restore read 44, held 42).
+
+## Waiting on the operator
+
+1. **Vouch agent 0.162.0** (Configs → Day-0 artifacts). If not: new installs get 0.161.0, without the swap fix.
+2. **Discard appliances 47 and 48** (the proof installs). If not: two „unclaimed" rows stay.
+3. **D28** — loosen the host-swap check (A, CC's pick) or keep it (B).
+4. **Tester 2** is off; when it is back, CC sends it agent 0.162.0.
+5. The secret names `REHEARSAL_2026_10_20_*`, `FIXES_2026_10_21_*`, `NIGHT_2026_10_21_*` are KEPT (the proof installs
+   used the night's root password); say „remove" to drop them.
+
+## Teardown
+
+- **Machine:** VMs 9341, 9342 destroyed (names checked); ISO 1.30.0 kept in demo-hp `local:iso`. No thin-pool write.
+- **Host:** demo-hp, Tester 1, demo-felhom now on agent 0.162.0 and controller 0.338.0 — intended, not torn down.
+- **Hub:** appliances 47, 48 for the operator to discard; floors: global 0.338.0, no per-customer floor left.
+
+## Instruction files / poster
+
+No instruction file changed. No system-poster fact changed (versions are not poster facts).
@@ -1,8 +1,8 @@
 # STATUS — what works, what's broken, what's next

-**Ready for the first real tester (Tester 2)? No — three morning yeses left:** release the controller (restore put-back, first-hour words), release and vouch the agent (the swap fix — the night soak says yes), deploy the hub. Tester 2 is off; nothing was sent to it.
+**Ready for the first real tester (Tester 2)? Nearly — one click left:** vouch agent 0.162.0 (Configs → Day-0 artifacts), so new boxes install it. Tester 2 is off; nothing was sent to it.

-**Updated 2026-10-22 (morning, after the night run).** A failed or cut restore now puts the data back and starts the app (proven on the scratch box); clearer first-hour texts; a host short of swap is reported. Built and tested, nothing released.
+**Updated 2026-10-22 (morning, your yeses).** Released: controller 0.338.0 (global floor), agent 0.162.0 (on the 3 test boxes), hub 0.164.0, installer 1.30.0 and the website download button. The new host-swap check warns on boxes bigger than 8 GB; that is too strict (decide D28).

 ## What works
 - A box installs from nothing with the public installer, links to the hub, and moves to the floor by itself (map A1, A3, A4).
@@ -15,7 +15,6 @@
 - The hub mails alarms and recoveries, and keeps one whole-box copy per week on ep0; CC uses its own limited token, not your password (map F1, F11, G15).

 ## What is broken
- **P1:** the 8 GB box can freeze for minutes under big uploads until the agent with the swap fix is released (R-1192; the night soak says the fix works — morning list item 2).
 - **P1:** about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
 - Two root-level weaknesses wait on your decisions D3 and D4 (R-985, R-982).
 - Tester 2 is off since 2026-10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862).
@@ -31,13 +30,14 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te

 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
-| D27 | R-1207 | A host with no swap gets nothing from the swap fix, and the agent never adds swap. Add host swap automatically (BYO too), or refuse an 8 GB host without swap at install? | **Report only for now** (our installer gives 7.75 GB; the alarm and the install-page sentence now tell you) — decide after the first BYO box | Add it: the agent changes a disk its owner set up; refuse: a BYO household cannot start | a no-swap host can still freeze; you get the alarm | — |
+| D28 | R-1216 | The host-swap check warns when host swap is below the guests' whole swap. A 16 GB box with the installer's 8 GB swap trips it, but the soak used 2.7 GB. Loosen it to „below what the installer gives"? | **Loosen it (A)** (no mail for a healthy box; 938 MB still warns) | Keep (B): you get a mail per big box, and the install page tells such a household to call us | demo-hp and demo-felhom stay flagged; one mail each, already sent | — |
+| D27 | R-1207 | A host with no swap gets nothing from the swap fix, and the agent never adds swap. Add host swap automatically (BYO too), or refuse an 8 GB host without swap at install? | **Report only for now** (our installer gives 7.75 GB, and Tester 2's laptop used our installer; the alarm and the install-page sentence now tell you) — decide after the first BYO box | Add it: the agent changes a disk its owner set up; refuse: a BYO household cannot start | a no-swap host can still freeze; you get the alarm | — |
