felhom.eu/REPORT.md

REPORT — Runbook refresh: RUNBOOK-onboarding-draft v3 → v4 (docs-only, XS)

Date: 2026-07-22 · Repo: felhom.eu · Scope: documentation only — no code, no version bump, no deploy. The onboarding runbook was refreshed against what shipped 2026-07-18..21 and against the second full onboarding on virgin hardware (HP t740, 2026-07-21).

What changed

documentation/runbooks/RUNBOOK-onboarding-draft-v3.md → RUNBOOK-onboarding-draft-v4.md (git mv, one commit), per the project-Claude refresh brief of 2026-07-21:

1. R-39 interim blocks DELETED (B4 descriptor caveat + E1 manual pvesm status check) — replaced with one sentence each: the DR tier self-detects a dead credential (loud auth_failed) and self-heals via damped re-issue; the hub gauge is trustworthy. Cited: backlog/ROADMAP.md R-39 (CLOSED, proven live 2026-07-21, hub 0.68.1 + agent 0.91.2, 13 s chain applied → auth_failed → applied).
2. R-36 workaround block in C4 DELETED (re-onboarding manual-Save) — replaced with the shipped behaviour: enabled-but-unprovisioned raises an amber banner (hub v0.67.0). R-31 (Save-once/504) and the R-32 orphan-card note KEPT. Consistency follow-through: A1 and the B3 note now say the self-bind link is auto-minted at create/RESET (also R-36) — the manual mint is the re-mint fallback.
3. C1 freemail gate — freemail.hu PROVEN 2026-07-21 (operator test-send received; R-4 COMPLETE per backlog/ROADMAP.md); the check-spam habit line kept.
4. A1 golden note — golden 0.153.0 carries all four infra images; floor-lift proven on TWO shapes (rehearsal 0.143→0.145 in 5 s; virgin HP t740 0.153.0→0.156.0 during day-0, CONTEXT.md). "Rebuild before first tester" softened to a pointer at the standing rule in F.
5. A3 loader note — the single F1 line replaced with the loader table. Deviation from the brief, on the record's side: the brief said "N100/AMI = shim"; the record (operations/nodes.md + tests/VALIDATION-n100-baremetal-2026-07-16.md F1) says the N100 installed with mkimage, SB off — the AMI AN3PLUS firmware cannot relocate the signed GRUB, which is exactly why shim was not usable there. Table written per the record, as the brief's "(SB state as recorded)" directs. HP t740 = shim with Secure Boot ENABLED (2026-07-21).
6. B2/B3 second datapoint — the HP onboarding walked register → pairing banner → unclaimed list → self-bind (code + passphrase) → day-0 → dashboard on never-seen hardware (cited CONTEXT.md + operations/nodes.md). New B2 gotcha: on multi-NIC boards verify the CABLED port got the lease during install (the t740 4-port trap; R-59/R-60 pending).
7. New A5 checklist item — agent train ≥ v0.93.0 (hyphen-free recovery wordlist, felhom-agent/CHANGELOG.md) must be BUILT + DEPLOYED to the customer's box before the FIRST real tester's escrow ceremony; ceremonies run box-side, source-only does not count.
8. D offboarding pointer — R-25b ruling noted: full teardown = DELETE cascade (TASK-I), RESET = identity-preserving re-onboarding; pointer to §G.
9. KEPT unchanged: DRAFT status, the C7 graduation-gate paragraph (still the last unwalked step), all reference wall-clocks, all F rules, all of §G.

Also: backlog/ROADMAP.md R-25b's live pointer updated …draft-v3.md → …draft-v4.md so the citation resolves (historical references in the rehearsal validation doc and past REPORTs left as-is — they describe the file as it was named then).

Not done / unchanged

• C7 not flipped; the capability-map row untouched; no other runbook touched.
• No CHANGELOG entry: this repo's changelogs are per-area (hub/, scripts/, website/) and none of those areas changed; prior docs-only commits (e.g. TASK-H nodes.md) followed the same pattern.

(Previous REPORT — TASK-I, hub v0.69.0/v0.70.0 DELETE cascade — preserved in git history at 9b3381b and summarized in backlog/ROADMAP.md R-25b.)