# ISO release 1.30.0 — PUBLISHED 2026-10-22 (W1 boot text, W7 the bound banner clears the screen)

| | |
|---|---|
| file | `felhom-installer-1.30.0-pve9.2-1.iso` |
| sha256 | `590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1` |
| size | 1 705 324 544 bytes |
| base | Proxmox VE 9.2-1 (`4e88fe41…c2c6c`) |
| source | felhom.eu `115f15c8` (clean and pushed; the build's own clean-tree gate) — W1/W7 from `2fa5b8f3`, the version bump `6d5a7f1b` |
| published | `https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso` (+ `.sha256`, `.manifest.txt`) |
| rollback | `felhom-installer-1.29.0-pve9.2-1.iso` (sha `dceacae5…`) stays online (HTTP 200 after the publish); rolling back is one edit on the two download pages |
| decided by | the operator's yes, 2026-10-22 morning („Publish items — Yes, all") |

**What changed (felhom.eu R-1210, the rehearsal's first-hour words):**
- **W1** — the graphical entry's boot line is in the te-form: „A Felhom telepítése indul — válaszd ki a lemezt a
  telepítőben..." (was „válassza ki"). Seen on the screen: `w1-boot-text.png`.
- **W7** — when the box is linked, the bound banner first clears the screen AND its scroll-back
  (`\033[3J\033[H\033[2J`), so the spent pairing code is not left readable. Pinned by
  `scripts/iso/test/test_bound_banner_clears.py` (with a decoy); **not seen live** — the bound banner shows only after a
  bind, and the proof installs were not bound (no customer was made for them).

## The criteria, each with its observed value (run on the exact file that was uploaded)

`static-gate.txt` holds the raw output of every static check below.

| | verdict | observed |
|---|---|---|
| G1 no `answer.toml` | **PASS** | root-level `answer.toml` / `auto-installer-mode.toml` → 0 |
| G2 no root password | **PASS** | `root-password`, `$6$`, `$y$`, `$2[aby]$` across every added path + the extracted package → 0; the build said `root-pw: NONE`, no `.rootpw.txt` in the publish source |
| G3 no SSH key | **PASS** | `root-ssh-keys`, `ssh-rsa`, `ssh-ed25519`, `ssh-dss` → 0 |
| G4 no customer identity | **PASS** | two hits, both variables: `Bearer $token` (line 534) and a `*FELHOM_RETRIEVAL_PASSPHRASE=*` pattern test (line 553) |
| G5 enumeration | **PASS** | added vs stock: `/boot/grub/felhomtheme/` (2 files) and `/proxmox/packages/felhom-bootstrap_1.30.0_all.deb`; removed: `/boot/grub/pvetheme/` — the same set as 1.29.0. PEM headers, `token=`/`password=`/`passphrase=`/`api_key=` with ≥ 12-char values → 0 |
| G6 boot menu | **PASS** | 2 menuentries, `timeout=15`, `timeout_style=menu`, `default=0`; `proxdebug`/`Rescue Boot`/`memtest`/`fwsetup` → 0 |
| G7 package | **PASS** | one `felhom-bootstrap 1.30.0`, no `Depends`; `dpkg-query` on both installs: `install ok installed` |
| G8 postinst | **PASS** | `systemctl start/daemon-reload/restart` → 1 and `set -e` → 1 are both the postinst's own header COMMENTS (lines 10–11, „NO `set -e`", „NO systemctl start") — no command; no curl/wget/apt/nc/ping; last line `exit 0`. Unchanged since 1.29.0 (`eb1ae370`) |
| G9 payload = repo HEAD | **PASS** | `felhom-bootstrap.sh` `8dbb173d…36adfb` and the unit `cf2e4678…a69af3` — extracted = repo, `cmp` IDENTICAL; the installed copy on both boxes has the same sha |
| G10 committed | **PASS** | the build's clean-tree gate (HEAD = origin/main, no untracked file); the manifest names the commit |
| G11 checksum + round trip | **PASS** | downloaded from `iso.felhom.eu`: 1 705 324 544 B, sha256 `590d7b9b…74d5cc1` = the built file = the published `.sha256` (both side files HTTP 200) |
| G12 bucket private | **NOT RE-READ** | nothing in this release touches the bucket; the token is object-scoped and cannot read the bucket's setting |
| G13 directories | **PASS** | `./etc/felhom/`, `./usr/local/sbin/`, `./lib/systemd/system/` in the package |
| G14 a person chooses the disk | **PASS** | `filter.` in the added text → 0; observed on BOTH entries: graphical `Target Harddisk /dev/sda (32.00GiB, QEMU HARDDISK)` with a selector (`gfx-disk.png`), text `Target harddisk: < /dev/sda (QEMU HARDDISK) (32.00 GiB) >` (`tui-disk.png`); both summaries show the disk before erasing |
| G15 console after first boot AND one reboot | **PASS** | both installs, both boots: `grep -c 8006 /etc/issue` → **0**; `Felhom otthoni szerver` → 1; `Felhom home server` → 1; `pvebanner.service` → **masked** (`checks-*.txt`); the text install's screen after the reboot is pixel-identical to the first boot |
| G16 Hungarian first, secrets once | **PASS** | `python3 scripts/iso_bootstrap_gate.py` → 73 harness checks green, its decoy convicted; `jelszavad` 0, `Tulajdonosi jelmondat` 1, `Owner passphrase` 1, negative control `zzqx-not-there` 0 |

**The runbook's G16 command was stale** and is corrected in the same session: it mounted `scripts/iso` as `/work`, where
`golden/` and `postinst` do not sit, so 10 checks failed on a correct tree (the same 10 failed on the commit before W7).
`scripts/iso_bootstrap_gate.py` stages the inputs and is now the named command.

## The proof installs — BOTH menu entries, on the built file (sha checked on demo-hp before boot)

Nested VMs on demo-hp, 4 GiB RAM, 32 GB disk on `nvme-scratch`, the Hungarian keyboard kept, destroyed afterwards.

| | entry | VM | result |
|---|---|---|---|
| 1 | `Felhom telepítés / Install Felhom` (graphical) | 9341 | installed, first boot + one reboot: package installed, unit `enabled` and fired on both boots, a pairing code in `/etc/felhom/appliance-pairing-code`, all G15 checks |
| 2 | `Felhom telepítés (szöveges mód) / text` | 9342 | the same, all pass |

The installer gave each 4 GB machine a 3.8 GB host swap (`SwapTotal` 4 005 884 kB) — the installer's swap = RAM rule
the swap fix relies on (felhom.eu R-1192, R-1207). Pairing codes are blanked in the committed screendumps.

## Teardown

- **Machine:** VMs 9341 and 9342 destroyed (`qm destroy --purge`, names checked first); no disk directory left on
  `nvme-scratch`. The ISO stays in demo-hp's `local:iso` beside 1.27.1–1.29.0, for the next proof.
- **Hub:** the two unclaimed appliance registrations the proof installs made (**ids 47 and 48**, `registered`) are
  the OPERATOR's to discard (Hosts page → Discard) — no token can do it (`05` §17.3).
- **Off-site:** nothing (an unbound appliance provisions nothing).