 | D21 | R-49 | Immich's off-site copy: leave out only the AI model files now (B), or also the raw database folder and Immich's own backups (A)? | **B now** (−62 %, no new risk); A's other parts after their proof | A: −92 %, but it needs a restore path we have never run | every Immich box sends about 12 times its real data off-site each night | — |
 | D9 | R-1062 | Split the N100's USB drive in two, for multi-drive tests? | **No — keep one drive** (the lived-in box keeps its nightly whole-box backup) | Split: the box loses its local whole-box backup, or you buy a second drive first | it stays one drive; multi-drive tests stay on Tester 1 | — |
 | D8 | R-206 | Install DooPlex's Docker settings from git (Docker restarts once), with a weekly build-cache prune? | **Yes, in a quiet window** (a rebuilt DooPlex then keeps the settings) | No: the live settings stay hand-made, and a rebuild loses them | git and the host can drift apart | — |
 | D7 | R-990, R-989 | Rule on the forum ideas and the selfh.st ideas now, or park them? | **Park them** (P4; nothing waits on them) | Rule now: about one hour of reading | nothing changes; the research gets old | — |
 | D6 | R-992 | The scratch box cannot read the private drill catalog: give it a read-only login, or make that copy public? | **A read-only login** (the drill catalog stays private) | Public copy: anyone can read the drill catalog | every new-app test needs staging by hand | new-app tests |
-| D5 | R-991 | Approve the minimum machine: x86-64, 4 cores, 8 GB RAM, 256 GB SSD (recommended: 16 GB, 512 GB)? | **Approve** (measured on the N100 with 61 apps) — **but wait for R-1192**: an 8 GB box froze on its first afternoon, 2026-10-20 | Change it: one edit | no hardware page; a buyer with a Raspberry Pi can still download the installer | the hardware page |
+| D5 | R-991 | Approve the minimum machine: x86-64, 4 cores, 8 GB RAM, 256 GB SSD (recommended: 16 GB, 512 GB)? | **Approve** (measured on the N100 with 61 apps) — the 8 GB freeze of 2026-10-20 is fixed by agent 0.162.0 (11 h soak on a fresh 8 GB box, no freeze) | Change it: one edit | no hardware page; a buyer with a Raspberry Pi can still download the installer | the hardware page |
 | D4 | R-982 | Stop root SSH with a password from the household network (key only)? | **Yes — key only** (the password stays for the console) | Keep it: anyone on the household network can try the password | the host keeps accepting root password logins from the LAN | — |
 | D3 | R-985 | Our „zero-knowledge" wording is stronger than the product: change the wording, or remove the operator's root reach to the key? | **Change the wording now**; look again after the first sale | Remove the reach: a design change to break-glass | the website promises more than the product does | the website text |

@@ -52,12 +52,11 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14.
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12.

-**Morning list, 2026-10-22.** CC decided one thing (you may reverse it): a box tells the hub the notification list its page shows, even if never saved (R-1199; the rehearsal household got 1 alarm of 9).
-1. Release controller 0.338.0 (restore put-back incl. power cut, first-hour words, swap sentence)? On the scratch box a damaged backup and a killed controller both kept the newest data, app running (R-1177, R-1195, R-1178, R-1180).
-2. Release and vouch agent 0.162.0 (swap = RAM, host-swap check, no false door alarm — R-1192, R-1194)? Soak, 11 h on a fresh 8 GB box: no freeze, every check answered, every night job ran; memory pressure passed the 20 % line for 3 min in the 03:30 backup (R-1214). With no host swap the freeze comes back; our installer gives 7.75 GB. I'd release.
-3. Deploy hub 0.164.0 (host-swap alarm, bind-page words)? And delete the test host „Tester4-9aca27" (machine gone; my token cannot delete).
-4. How was Tester 2's laptop installed — our installer, or its own Proxmox? (Without host swap the fix does not help.)
-5. A publish: the website download button (patch ready), and with the next ISO the boot text and the cleared screen (R-1210). Secrets: keep or remove the `REHEARSAL_2026_10_20_*`, `FIXES_2026_10_21_*`, `NIGHT_2026_10_21_*` names in sec.
