( 02 ) procedure
Five stages. One gate.
The guided installer walks one path: look, stage, confirm, write, hand off. Nothing is written before stage four, and stage four refuses to start until you type the exact identity of the disk it is about to erase.
The stages
Scans Windows for firmware mode, Secure Boot state, BitLocker status, internal-disk layout, GPU vendor, Bluetooth input dependencies, wired fallback peripherals, and every USB drive with its exact model, size, bus type, and serial. Internal disks are listed as protected. The result is a private local report on your machine.
writes: preflight.json / preflight.md - nothing elseThe installer requires a local Ubuntu 26.04 ISO and its SHA-256 sums file, and proves they match before anything moves. A failed checksum stops the flow - there is no "continue anyway".
refused if: ISO hash does not match the sums entryGenerates the files you will want after the reboot: a next-boot checklist, a Bluetooth handoff note, the target manifest, and a first-boot bootstrap script. Files only - still nothing written to any disk.
writes: a folder of documents on WindowsThe destructive step, and the reason this installer exists. It accepts only removable USB targets, refuses boot/system disks, refuses unexpectedly large disks, and demands that you type the exact disk number and serial. A durable approval artifact is written before the first byte. After the write, the raw bytes on the stick are re-hashed and must equal the ISO hash.
token format: DiskNumber:Serial - typed by you, never pre-filledThree escalation tiers: restart into the Windows "Use a device" menu; restart into UEFI firmware settings; or the per-vendor boot key with a guided manual path. The installer prepares each restart and asks - you perform it. If none of the tiers work on your hardware, it says so instead of pretending.
no boot-order change / no BCD edit / no firmware writeFeel the gate
This is a sample with a fake serial - the real gate runs in PowerShell on your machine with your disk's real identity. Type anything wrong and watch it refuse; type the sample token exactly and see what unlocking feels like.
( illustration - the real gate lives in the installer, not in this page )