felhom.eu/documentation/audits/DRILL-fresh-install-0242-2026-09-14.md

# DRILL — a stranger's first hour on 0.242.0 (2026-09-14)

**Interventions a volunteer could not have made: 1** (I1 — reaching the dashboard at all).
**Ready for a volunteer: NO — because no instruction tells a stranger where the installer is or what
to type, and the link in the setup-code e-mail does not open for a new customer; either stops them
before their first app.**

Evidence: `evidence-drill-fresh-install-0242-2026-09-14/` — `journal.md` (every observable, in
order), `screens/` (installer and console, codes redacted), `box-logs-phase1/`, `A1-power-cut.txt`,
`step10-remove-observe.txt`. Golden: `../tests/golden-0.242.0-2026-09-14/`.

---

## 1. What held, in one table

| # | step | result | time |
|---|---|---|---|
| 0.1 | golden 0.242.0 baked, round-trip verified, vouched | **PASS** | bake ≈6 min |
| 0.2 | customer-facing instructions exist | **FAIL — none exist** (R-493) | — |
| 1 | download the installer | PASS — but only with the exact file name; the site has no index (R-493) | 32 s, sha matches |
| 2 | install | PASS with **four unanswered questions**, one of which refuses its own default (R-495) | ≈12 min at the keyboard, 3 m 24 s copying |
| 3 | first screen, pairing, claim | box registered in 86 s; console sends a stranger to the Proxmox admin page and misnames the passphrase (R-496); passphrase is delivered by nothing (R-497); **the dashboard has no address** (R-494, **I1**); claim itself < 1 s | power-on → claimed 27 m 37 s |
| 4 | "ready", version | **PASS** — landed on controller 0.242.0 + agent 0.130.0, the vouched set; no self-update needed | power-on → controller 4 m 14 s |
| 5 | deploy BookStack + PrivateBin | **PASS** — 68 s and 21 s; pages honest about where data goes; first steps say literal `wiki.DOMAIN` (R-498) | |
| 6 | use both through their front doors | **PASS** — BookStack login, password change, book, Hungarian page, 256 KiB attachment; PrivateBin encrypted paste, decrypted round trip | |
| 7 | read the backups pages | mostly honest; **one page says „already in the PBS backup, nothing to do" on a box with no PBS** (R-499); „Következő mentés — 0 órája" reads backwards | |
| 8 | backup now | **PASS** — dates move to the true time on both pages | 21 s |
| 9 | version labels / Update | „Naprakész" true (installed == catalog); **no newer version offered — skipped** | |
| 10 | remove with „delete my data too" | **PASS** — volume, backup folder and restore points gone, front door 404; response names each removal | 6 s stop + <1 s remove |
| 11 | restore the other app | **DATA PASS** — deleted page and attachment back, sha256 identical, Hungarian intact | 32 s to healthy |
| 12 | status pages a week later | dashboard shows the backup in UTC, backup pages in local time (R-500) | |
| A1 | power cut | **PASS** — same versions, data intact, no alarm; one re-login | ≈2 min to dashboard |
| A2 | typo in the code | **PASS** — typo refused, right code accepted after it; 5 failures lock 15 min with an honest Hungarian message; lockout mail goes to the operator only | |

## 2. The intervention

**I1 — the dashboard has no reachable address (R-494, P1).** The setup-code mail says
`https://felhom.drill0242.felhom.eu`. That name has no DNS record; the hub never creates the
Cloudflare tunnel or record (the token is a pasted, optional field); the box's own split-horizon
resolver learns the name 3 m 46 s after the controller starts, but only a device that uses the box as
its DNS server benefits, and nothing says so. The walk reached the dashboard at the guest's LAN address
with the name forced. **Filed before it was performed.** It was performed once and covered every later
dashboard and app request.

