# Publication validation — 2026-09-24

The sanitized Debian 13 / OMV 8 tooling is expected to retain the original boot
behavior when configured with the operator's own identities and matching runtime
and kernel modules. The published diagnostic archives contain sample identities;
they are templates, not universal images ready to boot unchanged.

## Scrub regression fixed

The post-install runner accepted a custom LAN1 MAC, but register-network.py
still checked the anonymized constant. The runner now passes `--lan1-mac` to
that helper, which validates the actual interface against the supplied value.
A mismatched link configuration is rejected before network registration.
Regression tests cover argument forwarding, successful identity matching and
refusal of wrong or placeholder identities.

## Completed checks

- 100 offline Python tests: 32 rebuild, 39 post-install, 13 production,
  10 hardware and 6 LED tests.
- 37 offline PHP assertions under PHP 8.4: storage policy (21), data partition
  backend (11), filesystem details (5). The disposable container had no network,
  a read-only filesystem, and only the sanitized export mounted read-only.
- Five simulated USB discovery cases: immediate/delayed discovery, missing USB,
  missing payload, and failed mount move.
- All four sanitized archive entry lists match the originals. After reversing
  only the identity substitutions, their init payloads match; every other entry
  header and payload is unchanged. The EFI selector is byte-identical.
- OS and rescue init generation is byte-for-byte equivalent to the original
  builder when supplied the same operator identities.
- A real CLI build from the published revision-o archive with temporary Ed25519
  keys verifies MAC/UUID substitution, removal of unauthenticated diagnostics,
  private recovery key placement, key-free OS image, and native ext4 replacement.
  Runtime and ext4 inputs in this test are packaging fixtures, not bootable inputs.
- Both newly generated test images pass the packed BusyBox handoff test in
  temporary chroots, as do the historical revision-m and revision-o templates.
- Publication privacy scan, source syntax, release checksums and archive metadata
  checks pass. No original development Git objects enter the clean export.

## Limits

No NAS was rebooted and no live network or storage was changed during these
checks. They establish expected compatibility and packaging behavior, not a new
hardware boot result. Each installation still needs its own reviewed disk plan,
matching kernel modules/runtime, SSH identities, verified recovery path and boot
test. Historical lab results describe the original hardware session.