felhom.eu/REPORT-doorstep-1271.md

REPORT — the doorstep: installer 1.27.1, hub 0.113.0, walked again (2026-09-14)

Supervised task. STOPPED before publishing, as required. Findings: documentation/audits/DOORSTEP-walk-1270-2026-09-14.md. A parallel session owns root REPORT.md; this is a topic sibling.

0. Claims in the brief that turned out wrong — named first

1. "The ISO is built to install itself with no questions." Wrong for the public image. --release builds carry no answer file by construction (G1); the 1.26.1 manifest says answer-file: NONE and automated-entry: NOT PRESENT. The README's auto-install text describes the old operator-built images. Nothing "failed to engage".
2. "The installer installs itself, in Hungarian" / "no English reaches a volunteer." Not achievable under the operator's ruling: offered an install-time disk rule, he kept the interactive installer. The Proxmox auto-installer has no local chooser or stop page; its screens stay English. Felhom's own text is Hungarian (G16).
3. "Tester 1, fully configured." It has no e-mail (R-508) and its tunnel gives a new box no routes (R-505).
4. "The hub could create the tunnel later" as the only gap in A.1. day0-install.md A.1 also claimed the controller creates the hostnames; it does not (R-506, corrected).
5. "Host a Hungarian chooser; else a Hungarian stop." Not built — follows from 2.

1. Baselines (re-verified)

felhom.eu 8c7f882 at start · ISO 1.26.1 · host installer 1.28.0 (unchanged) · hub 0.112.0 · controller 0.242.0, golden 0.242.0. Highest row R-501.

2. Operator decisions taken in this task

when	question	answer
Phase 0	reverse to auto-install, or keep interactive?	keep interactive
Phase 4	test domain for the walk?	use customer tester-1
Phase 4	tunnel has no routes — add, or continue?	"works for me on mobile network … pi-hole" — see §5

3. What shipped, and what did not

artifact	commit	state
hub v0.113.0 — hand-over sentence on create + Credentials; self-bind mail names the operator (R-497)	6fd8c87 code, 63f29c6 deploy	LIVE — ArgoCD Synced, image 0.113.0, page renders it
ISO 1.27.0 — console fix at first boot	6fd8c87	built, gated, superseded (first boot still showed the Proxmox block)
ISO 1.27.1 — postinst masks pvebanner + writes /etc/issue	27e8ec8	built, gate PASS, proven live, NOT PUBLISHED · sha256 25637007d5a7120ff9faa6b5b7ead3e33c0a361ac2d67e9fd4e0ee77c034c053
release gate G14–G16; domain + installer rulings in 01-topology-and-trust.md and CONTEXT.md; guide + day-0 A.1/A.2 aligned	6fd8c87, this commit	committed
download page felhom.eu/letoltes	—	not written to the website — the website publishes on push; it goes with the ISO after yes

Tests: hub passphrase_handover_test.go red first, full go test ./... green; bootstrap harness 55/55, eight R-496 checks and scenario PI red first; shellcheck clean; felhom.eu gates green on every push; CI jobs 583, 585 success.

4. The walk

Interventions: 1 — reaching the dashboard by LAN address (R-505, filed 16:07:59Z before acting). Everything else held: install on 3 disks and 1, first-boot console Felhom-only on 1.27.1 with a proven reboot, deploy, use, backup-now, removal, byte-identical restore, power cut on the same versions, typo and lockout. Harness substitutions H1–H5 in the findings doc §4.

5. The tunnel, measured — the one thing that stops a volunteer

12 requests from DooPlex through public DNS → 12 × 503; the box's cloudflared logged 12 No ingress rules were defined in the same window and 0 remote-config updates since connecting. The guest's own front door answers the name. The operator's phone loads the dashboard — not explained by anything the session can see; a second connector reached from another Cloudflare location is the likeliest cause and is not established. The Pi-hole is excluded for these probes (public DNS, Cloudflare ray ids).

6. STOP — for the operator

• Intervention count: 1. By the rule set for this task, do not publish.
• The disk rule: the installer never picks; it lists every disk with size and model and erases the one you choose; unplug the backup drive; call the operator if unsure. One disk, three disks and nobody at the keyboard were each seen (findings §2).
• Gate: 1.27.1 PASS on every criterion runnable before publish (G1–G10, G13–G16); G11/G12 are publish-time; the graphical entry is proven only to its password screen (R-507).
• Ready: NO — until the tester-1 tunnel answers from our network, and the record has an e-mail.
• What publishing would do, on yes: upload 1.27.1 + .sha256 + manifest to the bucket, add the download page to the website, round-trip the checksum over https://iso.felhom.eu/, keep 1.26.1 online so rollback is one link change.

7. Rows

Opened R-502 … R-508 (7). Closed R-497. Fixed awaiting publish R-496; answered awaiting publish R-495; R-493 open; R-494 narrowed to P3. Register table rows 209 → 216.

8. Teardown

Layers 1–2 done (VMs 331/332 destroyed; ≈12.8 GiB back on nvme-scratch; both ISOs and /root/doorstep gone; 9201/9202 untouched). Layer 3: appliance 27 discarded; host tester-1-8603a2 delete pending its stale window (see the follow-up commit). Customer tester-1 KEPT. Left on ep0 by the DR tier: namespace tester-1, token felhom@pbs!tester-1 — retained with the customer for the operator's ruling. The hub's event stream and three operator mails are append-only and stay.

9. Observations

• iso-release-gate.md's "both entries" proof depends on a person for the graphical entry today (R-507).
• The bootstrap harness is run by hand only (R-502); the pairing banner had never been exercised.
• A closed row still lives in the open register (R-497) until the next compression sweep — the gates accept it.