felhom.eu/documentation/audits/DRILL-fresh-install-0242-2026-09-14.md

DRILL — a stranger's first hour on 0.242.0 (2026-09-14)

Interventions a volunteer could not have made: 1 (I1 — reaching the dashboard at all). Ready for a volunteer: NO — because no instruction tells a stranger where the installer is or what to type, and the link in the setup-code e-mail does not open for a new customer; either stops them before their first app.

Evidence: evidence-drill-fresh-install-0242-2026-09-14/ — journal.md (every observable, in order), screens/ (installer and console, codes redacted), box-logs-phase1/, A1-power-cut.txt, step10-remove-observe.txt. Golden: ../tests/golden-0.242.0-2026-09-14/.

---

1. What held, in one table

#	step	result	time
0.1	golden 0.242.0 baked, round-trip verified, vouched	PASS	bake ≈6 min
0.2	customer-facing instructions exist	FAIL — none exist (R-493)	—
1	download the installer	PASS — but only with the exact file name; the site has no index (R-493)	32 s, sha matches
2	install	PASS with four unanswered questions, one of which refuses its own default (R-495)	≈12 min at the keyboard, 3 m 24 s copying
3	first screen, pairing, claim	box registered in 86 s; console sends a stranger to the Proxmox admin page and misnames the passphrase (R-496); passphrase is delivered by nothing (R-497); the dashboard has no address (R-494, I1); claim itself < 1 s	power-on → claimed 27 m 37 s
4	"ready", version	PASS — landed on controller 0.242.0 + agent 0.130.0, the vouched set; no self-update needed	power-on → controller 4 m 14 s
5	deploy BookStack + PrivateBin	PASS — 68 s and 21 s; pages honest about where data goes; first steps say literal wiki.DOMAIN (R-498)
6	use both through their front doors	PASS — BookStack login, password change, book, Hungarian page, 256 KiB attachment; PrivateBin encrypted paste, decrypted round trip
7	read the backups pages	mostly honest; one page says „already in the PBS backup, nothing to do" on a box with no PBS (R-499); „Következő mentés — 0 órája" reads backwards
8	backup now	PASS — dates move to the true time on both pages	21 s
9	version labels / Update	„Naprakész" true (installed == catalog); no newer version offered — skipped
10	remove with „delete my data too"	PASS — volume, backup folder and restore points gone, front door 404; response names each removal	6 s stop + <1 s remove
11	restore the other app	DATA PASS — deleted page and attachment back, sha256 identical, Hungarian intact	32 s to healthy
12	status pages a week later	dashboard shows the backup in UTC, backup pages in local time (R-500)
A1	power cut	PASS — same versions, data intact, no alarm; one re-login	≈2 min to dashboard
A2	typo in the code	PASS — typo refused, right code accepted after it; 5 failures lock 15 min with an honest Hungarian message; lockout mail goes to the operator only

2. The intervention

I1 — the dashboard has no reachable address (R-494, P1). The setup-code mail says https://felhom.drill0242.felhom.eu. That name has no DNS record; the hub never creates the Cloudflare tunnel or record (the token is a pasted, optional field); the box's own split-horizon resolver learns the name 3 m 46 s after the controller starts, but only a device that uses the box as its DNS server benefits, and nothing says so. The walk reached the dashboard at the guest's LAN address with the name forced. Filed before it was performed. It was performed once and covered every later dashboard and app request.

The stop rule (four) was not reached.

3. Harness substitutions — not interventions, and why

These are things this harness could not do and a volunteer could, so they are not counted. They are listed because each one hides a part of the path from this walk.

	what	consequence for the claim
H1	No mailbox. Both customer mails go only to the registered address; the hub keeps hashes; the Resend key is send-only.	The self-bind page was not exercised — the operator's bind fallback was used. The setup code was minted box-side twice (--print-reset-code, generations 3 and 4) via the vaulted break-glass. The mailed code and the self-bind link are unproven by this walk.
H2	qm sendkey sends US scancodes; the layout was switched from Hungarian to U.S. English	Hungarian keyboard entry of the password and e-mail not exercised
H3	auto-reboot unticked, ISO detached by qm set	the "stick still in" reboot not exercised
H4	Terminal UI entry chosen over the graphical default	graphical installer not exercised this run

Harness slips, recorded: the first box-side code (generation 2) was captured with a pattern that does not match accented letters and was shredded unseen; the first template pick for the bake was arm64; two BookStack calls used wrong routes (405); one removal was called on a running app, which the screens never offer (409 — withdrawn as a finding); the A1 poll misread an expired session for 8 min; the monitoring banner and the restore-finish message were first read from server HTML and are script- rendered — both readings were corrected in the journal.

4. Findings

row	rank	one line
R-493	P1	No customer-facing install instructions; the ISO site has no index. Blocks inviting anyone. Stopgap: runbooks/VOLUNTEER-first-hour.md
R-494	P1	A new customer's dashboard has no address unless the operator hand-makes a tunnel — the setup mail's link is dead (I1)
R-495	P2	The installer asks four unanswered questions and refuses its own default hostname
R-496	P2	The console first tells a stranger, in English, to open the Proxmox admin page; calls the passphrase „a jelszavadat"
R-497	P2	Nothing delivers the Tulajdonosi jelmondat, yet the mail says it was received at setup
R-499	P2	„Already in the full system backup (PBS) — nothing to do" on a box with no PBS
R-498	P3	52 of 53 app pages say a literal wiki.DOMAIN
R-500	P3	Dashboard shows the backup time in UTC, backup pages in local time

Observations, not filed: the deploy poll has no degraded branch (16 s of stale step text); „0 °C" beside „Nincs adat" for a virtual disk; the removal dialog mentions „éjszakai restic pillanatképek" on a box with no restic; the drive „attach" list offers the guest's own system volume; the launcher menu shows an English „Debug"; the lockout e-mail reaches the operator only; R-214 still reproduces (pairing banner and stale code on the console after bind).

5. Scope and what this walk does NOT claim

• Not the recovery-after-rebuild journey. The capability map's journey row (walk 5) is about a rebuilt box recovering off-site data. This drill walked the first hour; it neither re-proves nor contradicts that row, and the map is annotated to say so.
• DR tier off, off-site off. The customer was created with the DR tier unticked (it provisions an ep0 namespace; the brief fenced ep0). The off-site and escrow screens were therefore not walked.
• ep0 was touched anyway, by the product: enrolment registers a WireGuard peer on ep0 for every box (wg registered … ip=10.77.0.5/32 … sync=ok). The teardown removes it through the host delete.
• No browser. Every screen was driven through the endpoint the page calls; script-rendered state (restore-finish banner, host-metrics card) was not observed.

6. Teardown — three layers

See REPORT-drill-fresh-install-0242.md §Teardown for the measured before/after of each layer and the disposition of customer drill0242.

Untouched, and checked: demo-hp guests 9201 and 9202 (running throughout), local-lvm, the demo-felhom box, DooPlex's services (only the bake VM, which is the accepted bake exception, reverted to virgin), ep0 beyond the product's own peer registration, and Peti's box.