**The stop rule (four) was not reached.**

## 3. Harness substitutions — not interventions, and why

These are things **this harness** could not do and **a volunteer could**, so they are not counted.
They are listed because each one hides a part of the path from this walk.

| | what | consequence for the claim |
|---|---|---|
| **H1** | **No mailbox.** Both customer mails go only to the registered address; the hub keeps hashes; the Resend key is send-only. | **The self-bind page was not exercised** — the operator's bind fallback was used. The setup code was minted box-side twice (`--print-reset-code`, generations 3 and 4) via the vaulted break-glass. **The mailed code and the self-bind link are unproven by this walk.** |
| H2 | `qm sendkey` sends US scancodes; the layout was switched from Hungarian to U.S. English | Hungarian keyboard entry of the password and e-mail not exercised |
| H3 | auto-reboot unticked, ISO detached by `qm set` | the "stick still in" reboot not exercised |
| H4 | Terminal UI entry chosen over the graphical default | graphical installer not exercised this run |

**Harness slips, recorded:** the first box-side code (generation 2) was captured with a pattern that
does not match accented letters and was shredded unseen; the first template pick for the bake was
arm64; two BookStack calls used wrong routes (405); one removal was called on a running app, which the
screens never offer (409 — withdrawn as a finding); the A1 poll misread an expired session for 8 min;
the monitoring banner and the restore-finish message were first read from server HTML and are script-
rendered — both readings were corrected in the journal.

## 4. Findings

| row | rank | one line |
|---|---|---|
| **R-493** | **P1** | No customer-facing install instructions; the ISO site has no index. **Blocks inviting anyone.** Stopgap: `runbooks/VOLUNTEER-first-hour.md` |
| **R-494** | **P1** | A new customer's dashboard has no address unless the operator hand-makes a tunnel — the setup mail's link is dead (**I1**) |
| R-495 | P2 | The installer asks four unanswered questions and refuses its own default hostname |
| R-496 | P2 | The console first tells a stranger, in English, to open the Proxmox admin page; calls the passphrase „a jelszavadat" |
| R-497 | P2 | Nothing delivers the Tulajdonosi jelmondat, yet the mail says it was received at setup |
| R-499 | P2 | „Already in the full system backup (PBS) — nothing to do" on a box with no PBS |
| R-498 | P3 | 52 of 53 app pages say a literal `wiki.DOMAIN` |
| R-500 | P3 | Dashboard shows the backup time in UTC, backup pages in local time |

Observations, not filed: the deploy poll has no `degraded` branch (16 s of stale step text);
„0 °C" beside „Nincs adat" for a virtual disk; the removal dialog mentions „éjszakai restic
pillanatképek" on a box with no restic; the drive „attach" list offers the guest's own system volume;
the launcher menu shows an English „Debug"; the lockout e-mail reaches the operator only;
**R-214 still reproduces** (pairing banner and stale code on the console after bind).

## 5. Scope and what this walk does NOT claim

- **Not the recovery-after-rebuild journey.** The capability map's journey row (walk 5) is about a
  rebuilt box recovering off-site data. This drill walked the **first hour**; it neither re-proves nor
  contradicts that row, and the map is annotated to say so.
- **DR tier off, off-site off.** The customer was created with the DR tier unticked (it provisions an
  ep0 namespace; the brief fenced ep0). The off-site and escrow screens were therefore not walked.
- **ep0 was touched anyway, by the product:** enrolment registers a WireGuard peer on ep0 for every
  box (`wg registered … ip=10.77.0.5/32 … sync=ok`). The teardown removes it through the host delete.
- **No browser.** Every screen was driven through the endpoint the page calls; script-rendered state
  (restore-finish banner, host-metrics card) was not observed.

## 6. Teardown — three layers

See `REPORT-drill-fresh-install-0242.md` §Teardown for the measured before/after of each layer and
the disposition of customer `drill0242`.

Untouched, and checked: demo-hp guests **9201** and **9202** (running throughout), `local-lvm`, the
demo-felhom box, DooPlex's services (only the bake VM, which is the accepted bake exception, reverted
to `virgin`), ep0 beyond the product's own peer registration, and Peti's box.