+**Today, 2026-10-22.**
+1. Vouch agent 0.162.0 (Configs → Day-0 artifacts; sha256 `5fd7a23b…`, bundle `ac772967…`). If not: new boxes install 0.161.0, without the swap fix.
+2. Discard the two test appliances 47 and 48 on the Hosts page (the installer proof). If not: they stay as „unclaimed".
+3. Decide D28 above. If not: big boxes keep the warning.
+4. When Tester 2 is back on: say so, and I send it agent 0.162.0 (the swap fix).
 **The rest**
 - Pull the failed disk Z6A07P2G out of DooPlex (R-934). If not: its alarms return on 11 November. Since 2026-10-12.
 - Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). Since 2026-10-09.
@@ -26,6 +26,18 @@

 ---

+## 2026-10-22 morning — the releases (full text of the rows: `git show 115f15c8:documentation/backlog/OPEN-ITEMS.md`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1210** | **Three first-hour words from the rehearsal wait for a publish:** (P3) | CLOSED 2026-10-22 — W2 published (website `6b391a63`: „Letöltés (1,6 GB)" / „Download (1.6 GB)"); W1 + W7 shipped in ISO **1.30.0**, published after its gate and two proof installs (W1 seen on the boot screen; W7 by test — the bound banner needs a bind); both download pages point at 1.30.0. Full row text: `git show 115f15c8:documentation/backlog/OPEN-ITEMS.md`. | `documentation/tests/iso-release-1.30.0-2026-10-22/` |
+| **R-1192** | **On the minimum machine (8 GB), the household's first afternoon froze the box for about an hour: the dashboard and every app stopped answering, and only pulling the plug brought it back.** (P1) | CLOSED 2026-10-22 — agent **v0.162.0** released (operator yes) and delivered to demo-hp, Tester 1, demo-felhom: each logged `guest-swap: raised` and `pct config` reads swap = memory (25898/25898, 12288/12288, 4096/4096). Night soak on a fresh 8 GB box: 11 h, no freeze. The vouch is the operator's. Follow-ups: R-1207 (no host swap), R-1214 (tier2 pressure), R-1216 (the host-swap check too strict). | `audits/morning-2026-10-22/release/04-agent-delivery.txt`, `audits/night-2026-10-21/P1-soak/` |
+| **R-1177** | **A local restore that fails destroys the household's live data and keeps no copy of it: the app is left broken.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (released on the operator's yes; on Tester 1, demo-hp and demo-felhom through the floor, then the global floor 0.338.0). Proven the night before on 9202: a damaged backup kept the newest row and the app ran. | `audits/night-2026-10-21/P3-*`, `audits/morning-2026-10-22/release/` |
+| **R-1178** | **The second drive's „Teljes visszaállítás" can change files, then refuse the database half, leave the app STOPPED, and tell the household „the app and its data are untouched".** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (`UnitRestoreOptions.CheckOnly`: a refusal moves nothing); test-proven. | controller CHANGELOG v0.338.0 |
+| **R-1180** | **The nightly second-drive mirror (`rsync --delete`) can run DURING a restore from that same mirror and delete files not yet copied back.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (the night's mirror skips an app while its restore runs); test-proven. | controller CHANGELOG v0.338.0 |
+| **R-1195** | **A power cut in the middle of a full off-site restore can leave the app running on the BACKUP's data while the page says only „the restore was interrupted, start it again" — the household's newer data is gone and nothing says so.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0**; proven on 9202 the night before (a controller killed mid-restore → put back at the next start, the record says so in Hungarian). | `audits/night-2026-10-21/P3-*` |
+| **R-1199** | **The household's notification page shows disk-warning, drive-disconnected and backup-failed mails switched ON, but on the rehearsal day only the OPERATOR got them — the household's mailbox received one alarm (a failed off-site run) out of nine.** (P2) | CLOSED 2026-10-22 — the hub mailed the household by a list saved 2026-10-18, before the box existed; the box never pushed its own because it pushes only a saved choice. Fixed in controller `ba22f9b` (a box with no saved choice pushes the default list its page shows, no address), shipped in **v0.338.0**. *Decided by CC unattended 2026-10-21 — operator may reverse* (the box's page is the source, `08`). `TestR1199_*` red-proved. | `REPORT-night-2026-10-21.md` §6, `audits/night-2026-10-21/P5-checks/` |
+
 ## 2026-10-21 night — the CI time limit of the decoy suite (full text of the row: `git show f576d7f7:documentation/backlog/OPEN-ITEMS.md`)

 | Row | What | Closed | Evidence |
@@ -7,6 +7,8 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S

 ## Moved from STATUS on 2026-10-22

+**Updated 2026-10-22 (morning, after the night run).** A failed or cut restore now puts the data back and starts the app (proven on the scratch box); clearer first-hour texts; a host short of swap is reported. Built and tested, nothing released.
