Install To Disk

Install LexiOS to an internal disk

Status, 11/11/2026: not available in current images. The install path is tested on image files only, and current images do not yet carry the installer source it copies from. Do not rely on it for a machine whose data matters.

Warning: this permanently erases the selected internal disk. Do not use the live stick itself as the destination. Back up files, recovery keys, model data, existing operating systems and other partitions to separate storage before starting. A reinstall is not a state-preserving update.

Prerequisites

• Boot LexiOS from the live installation stick on a machine supporting UEFI.
• Complete the initial appliance enrollment and sign in as the root Panel account. An ordinary administrator role alone cannot approve this action.
• Use media containing a locally available, authenticated installer source and the reviewed Secure Boot certificate. A plain filesystem tree or an unsigned archive is not a substitute for the authenticated release bundle.
• Have independent, persistent journal storage at /var/lib/lexios-installer/transactions. The installer refuses to mutate a disk when its recovery record cannot be retained off the target on an approved persistent filesystem.
• Ensure the intended internal disk is not mounted, used as swap, an ancestor of the active boot/root device, removable, or on a USB bus. An observed serial is required. Disks below 8 GiB, read-only media and protected VMFS/VMKCORE storage are refused. A disk with foreign partitions needs a separately reviewed replacement procedure and a verified backup; the live installation workflow does not silently bypass this protection.

Preview and installation

1. Open Storage in LexiPanel and choose the guided task Install LexiOS on an internal disk. Refresh the root-owned inventory and read each disk's observed model, size, serial and refusal status.
2. Select the intended target by its stable identity, not /dev/sdX alone. Preview the installation. The preview enumerates partition-table writes, verified system and verity payload copies, EFI-file staging, filesystem initialization, first-boot data and the final sync.
3. Independently check every destructive action and the target serial against the physical disk. Preserve a backup outside the target.
4. Submit the returned, unexpired review_id, acknowledge that all target data will be erased, and type the disk's exact observed serial. The Panel and the privileged installer both reject missing or mismatched typed serials. The root account must authorize the commit; a preview by itself never grants write permission.
5. Follow the installer status until it reports completion. A queued operation or a prepared/reviewed state is not a completed installation. Do not remove source media or boot the destination while a job is running or has failed.

The existing authenticated A/B installer writes a GPT containing the EFI system partition, two verified system/verity slots and persistent state. It copies the certified UKIs into the EFI system partition, including the architecture-specific fallback path, verifies copied bytes, and stages first-boot state. The trusted signing certificate must also be enrolled in firmware for Secure Boot; installation cannot bypass the platform's trust policy. An ESP fallback file is not proof that a firmware NVRAM boot entry was created or that the installed system completed first boot.

The disk is erased from its first GPT through all existing partitions. Existing Windows, macOS, Linux, recovery partitions, model files and LexiOS state on that disk are not retained. No separate disk data volume or LexiKernel boot entry should be assumed present unless the installed image's reviewed layout and verification explicitly list it.

Interrupted installs and recovery

The installer writes a root-owned journal before partitioning and records successive irreversible phases. An interrupted write can leave an incomplete GPT, unsigned or unverified boot path, or partial filesystem. On restart, the status view consults retained journal records for disks still present; an unfinished record is shown as INSTALL_PARTIAL_OR_UNKNOWN. The journal is never discarded just because the service restarted.

Do not boot, reformat or blindly retry an interrupted target. The installer will not automatically resume an unverified partial transaction or overwrite its prior journal. Inspect journal and disk evidence read-only, verify the source, target identity and backup, then use a new approved recovery or replacement procedure. Firmware and first-boot success are separate checks.

Undoing an installation

There is no general automatic undo after the GPT is written. To restore the previous operating system, boot independent recovery media and restore the previously verified whole-disk backup to the exact target, following the backup system's instructions. Recovering files from a partially overwritten partition is not guaranteed. Do not remove the journal until an authorized recovery procedure has been completed and reconciled.

Windows and macOS versions of LexiPanel do not offer the LexiOS appliance disk installation screens. Their native LexiSuite installers handle application installation, not destructive replacement of a host operating system.

Current limitations

The authenticated disk writer already verifies A/B payloads and signed UKIs, but an end-to-end physical install from the new release-media source partition, automatic continuation/rollback of an interrupted disk, an installed LEXIDATA layout, a dual-boot LexiKernel entry and firmware boot-variable enrollment still require integrated qualification. Until then, do not interpret a journal installed phase as proof of a fully bootable, Secure-Boot-qualified internal-disk installation.