docs: Phase C — golden 0.153.0 baked and published, all gates green

build-golden.sh v2.1.0 on felhom-pve from the vacation site. P3 (registry
reachability) passed before any mutation; the one deviation from the 0.146.0
recipe was an empty template cache, handled with pveam download (approved).

First golden carrying all FOUR infra images — the list came from
--print-infra-images on the 0.153.0 binary itself, so the historical
3-image fallback never fired and felhom-samba:1.1.0 is baked.

Upload HTTP 201; anonymous GET 200 with an exact sha256 byte-match
(15fdd191f3c660a6...); ranged request 206; the hub pod can fetch it.
GL-1 teardown: token via 0600 env file (never argv), shredded; leak grep 0;
build guest 9100 left stopped.

Bake log retained at 180:/mnt/5_hdd/felhom.eu/drill/bake-0.153.0.log.

REPORT.md

@@ -147,15 +147,64 @@ from the LIVE compose by `DBServiceNames`, unassisted.
 Credentials handling per GL-1: the operator's password was supplied file→file, never echoed, and the
 file plus both cookie jars (host and guest) were shredded at the end of the run.
 
+## 4c. Phase C — golden **0.153.0** baked and published (2026-07-20)
+
+Probes first, all before any mutation:
+
+| Probe | Result |
+|---|---|
+| **P1** — read `180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log` end to end | recipe extracted: `pct`-based LXC 9100 on felhom-pve, args `9100 <template> local-lvm local vmbr0 <controller-image>`, creds via `REGISTRY_USER`/`REGISTRY_TOKEN`, publish to the gitea generic package registry |
+| **P2** — build environment matches the log's starting point | 9100 absent (clean slate ✓); local-lvm 277 G / local 80 G free ✓; **DEVIATION: the Debian 13 template cache was EMPTY** (the 0.146.0 bake had it cached) |
+| **P3** — registry reachable from the vacation site (**load-bearing**) | **PASS.** `gitea.dooplex.hu` → `37.191.56.193` (public path); registry `/v2/` → 401 (alive, auth-gated); gitea API → 200; Docker Hub `/v2/` → 401. Independently corroborated: guest 9201 pulled `felhom-controller:0.153.0` from that registry the same afternoon |
+
+**P2 deviation, handled explicitly:** `pveam download local debian-13-standard_13.6-1_amd64.tar.zst`
+(129 954 319 B, checksum verified, 22 MB/s). This is the ONE departure from the 0.146.0 recipe and
+it is environmental, not a build-golden defect. Operator approved before it ran.
+
+Bake: `build-golden.sh` **v2.1.0** (confirmed on the host copy), run **detached under `setsid`+`nohup`**
+so an SSH blip over the tailnet could not orphan a half-built guest. Controller image
+`gitea.dooplex.hu/admin/felhom-controller:0.153.0`.
+
+### Gate table — vs the 0.146.0 row
+
+| Gate | 0.146.0 | **0.153.0** |
+|---|---|---|
+| Script version | v2.0.0 | **v2.1.0** |
+| Docker in build guest | overlay2, separate `/var/lib/docker` + `/mnt/sys_drive` mounts | same ✓ |
+| Controller image baked | 0.146.0 | **0.153.0** ✓ |
+| **Infra images baked** | **3** (historical fallback list) | **4** — `traefik:v3.6.7`, `cloudflare/cloudflared:2026.6.0`, `gtstef/filebrowser:1.3.3-stable`, **`gitea.dooplex.hu/admin/felhom-samba:1.1.0`** ✓ |
+| Source of the infra list | hard-coded fallback | **`--print-infra-images` from the 0.153.0 binary itself** — no WARN line in the log, so the fallback never fired |
+| `docker image ls` inside the guest ⊇ that list | — | **verified** — all four present, plus the baked controller |
+| Archive | 584 MB | **618 MB**, volid `local:backup/vzdump-lxc-9100-2026_07_20-17_50_57.tar.zst` |
+| Publish: pre-delete | HTTP 404 | **HTTP 404** ✓ |
+| Publish: upload | HTTP 201 | **HTTP 201** ✓ |
+| Anonymous GET + byte-match | — | **HTTP 200, 648 549 366 B, sha256 matches exactly** ✓ |
+| Ranged request (resumable restore) | — | **HTTP 206**, 1024 B ✓ |
+| Hub can fetch it from its own network position | — | **verified** — `wget` from the `hub-…` pod exits 0 |
+
+```
+GOLDEN_VERSION=0.153.0
+GOLDEN_SHA256=15fdd191f3c660a60dc8651111053dd84281aeebc6c4c0f9ecdd3a87cb45a9d0
+```
+
+**GL-1 teardown:** the token was written to a `0600` env file via STDIN (never in argv on either
+host), sourced by the detached run, and **shredded**. Token-leak grep over the bake transcript
+(host copy and the retained copy) = **0**; the build guest holds no registry credential; build guest
+9100 left **stopped** (destroy with `pct destroy 9100 --purge`); the 618 MB local verification copy
+was deleted. Log retained beside its predecessor: `180:/mnt/5_hdd/felhom.eu/drill/bake-0.153.0.log`.
+
+**Honest scope note:** I verified the golden artifact is published, byte-correct and fetchable *by
+the hub*. I did **not** render the hub's golden **dropdown** — that is the password-gated operator
+UI, and it remains part of STOP-2.
+
 ## 5. NOT yet live-validated — remaining human/supervised work
 
 - ~~**STOP-1**~~ — **DONE 2026-07-20, PASSED.** See §4b for the log ordering, timestamps and the
   before/after comparison against round 2. Residual: the immich **timeline screenshot** still cannot
   be captured from here (no browser on DooPlex) — that one visual remains the operator's.
-- **Phase C (golden 0.153.0):** probes P1–P3 first. **P3 is load-bearing** — the drill environment is
-  at the vacation site and must be proven able to pull
-  `gitea.dooplex.hu/admin/felhom-controller:0.153.0` BEFORE any bake. If unreachable: stop and
-  report; change no routing/DNS/nft.
+- ~~**Phase C**~~ — **DONE 2026-07-20.** Golden 0.153.0 baked, published, all gates green
+  (§4c). `GOLDEN_SHA256=15fdd191f3c660a60dc8651111053dd84281aeebc6c4c0f9ecdd3a87cb45a9d0`.
+  Housekeeping left for whoever is next at the host: `pct destroy 9100 --purge`.
 - **STOP-2 (Viktor, password-gated):** Day-0 manifest Golden → 0.153.0 (Agent 0.90.1 / MinAgent
   0.90.0 unchanged — the CHANGELOG's no-coupling declaration is the authority), then floor →
   v0.153.0 saved **LAST**. Watching the demo box wake during the manifest save banks the **R-23(a)**