+
 **Updated 2026-10-21 (evening).** A rebuilt box now gets the household's off-site backups back (hub 0.163.0, proven live: 3 031 files byte-identical), and shared folders, imported apps and away drives keep their copies and locks (controller 0.337.0, the floor). The 8 GB freeze is explained — the guest's swap was capped at 512 MB — and the agent fix is ready but not released. Report: `REPORT-fixes-2026-10-21.md`.

 ## Moved from STATUS on 2026-10-21
@@ -327,4 +327,4 @@ release report. A criterion with no recorded observation is a criterion that was
 **The ONE home for a release's record is `documentation/tests/iso-release-<version>-<date>/`** (R-588,
 2026-10-05) — one directory per published ISO, so „was the gate run for this image?" is answered by looking,
 not by a full-text search for a checksum. A record made elsewhere (inside an audit) gets a directory here
-whose `README.md` points at it. Today: 1.27.0, 1.27.1, 1.28.0 (pointer), 1.29.0.
+whose `README.md` points at it. Today: 1.27.0, 1.27.1, 1.28.0 (pointer), 1.29.0, 1.30.0.
@@ -0,0 +1,67 @@
+# ISO release 1.30.0 — PUBLISHED 2026-10-22 (W1 boot text, W7 the bound banner clears the screen)
+
+| | |
+|---|---|
+| file | `felhom-installer-1.30.0-pve9.2-1.iso` |
+| sha256 | `590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1` |
+| size | 1 705 324 544 bytes |
+| base | Proxmox VE 9.2-1 (`4e88fe41…c2c6c`) |
+| source | felhom.eu `115f15c8` (clean and pushed; the build's own clean-tree gate) — W1/W7 from `2fa5b8f3`, the version bump `6d5a7f1b` |
+| published | `https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso` (+ `.sha256`, `.manifest.txt`) |
+| rollback | `felhom-installer-1.29.0-pve9.2-1.iso` (sha `dceacae5…`) stays online (HTTP 200 after the publish); rolling back is one edit on the two download pages |
+| decided by | the operator's yes, 2026-10-22 morning („Publish items — Yes, all") |
+
+**What changed (felhom.eu R-1210, the rehearsal's first-hour words):**
+- **W1** — the graphical entry's boot line is in the te-form: „A Felhom telepítése indul — válaszd ki a lemezt a
+  telepítőben..." (was „válassza ki"). Seen on the screen: `w1-boot-text.png`.
+- **W7** — when the box is linked, the bound banner first clears the screen AND its scroll-back
+  (`\033[3J\033[H\033[2J`), so the spent pairing code is not left readable. Pinned by
+  `scripts/iso/test/test_bound_banner_clears.py` (with a decoy); **not seen live** — the bound banner shows only after a
+  bind, and the proof installs were not bound (no customer was made for them).
+
+## The criteria, each with its observed value (run on the exact file that was uploaded)
+
+`static-gate.txt` holds the raw output of every static check below.
+
+| | verdict | observed |
+|---|---|---|
+| G1 no `answer.toml` | **PASS** | root-level `answer.toml` / `auto-installer-mode.toml` → 0 |
+| G2 no root password | **PASS** | `root-password`, `$6$`, `$y$`, `$2[aby]$` across every added path + the extracted package → 0; the build said `root-pw: NONE`, no `.rootpw.txt` in the publish source |
+| G3 no SSH key | **PASS** | `root-ssh-keys`, `ssh-rsa`, `ssh-ed25519`, `ssh-dss` → 0 |
+| G4 no customer identity | **PASS** | two hits, both variables: `Bearer $token` (line 534) and a `*FELHOM_RETRIEVAL_PASSPHRASE=*` pattern test (line 553) |
+| G5 enumeration | **PASS** | added vs stock: `/boot/grub/felhomtheme/` (2 files) and `/proxmox/packages/felhom-bootstrap_1.30.0_all.deb`; removed: `/boot/grub/pvetheme/` — the same set as 1.29.0. PEM headers, `token=`/`password=`/`passphrase=`/`api_key=` with ≥ 12-char values → 0 |
+| G6 boot menu | **PASS** | 2 menuentries, `timeout=15`, `timeout_style=menu`, `default=0`; `proxdebug`/`Rescue Boot`/`memtest`/`fwsetup` → 0 |
+| G7 package | **PASS** | one `felhom-bootstrap 1.30.0`, no `Depends`; `dpkg-query` on both installs: `install ok installed` |
+| G8 postinst | **PASS** | `systemctl start/daemon-reload/restart` → 1 and `set -e` → 1 are both the postinst's own header COMMENTS (lines 10–11, „NO `set -e`", „NO systemctl start") — no command; no curl/wget/apt/nc/ping; last line `exit 0`. Unchanged since 1.29.0 (`eb1ae370`) |
+| G9 payload = repo HEAD | **PASS** | `felhom-bootstrap.sh` `8dbb173d…36adfb` and the unit `cf2e4678…a69af3` — extracted = repo, `cmp` IDENTICAL; the installed copy on both boxes has the same sha |
+| G10 committed | **PASS** | the build's clean-tree gate (HEAD = origin/main, no untracked file); the manifest names the commit |
+| G11 checksum + round trip | **PASS** | downloaded from `iso.felhom.eu`: 1 705 324 544 B, sha256 `590d7b9b…74d5cc1` = the built file = the published `.sha256` (both side files HTTP 200) |
+| G12 bucket private | **NOT RE-READ** | nothing in this release touches the bucket; the token is object-scoped and cannot read the bucket's setting |
+| G13 directories | **PASS** | `./etc/felhom/`, `./usr/local/sbin/`, `./lib/systemd/system/` in the package |
+| G14 a person chooses the disk | **PASS** | `filter.` in the added text → 0; observed on BOTH entries: graphical `Target Harddisk /dev/sda (32.00GiB, QEMU HARDDISK)` with a selector (`gfx-disk.png`), text `Target harddisk: < /dev/sda (QEMU HARDDISK) (32.00 GiB) >` (`tui-disk.png`); both summaries show the disk before erasing |
+| G15 console after first boot AND one reboot | **PASS** | both installs, both boots: `grep -c 8006 /etc/issue` → **0**; `Felhom otthoni szerver` → 1; `Felhom home server` → 1; `pvebanner.service` → **masked** (`checks-*.txt`); the text install's screen after the reboot is pixel-identical to the first boot |
+| G16 Hungarian first, secrets once | **PASS** | `python3 scripts/iso_bootstrap_gate.py` → 73 harness checks green, its decoy convicted; `jelszavad` 0, `Tulajdonosi jelmondat` 1, `Owner passphrase` 1, negative control `zzqx-not-there` 0 |
+
+**The runbook's G16 command was stale** and is corrected in the same session: it mounted `scripts/iso` as `/work`, where
+`golden/` and `postinst` do not sit, so 10 checks failed on a correct tree (the same 10 failed on the commit before W7).
+`scripts/iso_bootstrap_gate.py` stages the inputs and is now the named command.
+
+## The proof installs — BOTH menu entries, on the built file (sha checked on demo-hp before boot)
+
+Nested VMs on demo-hp, 4 GiB RAM, 32 GB disk on `nvme-scratch`, the Hungarian keyboard kept, destroyed afterwards.
+
+| | entry | VM | result |
+|---|---|---|---|
+| 1 | `Felhom telepítés / Install Felhom` (graphical) | 9341 | installed, first boot + one reboot: package installed, unit `enabled` and fired on both boots, a pairing code in `/etc/felhom/appliance-pairing-code`, all G15 checks |
+| 2 | `Felhom telepítés (szöveges mód) / text` | 9342 | the same, all pass |
+
+The installer gave each 4 GB machine a 3.8 GB host swap (`SwapTotal` 4 005 884 kB) — the installer's swap = RAM rule
+the swap fix relies on (felhom.eu R-1192, R-1207). Pairing codes are blanked in the committed screendumps.
+
+## Teardown
+
+- **Machine:** VMs 9341 and 9342 destroyed (`qm destroy --purge`, names checked first); no disk directory left on
+  `nvme-scratch`. The ISO stays in demo-hp's `local:iso` beside 1.27.1–1.29.0, for the next proof.
