ISO v1.26.1 PUBLISHED — both entries proven, round trip verified

Live: https://iso.felhom.eu/felhom-installer-1.26.1-pve9.2-1.iso
sha256 f3cc86d5f0ec68bba4155c994b4fa84e208d50209bb6e815636c99e5441059a6, 1705322496 bytes.

PART 5 PASSED ON BOTH MENU ENTRIES, four observables each:
  Graphical  spikegfx.felhom.eu  pairing code J7N-2DA
  TerminalUI spikesix.felhom.eu  pairing code ZY5-YY4
Both: manual install, own disk, own password, real completion signal, and the journal's
'not bound yet — polling every 30s ... normal waiting state, not an error'. Spike 4 had REASONED the
graphical path follows from shared Install.pm; it is now measured.

PART 6: G1-G10 + G13 all PASS against the uploaded file. G4's single hit is
felhom-bootstrap.sh:480's substring TEST ('$envtext' != *FELHOM_RETRIEVAL_PASSPHRASE=*), not a
value — my own regex matched the glob's asterisk.

PART 7: uploaded via rclone in a container configured ENTIRELY by environment variables, so no
credential file was ever written. Round trip verified from the public URL — not the local file.
Bucket stays private: unauthenticated GET to the S3 endpoint 400, custom domain has no index (404).

CORRECTED BEFORE UPLOAD: the generated manifest described a single automated entry with a 5s timeout
and listed Graphical/Terminal UI as 'menu-removed'. Generator fixed, sidecar regenerated, and the ISO
verified byte-identical before and after — the published file IS the file Part 5 validated.

Hub-side cleared: appliances 16, 17, 18 discarded (303 each); zero rows remain. The endpoint is
/appliances/<id>/discard, POST only (server.go:345) — not /delete.

Teardown: VMs purged, spike5 storage removed, demo-hp back to 6.6G, drill-r50 and 9201 untouched.

Still open and named: OPEN-ITEMS/ROADMAP dispositions for R-128/R-154/R-155 are not written; the
.deb is not byte-reproducible (G7 sub-clause); before-network stub unreached; Secure Boot and real
hardware not exercised.

scripts/CHANGELOG.md

@@ -1,3 +1,44 @@
+## ISO v1.26.1 — the PUBLIC installer ISO, PUBLISHED (2026-07-31)
+
+**Live at `https://iso.felhom.eu/felhom-installer-1.26.1-pve9.2-1.iso`**
+sha256 `f3cc86d5f0ec68bba4155c994b4fa84e208d50209bb6e815636c99e5441059a6`, 1 705 322 496 bytes,
+with its `.sha256` and manifest beside it. Round-trip verified: the bytes downloaded from the public
+URL checksum to the same value. Bucket `Public Access` stays disabled — an unauthenticated GET to the
+S3 endpoint returns 400, and the custom domain has no index (404 on `/`).
+
+**What it is.** Write it to a USB stick, boot it, choose your own disk and your own root password in
+the standard Proxmox installer. The box sets itself up on first boot and shows a pairing code. The
+image carries **no answer file, no root password, no SSH key, no customer identity and no disk
+profile** — the entire Spike 1-2 problem space is deleted rather than mitigated.
+
+**How day-0 is delivered.** A `felhom-bootstrap` .deb in `/proxmox/packages/`, which the PVE installer
+unpacks on EVERY install path including the interactive one (`Install.pm:1343-1372`, `:1378`). The
+answer file's `[first-boot]` hook does NOT reach an interactive install — measured in
+SPIKE-universal-iso-3 with a same-image control.
+
+**PROVEN ON BOTH MENU ENTRIES** before publication, four observables each:
+  graphical (`spikegfx.felhom.eu`)  package installed, unit enabled, unit fired at first boot,
+                                    pairing code `J7N-2DA`, token 0600
+  Terminal UI (`spikesix.felhom.eu`) same, pairing code `ZY5-YY4`
+
+**One defect was caught by that gate and fixed before publication:** the package did not ship
+`/etc/felhom/`, so the first build registered at the hub and then polled `HTTP 401` forever with no
+claim code ever shown. G9 proved the payload script was byte-identical to HEAD and said nothing about
+the directory the payload writes into. Fixed, plus gate criterion **G13** (every directory the payload
+writes into is in the package), red-proofed.
+
+**A second false claim was caught before publication:** the generated manifest — the file a tester
+reads — described a single automated entry with a 5s timeout and listed Graphical/Terminal UI as
+'menu-removed'. It now describes the image it ships.
+
+Menu: two INTERACTIVE entries, graphical default, **timeout 15s** (Spike 2 lost a probe to a
+1-second menu). No automated entry exists at all: without `auto-installer-mode.toml` the stock
+grub.cfg does not emit it.
+
+R-128 FIXED (the ISO/SCRIPT_VERSION 'alignment' was a comment nothing evaluated; the coupling does not
+exist, so the claim was corrected rather than asserted). R-155 RESOLVED (guard narrowed to
+`FELHOM_MENU=single`, not deleted). Release gate: `documentation/runbooks/iso-release-gate.md`.
+
 ## SPIKE 4 (no code change) — a `.deb` in the ISO DOES deliver on an interactive install (2026-07-31)
 
 **No script, profile or build file was modified.** Findings: