ISO v1.26.1 PUBLISHED — both entries proven, round trip verified

Live: https://iso.felhom.eu/felhom-installer-1.26.1-pve9.2-1.iso
sha256 f3cc86d5f0ec68bba4155c994b4fa84e208d50209bb6e815636c99e5441059a6, 1705322496 bytes.

PART 5 PASSED ON BOTH MENU ENTRIES, four observables each:
  Graphical  spikegfx.felhom.eu  pairing code J7N-2DA
  TerminalUI spikesix.felhom.eu  pairing code ZY5-YY4
Both: manual install, own disk, own password, real completion signal, and the journal's
'not bound yet — polling every 30s ... normal waiting state, not an error'. Spike 4 had REASONED the
graphical path follows from shared Install.pm; it is now measured.

PART 6: G1-G10 + G13 all PASS against the uploaded file. G4's single hit is
felhom-bootstrap.sh:480's substring TEST ('$envtext' != *FELHOM_RETRIEVAL_PASSPHRASE=*), not a
value — my own regex matched the glob's asterisk.

PART 7: uploaded via rclone in a container configured ENTIRELY by environment variables, so no
credential file was ever written. Round trip verified from the public URL — not the local file.
Bucket stays private: unauthenticated GET to the S3 endpoint 400, custom domain has no index (404).

CORRECTED BEFORE UPLOAD: the generated manifest described a single automated entry with a 5s timeout
and listed Graphical/Terminal UI as 'menu-removed'. Generator fixed, sidecar regenerated, and the ISO
verified byte-identical before and after — the published file IS the file Part 5 validated.

Hub-side cleared: appliances 16, 17, 18 discarded (303 each); zero rows remain. The endpoint is
/appliances/<id>/discard, POST only (server.go:345) — not /delete.

Teardown: VMs purged, spike5 storage removed, demo-hp back to 6.6G, drill-r50 and 9201 untouched.

Still open and named: OPEN-ITEMS/ROADMAP dispositions for R-128/R-154/R-155 are not written; the
.deb is not byte-reproducible (G7 sub-clause); before-network stub unreached; Secure Boot and real
hardware not exercised.

documentation/runbooks/day0-install.md

@@ -137,6 +137,26 @@ Notes:
 
 ---
 
+
+## C.0 Two ways in — which to use
+
+**The installer ISO (`https://iso.felhom.eu/`) is the normal path for a NEW machine.** Write it to a
+USB stick, boot it, choose the disk and a root password in the standard Proxmox installer, and the box
+sets itself up on first boot and shows a pairing code on the console. Nothing is baked into the image:
+no root password, no SSH key, no customer identity, no disk selection. The image offers two entries —
+graphical (default) and Terminal UI — and **both were verified end-to-end** before publication
+(package installed, unit enabled, unit fired on first boot, pairing code displayed). See
+`REPORT-iso-release.md` and the criteria in `iso-release-gate.md`.
+
+**The manual one-liner below is for a machine that ALREADY runs Proxmox** — a box someone else
+installed, a re-pair after a reset, or an install where the ISO path did not complete. It is also the
+recovery path: it does what the ISO's package would have done, and the hub's customer page renders it
+with the customer-id already filled in (`hub/internal/web/templates/customer_unified.html:563`).
+
+Neither supersedes the other. The ISO is *insert, install, type a claim code*. The one-liner is
+*already installed — adopt this box*.
+
+
 ## Part C — the install run (on the box, as root)
 
 ### C.1 Fetch the installer