+- **Hub:** the two unclaimed appliance registrations the proof installs made (**ids 47 and 48**, `registered`) are
+  the OPERATOR's to discard (Hosts page → Discard) — no token can do it (`05` §17.3).
+- **Off-site:** nothing (an unbound appliance provisions nothing).
@@ -0,0 +1,17 @@
+host: proofgfx  boot: 2026-10-22 10:39:27
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 8; first: Oct 22 10:39:51 proofgfx felhom-bootstrap.sh[1072]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008428 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
+--- after one reboot
+host: proofgfx  boot: 2026-10-22 10:41:41
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 6; first: Oct 22 10:41:53 proofgfx felhom-bootstrap.sh[1008]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008428 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
@@ -0,0 +1,17 @@
+host: prooftui  boot: 2026-10-22 10:41:41
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 8; first: Oct 22 10:42:00 prooftui felhom-bootstrap.sh[1050]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008424 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
+--- after one reboot
+host: prooftui  boot: 2026-10-22 10:43:54
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 3; first: Oct 22 10:44:06 prooftui felhom-bootstrap.sh[1018]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008420 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
@@ -0,0 +1,26 @@
+Felhom bare-metal ISO build manifest (R-21 slice A+B+C)
+built              : 2026-10-22T10:24:15+02:00
+iso-version-tag    : iso-v1.30.0   (the git tag this image's source carries, when tagged — NOT installer-v*, the host-install script's line)
+pve-version        : 9.2-1
+source-iso         : proxmox-ve_9.2-1.iso
+source-iso-sha256  : 4e88fe416df9b527624a175f24c9aa07c714d3332afb1ee3dbf3879573ef2c6c
+assistant-version  : proxmox-installer-common v9.2.8
+profile            : none (a release image bakes no disk selection)
+fqdn               : (none — interactive install)
+mode               : release (PUBLIC image — NO answer.toml, NO baked credential, interactive disk selection)
+loader             : shim (stock MS-signed chain; Secure Boot OK on compliant firmware)
+grub-mkimage       : unknown
+boot-menu          : FELHOM release menu — TWO INTERACTIVE entries ('Felhom telepítés' graphical = default, 'Felhom telepítés (szöveges mód)' = Terminal UI), timeout 15s
+menu-entries       : 2 (graphical default + Terminal UI; timeout 15s)
+menu-removed       : debug variants, Rescue Boot, memtest86+, UEFI Firmware Settings
+automated-entry    : NOT PRESENT — no auto-installer-mode.toml, so the stock grub.cfg does
+                     not emit it. Disk selection is INTERACTIVE by construction.
+host-install-url   : https://felhom.eu/scripts/felhom-host-install.sh (default)
+secret-bearing     : no   (PUBLIC image — carries NO credential of any kind)
+root-password      : NONE — not baked. The installer prompts the person installing (release gate G2).
+answer-file        : NONE — no answer.toml, no auto-installer-mode.toml (release gate G1)
+felhom-package     : felhom-bootstrap_1.30.0_all.deb sha256=fb224e733e312f992492109f9c29e455bba3471ade254c26494e2dee639fb910
+repo-commit        : 115f15c89e82b6002235a2c132cf30570a3cedfd   (clean tree, = origin/main at build time — the clean-tree gate, R-730)
+output             : felhom-installer-1.30.0-pve9.2-1.iso
