v0.334.0: a live box refreshes its config with its own hub key (GET /box-config; R-1159, operator D19)

CHANGELOG.md

@@ -1,3 +1,18 @@
+## v0.334.0 — a live box refreshes its config with its own key (box-config, R-1159, operator decision D19) (2026-10-19)
+
+**MinAgent: 0.158.1** — the floor's, carried; no agent change. No golden (`09` §3 decision 250). Needs hub ≥ 0.161.0
+for the new route; against an older hub it falls back to the passphrase, as before.
+
+- **The config refresh uses the box's OWN hub key** (R-1159, D19 „box key first, then lock"). On each config change
+  (the report ACK's `config_version`) the controller re-pulled `controller.yaml` with the household's retrieval
+  passphrase from `bootstrap.json`. It now pulls `GET /api/v1/box-config/{id}` with its hub key
+  (`report.PullConfigPreferKey`); the passphrase only when the hub has no such route (404/405) or the box holds no key
+  yet; a refused key is returned as it is, never retried with the passphrase. Hub 0.161.0 then refuses the
+  passphrase's keys for a box whose controller is this version or newer and has reported. The first-boot pull (no key
+  yet) is unchanged. Tests `TestR1159_RefreshUsesTheBoxKey` (new hub / old hub / no key / refused key) — red-proved
+  with the old pull (0 key pulls) — and `TestR1159_MainWiresTheKeyFirstRefresh` (the live refresh in `main.go` calls
+  it).
+
 ## v0.333.0 — the file manager's own pass ends with the dashboard sign-out (R-1155); the recovery-code page says the code becomes live after the check (R-1161) (2026-10-19)
 
 **MinAgent: 0.158.1** — the floor's, carried. Neither change needs a new agent (R-1161's two texts are chosen by the