docs: GL-8 wrap — runbook F3/F6 notes, findings FIXED, REPORT, decision log

day0-install: F3 (no --allow-new-leaf on a populated BYO host) + F6 (:53 must
be free, refusal + remediation). GO-LIVE-PACKAGE + DRILL-GL6 ledger flip
F1/F3/F6 -> FIXED v1.12.0; GL-7 unblocked; F2/F7 stay open. CONTEXT + REPORT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/runbooks/day0-install.md

@@ -240,8 +240,18 @@ What byo does differently (everything else matches C.4's eight steps):
 - `--cores` AND `--memory` are **required** — size them WITH the owner (the guest must never starve
   the owner's guests). `--acl-storages` must name storages that actually exist on the box, or the
   preflight dies naming the missing ones.
-- Preflight additionally prints what already listens on the host's `:53` (informational — Felhom
-  never configures DNS on a byo box) and the existing-guest count.
+- **The host's `:53` must be free** (v1.12.0/F6): Felhom publishes the guest by name on the LAN, so a
+  resolver already bound to `:53` blocks it. byo preflight **REFUSES** (does not touch the owner's
+  service — it is a refusal, not a change) with: *"a resolver is already bound to :53 … stop or
+  reconfigure it, or point your LAN DNS at the guest's address, then re-run."* Clear `:53` (or point
+  the owner's DNS at the guest) and re-run. (Appliance mode is different — there Felhom's own
+  lan_resolver owns `:53`.)
+- **A fresh install on a populated BYO host Just Works** (v1.12.0/F3): the leaf-regeneration guard
+  now fires only when a **Felhom** guest is already present — the owner's own non-Felhom guests no
+  longer trip it, so **`--allow-new-leaf` is NOT needed** on a first install. (You still need
+  `--preserve-state-from` / `--allow-new-leaf` on a reinstall over an existing *Felhom* guest, to
+  protect its pinned fingerprint — unchanged.)
+- Preflight also prints the existing-guest count.
 - At the end of preflight the script prints the **complete host-mutation list** (pveum
   roles/user/token/ACL/pool, agent user/binary/unit/sudoers/config/state, the watchdog + guarded
   wrappers, the guest + golden) and requires typing the host's **short hostname** to proceed —