felhom.eu/documentation/audits/DOORSTEP-walk-1270-2026-09-14.md

DOORSTEP — the first hour again, on the unpublished installer (2026-09-14)

Interventions a volunteer could not have made: 1 — I1 again, now with a different cause (R-505). Ready for a volunteer: NO — because on customer tester-1 the dashboard link answers 503 from our network: the box's tunnel connects but receives no routes. Everything the task changed held.

Evidence: evidence-doorstep-walk-1270-2026-09-14/ — screens-331/, screens-332/, box-logs-331/, A1-power-cut-331.txt, A2-typo-331.txt, step10-remove-observe-331.txt, G15-live-332-iso1271.txt, teardown-*.txt. Gate records: ../tests/iso-release-1.27.0-2026-09-14/, ../tests/iso-release-1.27.1-2026-09-14/. Yesterday's walk for comparison: DRILL-fresh-install-0242-2026-09-14.md and its screens/.

---

0. Phase 0 — why the installer asked questions (named first, because the brief assumed otherwise)

The auto-install never engaged, by construction. The public 1.26.1 manifest (downloaded from iso.felhom.eu) reads answer-file : NONE — no answer.toml, no auto-installer-mode.toml (release gate G1) and automated-entry : NOT PRESENT; build-felhom-iso.sh --release refuses a profile and skips prepare-iso; grub/grub-release.cfg.tmpl explains why — SPIKE-universal-iso-1 measured that no udev property separates an internal disk from a USB backup drive and that a two-disk filter silently wipes one. The operator's 2026-07-31 ruling made the interactive installer the product. Offered an install-time disk rule on 2026-09-14, the operator kept that ruling. The auto-installer has no local chooser or stop page (its modes are a static answer from the image or a partition, or an HTTP answer service), so "no English reaches a volunteer" cannot hold on the installer's own screens; the Felhom-written text around them is Hungarian (G16) and the guide answers each screen.

1. What was built

artifact	change	status
ISO 1.27.0	felhom-bootstrap.sh masks pvebanner + writes Felhom /etc/issue at first boot; banner names the Tulajdonosi jelmondat	built, gated, superseded — its proof install still showed the Proxmox block on the first boot
ISO 1.27.1	the postinst does the mask (symlink) and the issue write at install time; issue text without ő/ű	built, gated PASS, proven live on VM 332, NOT PUBLISHED
hub v0.113.0	hand-over sentence on customer create + Credentials; self-bind mail names the operator	deployed, rendered live on tester-1's page

2. The disk rule, and what a volunteer sees in each case

The installer never picks a disk for you. It lists every disk with size and model; you choose the one the system goes on, and that disk is erased. Unplug the external backup drive during the install. If you do not know which internal disk is right, stop and call the operator.

case	what the screen shows (measured)
one disk (VM 332, TUI and graphical)	TUI: Target harddisk: /dev/sda (QEMU HARDDISK) (64.00 GiB); graphical: „Please verify the installation target … All existing partitions and data will be lost." with Target Harddisk /dev/sda (64.00GiB, QEMU HARDDISK)
three disks (VM 331, TUI)	the same field pre-set to /dev/sda (200.00 GiB); opening it lists /dev/sda (200.00 GiB), /dev/sdb (50.00 GiB), /dev/sdc (50.00 GiB) (screen 331-s07); the installer does not ask "which one?" by itself — the guide's disk row covers it
nobody at the keyboard (VM 332)	the 15 s menu boots the graphical installer, which stops at the EULA and waits (screen 332-s02) — nothing installs unattended
zero disks	not exercised

3. The walk, step by step

Customer tester-1 (operator's choice), domain enkicsifelhom.hu, tunnel token set, DR tier on, no e-mail registered. VM 331 = ISO 1.27.0, three disks, TUI. VM 332 = ISO 1.27.1, one disk.

