ISO train v1.25.0 code: OOB belt default appliance leg (F9) + apt no-subscription (Part2) + R-63 Lat2 console font + R-71 golden>=floor build gate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

scripts/iso/build-felhom-iso.sh

@@ -41,7 +41,7 @@
 #===============================================================================
 set -euo pipefail
 
-ISO_VERSION="1.24.0"   # Felhom release the ISO is tagged to (aligns with felhom-host-install SCRIPT_VERSION).
+ISO_VERSION="1.25.0"   # Felhom release the ISO is tagged to (aligns with felhom-host-install SCRIPT_VERSION).
 IMAGE="${FELHOM_ISO_ASSISTANT_IMAGE:-felhom-iso-assistant:trixie}"
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -56,6 +56,29 @@ log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
 log_dry()     { echo -e "${CYAN}[DRY-RUN]${NC} $1"; }
 die()         { log_error "$1"; exit 1; }
 
+# ver_ge A B → true iff version A >= version B (dotted numeric, sort -V).
+ver_ge() { [[ "$1" == "$2" ]] && return 0; [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -1)" == "$1" ]]; }
+
+# R-71 STANDING GATE (v1.25.0): every ISO build asserts the golden it will install is >= the managed
+# controller floor. If the floor exceeds golden, a freshly-installed box boots BELOW the floor and the
+# day-0 managed update fires — racing the offsite apply-bridge exactly as it did on demo-hp
+# (DIAG-f10-demo-hp-offsite-2026-07-23 / R-71). The build must fail loudly rather than ship that gap.
+# Inputs: FELHOM_ASSERT_GOLDEN + FELHOM_ASSERT_FLOOR (the hub's current artifact_golden_version and
+# min_controller_version — resolve them operator-side and pass in; the publish-train runbook covers
+# how). Both printed. If either is unset the gate is UNENFORCED and says so LOUDLY (never a silent pass).
+assert_golden_ge_floor() {
+    local golden="${FELHOM_ASSERT_GOLDEN:-}" floor="${FELHOM_ASSERT_FLOOR:-}"
+    if [[ -z "$golden" || -z "$floor" ]]; then
+        log_warn "R-71 golden>=floor gate UNENFORCED — pass FELHOM_ASSERT_GOLDEN + FELHOM_ASSERT_FLOOR to enforce (golden='${golden:-unset}' floor='${floor:-unset}')"
+        return 0
+    fi
+    if ver_ge "$golden" "$floor"; then
+        log_success "R-71 gate OK: golden $golden >= managed floor $floor"
+    else
+        die "R-71 BUILD GATE FAILED: golden $golden < managed floor $floor — a fresh box would boot below the floor and the day-0 update would race the offsite apply-bridge. Republish golden >= $floor (and vouch it) before building this ISO."
+    fi
+}
+
 PVE_ISO=""; ISO_SHA256=""; PROFILE=""; BOOTSTRAP_ENV=""; OUT_DIR="${FELHOM_ISO_OUT:-/mnt/5_hdd/felhom.eu/felhom-iso/out}"; PVE_VERSION=""; DRY_RUN=false
 LOADER_CLI=""   # --loader override; empty = fall back to the profile, then the shim default.
 PAIRING=false   # --pairing: build the GENERIC secret-free ISO (slice C); no --bootstrap-env.
@@ -205,6 +228,9 @@ else
     log_warn "this ISO will be SECRET-BEARING (embeds the customer retrieval passphrase) — supervised/single-use only"
 fi
 
+# R-71 build gate — before any workspace/mint/build work commits (fails fast + loud).
+assert_golden_ge_floor
+
 # --- workspace ------------------------------------------------------------------------------------
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/felhom-iso.XXXXXX")"
 # chmod first: the mkimage surgery's osirrox extract leaves read-only file modes that rm can't clear.

scripts/iso/felhom-bootstrap.sh

@@ -64,6 +64,7 @@ log() { echo "felhom-bootstrap: $*"; }
 print_pairing_banner() {
     local code; code=$(cat "$PAIRING_CODE_FILE" 2>/dev/null)
     [[ -n "$code" ]] || return 0
+    set_console_font   # R-63: ő/ű-capable font before painting (once)
     { printf '\n================================================\n'
       printf '  Felhom — a doboz készen áll, és a párosításra vár.\n\n'
       printf '  Párosító kód:  %s\n\n' "$code"
@@ -109,6 +110,26 @@ SWEEP_DHCP_TIMEOUT=20    # F-P1/F-P4: a real lease lands in ~3s; a dead NIC neve
 HUB_PROBE_TIMEOUT=10
 GATE_ORIG_COPY=/run/felhom-interfaces.orig
 
+# R-63 (v1.25.0): the kernel's default console font lacks the Hungarian double-acute ő/ű glyphs, so
+# the R-59 network screen (élő / telepítő / ellenőrizze) and the pairing banner (képernyő / teendő)
+# rendered them as blanks. Load a Latin-2 console font ONCE before the first paint — idempotent and
+# strictly best-effort: a missing font or an ioctl failure (e.g. a serial console) must NEVER block
+# the boot. Lat2 fonts ship in the trixie/PVE base (console-setup), so no copy rewording is needed.
+FONT_SET=0
+set_console_font() {
+    [[ "$FONT_SET" == 1 ]] && return 0
+    FONT_SET=1
+    command -v setfont >/dev/null 2>&1 || return 0
+    local fnt
+    for fnt in Lat2-Terminus16 Lat2-Fixed16 Lat2-Terminus14; do
+        if setfont "$fnt" -C "$CONSOLE_DEV" >/dev/null 2>&1 || setfont "$fnt" >/dev/null 2>&1; then
+            log "console font -> $fnt (Latin-2, ő/ű capable)"
+            return 0
+        fi
+    done
+    log "console font: no Latin-2 font loaded (setfont unavailable/failed) — accented chars may show as boxes"
+}
+
 hub_reachable() {
     # F-P5: ANY HTTP status proves TLS+HTTP reachability (the hub answers / with a 302); only
     # 000/empty means no contact.
@@ -231,6 +252,7 @@ paint_network_screen() {
     # R-59: the legible refuse-loudly screen (print_pairing_banner pattern — /dev/console, stdout
     # fallback). Calm adult Hungarian; spec-fixed copy.
     local table="$1" fbnote="$2"
+    set_console_font   # R-63: ő/ű-capable font before painting (once)
     { printf '\n================================================\n'
       printf '  Felhom — Nincs hálózati kapcsolat: a doboz nem éri\n'
       printf '  el a felhom.eu szolgáltatást.\n\n'