# REPORT — E-2d fresh-VM run: STOPPED at Phase 0 (2026-07-29)

`RUNBOOK-e2d-fresh-vm-2026-07-29.md`, executed by CC on DooPlex. Full evidence:
`documentation/audits/E2D-fresh-vm-2026-07-29.md`. Written as `REPORT-e2d.md` per the runbook §8.5;
root `REPORT.md` untouched.

**Outcome: no VM created, no install run, no box touched, no teardown needed.** The run stopped at the
Phase 0 gate, per §3 (*"If any gate fails, STOP and report — do not adapt around it"*).

## Why

`felhom-host-install.sh` does not install what is on `main`. It resolves the hub-vouched manifest
(`:423-436`) and fetches **Gitea generic packages** (agent `:1945`, golden `:2573`). Gitea's newest are
**agent `0.96.0`** and **golden `0.161.0`**; the hub's saved manifest selects exactly those; the global
controller floor is `v0.156.0`, below the golden's 0.161.0, so no self-update follows.

| Component | Fresh install gets | `main` / demo boxes |
|---|---|---|
| host-install | **1.22.0** | 1.22.0 |
| agent | **0.96.0** | 0.113.0 — **never published**, direct-deployed |
| controller | **0.161.0** | 0.185.1 |

## Claims

| Claim | Verdict | Pinned to |
|---|---|---|
| C1 — real rc=0 install of 1.22.0 | **ACHIEVABLE, not run** | installer-side |
| C2 — Case B fires naturally | **ACHIEVABLE, not run** | `felhom-host-install.sh:627`, `:653-655` |
| C3 — degraded banner renders | **BLOCKED** | controller v0.185.1 `cdaeb36`; copy v0.185.0 `3f7cf2a` |
| C4 — offer moves the target | **BLOCKED** | controller v0.185.1 + agent v0.113.0 `58b598b` |
| C5 — `backup_target_absent` e2e | **BLOCKED** | controller v0.184.0 `c1a63de` + agent v0.112.0 |

C3 unblocks by raising the hub floor to ≥0.185.0 (controller 0.185.1 **is** in the registry); measured
fleet impact nil — both demo boxes already run 0.185.1, Peti is DOWN 14 d and already below the current
floor. C4/C5 need agent 0.112.0/0.113.0 **published**, which runbook §0 forbids this run from doing.

## Filed

**R-111 (P1)** — the Day-0 artifact channel is 17 agent releases stale. v0.97.0–v0.113.0 unpublished,
stranding the entire R-82 tiered-backup arc plus **F-CRIT-2** and **F-REBOOT**. A new customer's box
installs without them. Mirror of R-110, not a duplicate: R-110 = publishes instantly with no staging;
R-111 = the publish gate exists and was never walked.

## Record

- `OPEN-ITEMS.md` — **R-111 opened** (READY (M), P1). **E-2d re-stated**, not closed: the attempt, the
  blocker, the C1/C2-vs-C3/C4/C5 split, and every Phase 0 answer so a resumed run does not re-derive them.
- `ROADMAP.md` — R-111 filed under **P1 — closed-alpha blockers**.
- `architecture/00-capability-map.md` — **not touched.** Nothing was proven live; no row qualifies.

## Not done

C1–C5 all unproven. No VM, no ISO boot, no appliance registered/bound/discarded, no storage created or
modified on demo-hp, no drive attached or detached, no hub setting written (the floor was read only),
no code written.

The runbook's **§5.1a operator STOP is retired**: `HUB_PW` is in `~/.config/credentials` and hub auth
was verified working, so CC can perform the bind itself on a resumed run.