CHANGELOG v0.143.0 (R-840); build-golden.sh 3.2.0: GOLDEN_GUEST_PKGS — the approved guest release at bake time, first-night count

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

configs/build-golden.sh

@@ -61,7 +61,7 @@ set -euo pipefail
 
 # Script provenance — logged into every bake transcript next to the baked controller tag, so an
 # archive can always be traced to the script that produced it. Bump on any behavior change.
-GOLDEN_SCRIPT_VERSION="3.1.0"
+GOLDEN_SCRIPT_VERSION="3.2.0"
 
 VMID="${1:-9100}"
 TEMPLATE="${2:-local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst}"
@@ -137,6 +137,48 @@ pct exec "$VMID" -- env GOLDEN_DOCKER_PKGS="$GOLDEN_DOCKER_PKGS" bash -c '
   fi
   dpkg-query -W containerd.io docker-buildx-plugin docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin 2>/dev/null | sed "s/^/  installed: /"
 '
+# v3.2.0 (Part F of the R-840 brief, `11` §5.3): GOLDEN_GUEST_PKGS = the newest APPROVED guest release, as
+# "name=version …" (the hub's os_releases row for layer guest, IN FORCE — never a cancelled test approval). The bake
+# brings every package the template HAS to exactly that version, under felhom-os-apply's rules: never a package the
+# template lacks (--only-upgrade), never newer than approved, never a removal or a new package (a simulation is checked
+# first and the bake FAILS on either). Empty = no approved guest release in force: the template's versions stay, and
+# the box's first night installs whatever release is approved then. Either way the bake PRINTS the first-night count:
+# how many installed packages are older than the approved version (target 0).
+GOLDEN_GUEST_PKGS="${GOLDEN_GUEST_PKGS:-}"
+pct exec "$VMID" -- env GOLDEN_GUEST_PKGS="$GOLDEN_GUEST_PKGS" bash -c '
+  set -e
+  export DEBIAN_FRONTEND=noninteractive
+  if [ -z "$GOLDEN_GUEST_PKGS" ]; then
+    echo "[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a"
+    echo "[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): $(apt list --upgradable 2>/dev/null | grep -c /)"
+    exit 0
+  fi
+  want=""
+  for nv in $GOLDEN_GUEST_PKGS; do
+    n=${nv%%=*}; v=${nv#*=}
+    cur=$(dpkg-query -W -f="\${Version}" "$n" 2>/dev/null) || continue           # not in the template: never added
+    dpkg --compare-versions "$cur" lt "$v" && want="$want $n=$v"
+  done
+  if [ -n "$want" ]; then
+    sim=$(apt-get -s install --only-upgrade -o Dpkg::Options::=--force-confold $want)
+    if echo "$sim" | grep -q "^Remv "; then echo "[golden] FATAL: the approved guest set would REMOVE a package"; echo "$sim" | grep "^Remv "; exit 1; fi
+    for p in $(echo "$sim" | awk "/^Inst /{print \$2}"); do
+      dpkg-query -W "$p" >/dev/null 2>&1 || { echo "[golden] FATAL: the approved guest set would ADD $p - not in the template"; exit 1; }
+    done
+    apt-get install -y -qq --only-upgrade -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef $want >/dev/null
+    echo "[golden] approved guest release installed: $(echo $want | wc -w) package(s) brought to the approved version"
+  else
+    echo "[golden] approved guest release: the template already runs every approved version"
+  fi
+  left=0
+  for nv in $GOLDEN_GUEST_PKGS; do
+    n=${nv%%=*}; v=${nv#*=}
+    cur=$(dpkg-query -W -f="\${Version}" "$n" 2>/dev/null) || continue
+    dpkg --compare-versions "$cur" lt "$v" && { left=$((left+1)); echo "  still older: $n $cur < $v"; }
+  done
+  echo "[golden] first-night count vs the approved guest release: $left (target 0)"
+  [ "$left" -eq 0 ] || { echo "[golden] FATAL: $left package(s) stayed older than the approved release"; exit 1; }
+'
 echo "[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …"
 # containerd-snapshotter (Docker 28+/29 default) keeps the IMAGE content store under
 # /var/lib/containerd — which is NOT /var/lib/docker, so it would stay on the OS rootfs and the split