[qw3rtyy1]

Two small fixes to the setup-code line at the end of deploy/install.sh.

1. The installer never prints the code it extracts.

install.sh pulls the code out of the journal with [A-Z0-9]*, but the code is rand.Text()[:12] (cmd/heron/main.go:212), and crypto/rand.Text() uses the URL-safe base64 alphabet [A-Za-z0-9_-] — so it usually contains lowercase letters. The capture group matches zero characters, code ends up empty, and the guard on the next line drops the message.

Reproduced against both log shapes (the text handler is the default, cmd/heron/main.go:120; JSON is opt-in through log_format):

$ L='time=2026-11-03T10:00:00Z level=WARN msg="no administrator yet, open the admin panel and enter the setup code" setup_code=aB3dEf9gHi2X'

$ printf '%s\n' "$L" | sed -n 's/.*setup_code[=":]*\([A-Z0-9]*\).*/\1/p'
# nothing

$ printf '%s\n' "$L" | sed -n 's/.*setup_code[=":]*\([A-Za-z0-9_-]*\).*/\1/p'
aB3dEf9gHi2X

The JSON form {"setup_code":"aB3dEf9gHi2X"} behaves the same way, so widening the class fixes both.

2. An empty code made a successful install exit 1.

[ -n "$code" ] && say "setup code: $code" is the last command in the file, so when code is empty the script's exit status is 1 — verified on bash, dash and sh. Nothing aborts (set -e ignores a failing AND-list), but curl -fsSL ... | sudo sh from the README now reports failure for an install that worked, which is exactly what a CI job or a wrapping script with pipefail will read as a broken deploy. Turning it into an if block keeps the same output and returns 0:

$ cat old.sh                       # ends with: [ -n "$code" ] && say x
$ for SH in bash dash sh; do "$SH" old.sh; echo "$SH rc=$?"; done
bash rc=1
dash rc=1
sh rc=1

$ cat new.sh                       # ends with: if [ -n "$code" ]; then say x; fi
$ for SH in bash dash sh; do "$SH" new.sh; echo "$SH rc=$?"; done
bash rc=0
dash rc=0
sh rc=0

sh -n deploy/install.sh passes on bash, dash and sh after the change.

Left alone after checking, because they are fine: heron user reset-2fa really is implemented (cmd/heron/main.go:424), and StateDirectory=heron in deploy/heron.service creates /var/lib/heron, so the installer does not need an explicit mkdir.