the procedure / five stages, one gate
Look. Verify. Stage. Confirm. Hand off.
The guided installer walks one path, and the destructive step cannot start until you type the exact identity of the disk it is about to erase. Every refusal below is enforced by the code, not by this copy.
Scans Windows for firmware mode, Secure Boot state, BitLocker status, internal-disk layout, GPU vendor, Bluetooth input dependencies, and every USB drive with its exact model, size, bus type, and serial. Internal disks are listed as protected. The result is a private local report on your machine.
writes: preflight.json / preflight.md - nothing elseThe installer requires a local Ubuntu 26.04 ISO and its SHA-256 sums file, and proves they match before anything moves. A failed checksum stops the flow - there is no continue-anyway.
refused if: ISO hash does not match the sums entryGenerates the files you will want after the reboot: a next-boot checklist, a Bluetooth handoff note, the target manifest, and a first-boot bootstrap script. Files only - still nothing written to any disk.
writes: a folder of documents on WindowsThe destructive step. It accepts only removable USB targets, refuses boot and system disks, refuses unexpectedly large disks, and demands that you type the exact disk number and serial. A durable approval artifact is written before the first byte. After the write, the raw bytes on the stick are re-hashed and must equal the ISO hash.
token format: DiskNumber:Serial - typed by you, never pre-filledThree escalation tiers: restart into the Windows use-a-device menu, restart into UEFI firmware settings, or the per-vendor boot key with a guided manual path. The installer prepares each restart and asks - you perform it. If none of the tiers work on your hardware, it says so instead of pretending.
no boot-order change / no BCD edit / no firmware writeFeel the gate.
( illustration - the real gate lives in the installer, not in this page )