+output-sha256      : 590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1
+output-size-bytes  : 1705324544
@@ -0,0 +1 @@
+590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1  felhom-installer-1.30.0-pve9.2-1.iso
@@ -0,0 +1,62 @@
+== G1 answer.toml/auto-installer-mode.toml at root (want 0)
+0
+== G5 paths added vs stock:
+'/boot/grub/felhomtheme'
+'/boot/grub/felhomtheme/background.png'
+'/boot/grub/felhomtheme/theme.txt'
+'/proxmox/packages/felhom-bootstrap_1.30.0_all.deb'
+== G5 paths removed vs stock:
+'/boot/grub/pvetheme'
+'/boot/grub/pvetheme/logo.png'
+'/boot/grub/pvetheme/theme.txt'
+deb: <extract>/x/proxmox/packages/felhom-bootstrap_1.30.0_all.deb
+== G2 root-password / crypt hash (want 0)
+0
+== G3 ssh keys (want 0)
+0
+== G4 identity with a value (lines, want only empty decls / variables)
+<extract>/debx/usr/local/sbin/felhom-bootstrap.sh:534:            -H "Authorization: Bearer $token" "$HUB_URL/api/v1/appliance/poll" 2>/dev/null)
+<extract>/debx/usr/local/sbin/felhom-bootstrap.sh:553:            if [[ -z "$envtext" || "$envtext" != *FELHOM_RETRIEVAL_PASSPHRASE=* ]]; then
+== G5 secret patterns (PEM, token=, password=, passphrase=, api_key=)
+(end)
+== G6 menuentries / settings / banned
+2
+set timeout_style=menu
+set timeout=15
+set default=0
+menuentry 'Felhom telepítés / Install Felhom' --class felhom --class os {
+menuentry 'Felhom telepítés (szöveges mód) / text' --class felhom --class os {
+0
+== W1 boot text (te-form 'valaszd' want>=1, formal 'valassza' want 0) — ASCII fragments with controls
+1
+0
+1
+== G7 package
+1
+ Package: felhom-bootstrap
+ Version: 1.30.0
+== G8 postinst
+1
+0
+1
+exit 0
+== G9 payload = repo HEAD
+8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb <extract>/debx/usr/local/sbin/felhom-bootstrap.sh
+8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb /repo/scripts/iso/felhom-bootstrap.sh
+cf2e4678e9ef5ab8439f7fc8522e4a61b031222243eea8916ea0efa6dca69af3 <extract>/debx/lib/systemd/system/felhom-bootstrap.service
+cf2e4678e9ef5ab8439f7fc8522e4a61b031222243eea8916ea0efa6dca69af3 /repo/scripts/iso/felhom-bootstrap.service
+script IDENTICAL
+unit IDENTICAL
+== W7 clear in the shipped bound banner (ASCII fragment)
+98:    # W7 (rehearsal 2026-10-20): clear the screen AND its scroll-back first — the spent pairing code stayed readable
+100:    { printf '\033[3J\033[H\033[2J'
+296:        # judged on the lease's OWN addressing/routing, so clear vmbr0 first; the restore path (and
+312:        pkill -x dhclient 2>/dev/null   # F-P4: clear the failed/killed client before the next candidate
+== G13 dirs
+./etc/felhom/
+./lib/systemd/system/
+./usr/local/sbin/
+== G14 filter. in added text files (want 0)
+0
+== G16 secret names in the shipped script
+jelszavad=0 Tulajdonosi jelmondat=1 Owner passphrase=1 NEGATIVE-control zzqx-not-there=0
@@ -1,4 +1,11 @@
-## 2026-10-22 — a real download button on the download pages (W2, operator yes)
+## 2026-10-22 — the download pages point at installer 1.30.0 (W1, W7; operator yes)
+
+- `letoltes.html` and `en/download.html`: version, both links, the side-file link, the two check commands and the SHA-256
+  now name `felhom-installer-1.30.0-pve9.2-1.iso` (`590d7b9b…74d5cc1`, the same 1 705 324 544 bytes). Published and
+  verified by round trip first; the gate record is `documentation/tests/iso-release-1.30.0-2026-10-22/`. 1.29.0 stays
+  online for a one-edit rollback.
