# REPORT — build-golden.sh default fix + golden rebuild at current (2026-06-27)

**Task class:** Risky/supervised, Part A only. **No agent binary change** — version stays **v0.42.0**.

## What changed

`configs/build-golden.sh` — the `CONTROLLER_IMAGE` default (positional arg 6) was a stale
`gitea.dooplex.hu/admin/felhom-controller:0.43.0`. An argument-less build therefore baked a wildly old
controller, so fresh Day-0 boxes booted old (the demo started at 0.77). Bumped the default to the
**current** `…/felhom-controller:0.85.1`, with a comment that the version should still be passed
explicitly at each rebuild (a `make golden` that resolves the latest tag is a future Observation).

## Green gate

- `bash -n configs/build-golden.sh` → OK.

## Golden rebuild (live on felhom-pve)

Ran the rebuild with the controller image passed **explicitly**:

```
build-golden.sh 9100 local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst \
                local-lvm local vmbr0 gitea.dooplex.hu/admin/felhom-controller:0.85.1
```
(`REGISTRY_USER`/`REGISTRY_TOKEN` sourced out-of-band from `/root/.golden-secrets.env`.)

- **New golden archive volid:** `local:backup/vzdump-lxc-9100-2026_06_27-11_42_51.tar.zst`
  (rootfs 32G + Docker-data 16G + user-data 8G; archive size ~574 MB; the vzdump log confirmed
  *including mount point mp0 (/var/lib/docker)* and *mp1 (/mnt/sys_drive)* — neither excluded).

### Baked-image verify (cheap, mandatory) — PASS

In the build guest (started briefly, then stopped again):

```
/etc/felhom-controller-image  → gitea.dooplex.hu/admin/felhom-controller:0.85.1
docker images (felhom-controller) → gitea.dooplex.hu/admin/felhom-controller:0.85.1  379MB
```

New Day-0 provisions now ship **current** (the host-bootstrap script auto-discovers the newest golden,
so it picks up this rebuild with no further change).

### Full verify (throwaway provision) — not performed

Operator-gated/recommended only. The cheap verify already proves the archive carries 0.85.1; the real
demo 9201 was deliberately **not** re-provisioned (it is the Phase-2 floor test box). The build guest
9100 is left stopped (destroy with `pct destroy 9100 --purge` when no longer needed).

## Observations

- A `make golden` (or a `--latest` flag) that resolves the newest pullable controller tag at build time
  would make the hand-bumped default unnecessary and prevent this class of drift entirely.