docs(wiki): runbook §5c uses gpasswd -d — deluser rejects hyphenated users

Demoting the operator on park-buzi failed with "sanitize_string: invalid
characters in 'park-operator'" — Ubuntu's perl adduser/deluser tooling
rejects the hyphenated username. §5c now prescribes gpasswd -d for
sudo/lxd/lpadmin (shadow-suite, no perl sanitize) and documents that
group removal lands at NEXT login: the auto-login operator session keeps
its old memberships until reboot/relog, so verify `groups` from inside
the session afterwards.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/appliance-provisioning.md

@@ -216,17 +216,24 @@ adversary). Create a dedicated **admin** (real password, sudo, NO auto-login) an
 ```bash
 sudo adduser admin && sudo usermod -aG sudo admin
 # VERIFY in a second session: log in as admin → `sudo whoami` prints root — BEFORE the next step:
-sudo deluser <operator> sudo            # demote the auto-login operator
+sudo gpasswd -d <operator> sudo          # demote the auto-login operator
 groups <operator>                        # confirm: no 'sudo'
 ```
 
+> Use **`gpasswd -d`**, not `deluser <user> <group>`: on this Ubuntu the perl adduser tooling
+> rejects hyphenated usernames (`sanitize_string: invalid characters in 'park-operator'` —
+> VERIFIED on park-buzi 2026-07-06). And group removal applies at **next login** — the auto-login
+> operator session keeps its old memberships until the box reboots (or the session relogs);
+> re-verify `groups` from inside the operator session afterwards.
+
 ⚠ Order matters: confirm the new admin's sudo works **before** demoting the operator, or you lock
 yourself out. Keep auto-login on the OPERATOR, not admin. **Leave root password disabled** (Ubuntu
 default) — `admin`+sudo IS the root path; enabling root adds risk, no gain.
 
-> Strip latent escalation groups from the operator: **`sudo deluser <operator> lxd`** (lxd group =
+> Strip latent escalation groups from the operator: **`sudo gpasswd -d <operator> lxd`** (lxd group
-> launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
+> = launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
-> `lpadmin` (printer admin, unneeded). And NEVER add the operator to `docker` (also root-equivalent).
+> `sudo gpasswd -d <operator> lpadmin` (printer admin, unneeded). And NEVER add the operator to
+> `docker` (also root-equivalent).
 
 ## 5b. Further hardening (TODO — not yet done)
 

wiki/log.md

@@ -2459,3 +2459,11 @@ stays attributable in the chain. Best-effort: no build/key → loud warning, see
 (verified both paths on a scratch DB). [[appliance-provisioning]] gained §7e: FORCE=1 reset
 commands (interactive preferred — keeps the password out of shell history), sessions-not-revoked
 caveat + JWT_SECRET rotation for suspected theft, role-row self-heal note added to §7d.
+
+## [2026-07-06] update | Runbook §5c: gpasswd -d, not deluser (hyphenated-username perl bug)
+
+Demoting the operator on park-buzi hit `sanitize_string: invalid characters in 'park-operator'` —
+Ubuntu's perl adduser/deluser tooling rejects the hyphenated username. [[appliance-provisioning]]
+§5c now uses `gpasswd -d <operator> sudo|lxd|lpadmin` (shadow-suite, no perl sanitize) and notes
+that group removal applies at NEXT login — the auto-login operator session keeps old memberships
+until reboot/relog, so verify `groups` from inside the session afterwards.