#	step	result	time
1	installer	built from main, not downloaded (unpublished)	—
2	install (331)	same English Proxmox screens as yesterday; host name felhom.enkicsifelhom.hu per the guide	copy ≤ 3 m 21 s
3a	first screen (331, 1.27.0)	Proxmox :8006 block still on top; Felhom text below with ő/ű dropped → fixed in 1.27.1	registered at hub +41 s
3b	first screen (332, 1.27.1)	Felhom text only — „Felhom otthoni szerver · Ezen a gépen most nincs dolgod, és bejelentkezni sem kell." — then the pairing banner naming the Tulajdonosi jelmondat; identical after a proven reboot (boot 16:14:11Z > reboot 16:13:56Z, pvebanner masked, /etc/issue 0 × 8006)	—
3c	bind + claim (331)	operator bind (no link: no e-mail); hub claim code generated … but customer tester-1 has NO registered email (R-508); dashboard 503 via the tunnel → I1 (R-505, filed 16:07:59Z before acting); claim by LAN + box-printed code (H1) → 302	controller 0.242.0 at +2 m 31 s after bind
4	version	controller 0.242.0, agent 0.130.0 — the vouched set	—
5	deploy	BookStack 68 s, PrivateBin 22 s	—
6	use	BookStack: default login → changed (old refused, new accepted), book, Hungarian page, 256 KiB attachment, sha equal; PrivateBin: encrypted paste round trip, wrong key InvalidTag	—
7	backup pages	same honest warnings; R-499's „(PBS)" sentence still present (not this task)	—
8	backup now	points move to 16:11:56Z; page „18:11 (most)"	16 s
9	versions	installed == catalog for both; no update offered — skipped	—
10	remove PrivateBin (stop → remove, every box)	volume, container, backup dir, restore points gone; front door 404	<1 s
11	restore BookStack after deleting its page	page + attachment byte-identical, finish message „2 adatkötet és az adatbázis visszaállítva"	healthy 36 s
12	status pages	launcher BookStack + Filebrowser; dashboard 4 running	—
A1	power cut	same six image tags, agent 0.130.0, data byte-identical, hub controller_started only	dashboard +123 s, BookStack +133 s
A2	typo	„Hibás vagy lejárt kód" → right code accepted → 6th attempt „Túl sok próbálkozás — próbáld újra 15 perc múlva."; claim_lockout + operator mail	—

4. Harness substitutions (not interventions)

H1 no mailbox (and tester-1 has none) → operator bind, box-printed codes · H2 U.S. keyboard on 331/332-TUI · H3 auto-reboot unticked, ISO detached · H4 TUI entry. H5 (new): the graphical installer did not take Tab or mouse input from qm sendkey/mouse_move; Alt+N worked — the 1.27.1 graphical path was proven to boot, wait at the EULA, show the one-disk target and reach the password screen, not to install (R-507).

5. Findings

row	rank
R-505	P1	tester-1's tunnel gives a fresh box no routes → 503 (12/12 probes, 12 box warnings, 0 config updates); operator's phone reaches it — cause not visible to the session
R-508	P2	tester-1 has no registered e-mail: the setup code and self-bind link cannot be delivered
R-506	P3	day0-install.md A.1 says the controller manages hostnames — it does not
R-507	P3	the proof-install harness cannot drive the graphical installer
R-502	P3	the bootstrap harness runs in no gate/CI; the banner was never tested
R-503	P3	spike for an install-time disk rule (not chosen)
R-504	P3	iso.felhom.eu/ has no index; download page goes on the website

Closed with this evidence: R-497 (hub v0.113.0 live). Fixed, awaiting publish: R-496 (ISO 1.27.1), R-495 (answered by the guide + G14). R-493 stays open until the download page and ISO are live.

6. Teardown

Layers 1–2 measured in teardown-layers-1-2.txt (VMs 331/332 destroyed; nvme-scratch used 23 528 192 → 10 132 924 KiB; local 26 489 992 → 23 033 320 KiB; ISOs and /root/doorstep gone; 9201/9202 running; local-lvm 44.17 % unchanged). Layer 3 in teardown-layer3-hub.txt: appliance 27 discarded; host tester-1-8603a2 deleted at 16:46:52Z once stale; its ep0 peer gone at the 16:49:13Z push (customer tester-1 is KEPT — the operator's fixture; a RESET or DELETE would remove its tunnel and zone). Left on ep0 by the DR tier, measured read-only: namespace tester-1 with 2 directories of backup data and token felhom@pbs!tester-1; a host delete does not deprovision tenancy — only the customer RESET does, which would also remove the tunnel. Disposition: retained with the customer, for the operator to rule.