( 03 ) readouts
What it touches.
What it never will.
Plain statements about disks, firmware, and the warnings Windows will show you. Where the truth is uncomfortable - unsigned scripts, manual Bluetooth re-pairing - it is printed here rather than hidden.
What gets written, and how it is proven
writtenone removable USB stick, sector by sector, with the Ubuntu 26.04 live image
proven bypost-write raw hash of the stick must equal the ISO hash - mismatch marks the write FAILED
approved bya durable approval artifact written before the first byte: operator, disk number, serial, timestamp, ISO hash
never touchedinternal disks, recovery partitions, the Windows boot/system disk - listed as protected in preflight and refused by the writer
Firmware and encryption reality
bitlockerreported, never managed. Save your recovery key off-device before any boot work; the installer will not suspend or touch keys.
secure bootreported, never changed. If Ubuntu refuses to boot you may toggle it manually - the next-boot checklist covers it.
boot order / bcdread-only. Firmware boot entries are enumerated, never edited; no persistent boot-order change is ever made.
bluetooth inputdetected and flagged as a risk. Pairing keys do not migrate - have a wired or 2.4 GHz keyboard ready before rebooting.
The unsigned truth
The bundle is plain unsigned PowerShell. Windows SmartScreen will warn you, and it should - there is no EXE and no code-signing certificate yet. In exchange, every script is readable text: open it in an editor before you run it.
verify the launcherGet-FileHash outos-easy-installer-mvp1.cmd -Algorithm SHA256
compare againstthe .sha256 sidecar published next to the download - the page shows the same value it serves
verify the isoGet-FileHash ubuntu-26.04-desktop-amd64.iso -Algorithm SHA256 - must match the SHA256SUMS entry
Proven versus written
House rule: a thing is "proven" only when fresh command output or a hardware run says so. Status below reflects repository evidence, not ambition.
proven on hardwarethe guarded CLI write path: exact serial gate, all refusals, raw post-write hash verify (evidence 2026-06-10)
code written, not hardware-proventhe GUI write path - the same gates exercised by tests, not yet by a real GUI-driven write
not guaranteedone-click boot on every PC, Bluetooth pairing migration, UEFI/legacy edge cases on exotic firmware