SPIKE: a universal ISO needs a different disk strategy and a locked root

Findings only — no script, profile or build file changed; no ISO built, nothing published.
documentation/audits/SPIKE-universal-iso-2026-07-31.md

- R-139 (HIGH): a disk filter matching >1 device does NOT fail safe. Observed in a nested VM —
  the installer silently picked one of two matching disks and wiped it; validate-answer accepts
  such an answer. The 'filter did not match any devices' guard covers the ZERO-match case only.
- No udev property distinguishes an internal system disk from external media. Measured on
  demo-felhom with its 1TB external attached: ID_BUS='ata' for BOTH, lsblk RM=0 for both, and
  device-info exposes no removability property. demo-hp's NVMe carries no ID_BUS/ID_TYPE at all.
- R-141 (HIGH): the answer schema makes a root credential mandatory, but root-password-hashed='*'
  validates AND installs to completion. [first-boot].ordering accepts 'before-network', the only
  ordering that closes the exposure window structurally.
- Q3: prepare-iso leaves grub.cfg byte-identical to stock (15 entries, automated AND interactive)
  — a two-entry menu is purely a Felhom grub.cfg.tmpl change.
- R-129 resolved: demo-hp's key is the operator's own, added post-install; demo-felhom's IS baked
  by an uncommitted profile.

The reachable-before-rotation measurement FAILED twice and is recorded as failed, not inferred.

Opens R-139..R-147; restates R-128.

scripts/CHANGELOG.md

@@ -1,3 +1,30 @@
+## SPIKE (no code change) — a universal ISO needs a different disk strategy and a locked root (2026-07-31)
+
+**No script, profile or build file was modified.** Findings only:
+`documentation/audits/SPIKE-universal-iso-2026-07-31.md`. Opened R-139..R-147; restated R-128.
+
+Three results that constrain any future universal-ISO spec:
+
+- **A disk filter matching more than one device does not fail safe.** Observed in a nested VM: with
+  `filter.ID_SERIAL_SHORT = "SPIKE*"` matching two disks and `filesystem = "ext4"`, the installer
+  silently picked one and wiped it (`disk0` hash changed, `disk1` byte-identical). `validate-answer`
+  accepts such an answer. The `filter did not match any devices` guard covers the ZERO-match case
+  only. **R-139.**
+- **No udev property distinguishes an internal system disk from external media.** Measured on
+  `demo-felhom` with its 1 TB external drive attached: `ID_BUS` is `ata` for *both* (the external is a
+  SATA drive in a USB caddy), `lsblk RM` is `0` for both, and `device-info` exposes no removability
+  property at all. On `demo-hp` the NVMe carries no `ID_BUS` or `ID_TYPE` whatsoever. Nothing
+  expresses *role*. **R-141 context.**
+- **A root credential is mandatory in the answer schema, but a usable one is not.**
+  `root-password-hashed = "*"` validates and installs to completion (guest powered off after 200 s
+  with `reboot-mode = "power-off"`). `[first-boot].ordering` also accepts `before-network`, which is
+  the only ordering that could close the exposure window structurally — today's bootstrap unit is
+  `After=network-online.target pveproxy.service` and the pairing poll waits indefinitely. **R-141.**
+
+Also: `prepare-iso` leaves `grub.cfg` byte-identical to stock (15 menu entries, automated **and**
+interactive), so a two-entry boot menu is purely a change to Felhom's own `grub.cfg.tmpl` — the
+single-entry menu is Felhom's repack, not a constraint of ISO preparation.
+
 ## v1.22.0 — E-2 Part 2: new boxes get a real backup target, or are told they do not (2026-07-29)
 
 Every box installed before this got `local_backup_target: "local"` — the vzdump target on the SAME