+
+## 2026-10-22 — a real download button on the download pages (W2, operator yes)

 - `letoltes.html` „Letöltés (1,6 GB)" and `en/download.html` „Download (1.6 GB)": a `.btn` link to the ISO above the
  file name, so the household sees one obvious button (the rehearsal's first-hour word W2, felhom.eu R-1210). The
@@ -100,17 +100,17 @@
            <div class="container">
                <div class="section-header">
                    <h2>Download</h2>
-                    <p>Felhom installer 1.29.0 (based on Proxmox VE 9.2)</p>
+                    <p>Felhom installer 1.30.0 (based on Proxmox VE 9.2)</p>
                </div>
                <div class="info-card">
-                    <p><a class="btn" href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso" download>Download (1.6 GB)</a></p>
-                    <p><a href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso"><strong>felhom-installer-1.29.0-pve9.2-1.iso</strong></a> – 1.6 GB (1,705,324,544 bytes)</p>
+                    <p><a class="btn" href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso" download>Download (1.6 GB)</a></p>
+                    <p><a href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso"><strong>felhom-installer-1.30.0-pve9.2-1.iso</strong></a> – 1.6 GB (1,705,324,544 bytes)</p>
                    <p>Checksum (SHA-256):</p>
                    <div class="highlight-box">
-                        <p><code>dceacae5da247d76cad065bf6c0d3bbefac8d8a5f8e571db2fd8449a97e94829</code></p>
+                        <p><code>590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1</code></p>
                    </div>
-                    <p>The same checksum as a file: <a href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso.sha256">felhom-installer-1.29.0-pve9.2-1.iso.sha256</a></p>
-                    <p>To check it on Linux or macOS: <code>sha256sum felhom-installer-1.29.0-pve9.2-1.iso</code>. On Windows, in PowerShell: <code>Get-FileHash felhom-installer-1.29.0-pve9.2-1.iso</code>. The string it prints must match the one above. If it does not match, do not use the file – download it again.</p>
+                    <p>The same checksum as a file: <a href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso.sha256">felhom-installer-1.30.0-pve9.2-1.iso.sha256</a></p>
+                    <p>To check it on Linux or macOS: <code>sha256sum felhom-installer-1.30.0-pve9.2-1.iso</code>. On Windows, in PowerShell: <code>Get-FileHash felhom-installer-1.30.0-pve9.2-1.iso</code>. The string it prints must match the one above. If it does not match, do not use the file – download it again.</p>
                    <p>The downloaded file has to be written to a USB stick of at least 4 GB (with Balena Etcher or Rufus, for example). The guide covers that too.</p>
                </div>
            </div>
@@ -100,17 +100,17 @@
            <div class="container">
                <div class="section-header">
                    <h2>Letöltés</h2>
-                    <p>Felhom telepítő 1.29.0 (Proxmox VE 9.2 alapon)</p>
+                    <p>Felhom telepítő 1.30.0 (Proxmox VE 9.2 alapon)</p>
                </div>
                <div class="info-card">
-                    <p><a class="btn" href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso" download>Letöltés (1,6 GB)</a></p>
-                    <p><a href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso"><strong>felhom-installer-1.29.0-pve9.2-1.iso</strong></a> – 1,6 GB (1 705 324 544 bájt)</p>
+                    <p><a class="btn" href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso" download>Letöltés (1,6 GB)</a></p>
+                    <p><a href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso"><strong>felhom-installer-1.30.0-pve9.2-1.iso</strong></a> – 1,6 GB (1 705 324 544 bájt)</p>
                    <p>Ellenőrző összeg (SHA-256):</p>
                    <div class="highlight-box">
-                        <p><code>dceacae5da247d76cad065bf6c0d3bbefac8d8a5f8e571db2fd8449a97e94829</code></p>
+                        <p><code>590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1</code></p>
                    </div>
-                    <p>Ugyanez letölthető fájlként is: <a href="https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso.sha256">felhom-installer-1.29.0-pve9.2-1.iso.sha256</a></p>
-                    <p>Ellenőrzés Linuxon vagy Macen: <code>sha256sum felhom-installer-1.29.0-pve9.2-1.iso</code>. Windowson PowerShellben: <code>Get-FileHash felhom-installer-1.29.0-pve9.2-1.iso</code>. A kiírt számsornak meg kell egyeznie a fentivel. Ha nem egyezik, ne használd a fájlt, és töltsd le újra.</p>
+                    <p>Ugyanez letölthető fájlként is: <a href="https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso.sha256">felhom-installer-1.30.0-pve9.2-1.iso.sha256</a></p>
+                    <p>Ellenőrzés Linuxon vagy Macen: <code>sha256sum felhom-installer-1.30.0-pve9.2-1.iso</code>. Windowson PowerShellben: <code>Get-FileHash felhom-installer-1.30.0-pve9.2-1.iso</code>. A kiírt számsornak meg kell egyeznie a fentivel. Ha nem egyezik, ne használd a fájlt, és töltsd le újra.</p>
                    <p>A letöltött fájlt egy legalább 4 GB-os USB kulcsra kell írni (például a Balena Etcher vagy a Rufus programmal). Az útmutató ezt is leírja.</p>
                </div>
            </div>
				`@@ -0,0 +1 @@`
				`590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1 felhom-installer-1.30.0-pve9.2-1.iso`