## 2026-09-28T07:25:42Z golden 0.276.0 — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1)
  reverted to virgin (this also proves no qemu holds the qcow2)
  cold boot started
  ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
system          debian-13-standard_13.6-1_amd64.tar.zst
system          debian-13-standard_13.6-1_arm64.tar.zst
  template (current point release, listed not assumed): debian-13-standard_13.6-1_arm64.tar.zst
  template downloaded
  script (v3.0.0) + token landed, non-empty, executable
  bake launched 2026-09-28T07:26:42Z  (GITEA_USER=admin)
  token leak check on the unit (needle proven non-empty, so the grep cannot match everything): 0
  unit state: inactive at 2026-09-28T07:27:03Z
  log copied off the machine FIRST: 19 lines
  markers: overlay2=0 mountpoints=0 upload=0 FATAL=0 excluding=0
  token-leak grep on the saved log: 0
  positive control (token appended to a throwaway copy): 1
  REGISTRY CHECK (the outcome, not the attempt): golden 0.276.0 -> http=404
  secrets shredded (3 expected absent): 3
  pct list lines after destroy: 0
  qemu processes: 0
  PUBLISHED; guest destroyed, qemu exited, disk reverted to virgin
## bake finished 2026-09-28T07:27:28Z
## CORRECTION (written by hand after the run): this attempt was ABORTED by CC, and the "PUBLISHED" line
## above is WRONG — the driver printed it unconditionally. The registry check two lines earlier (404) is
## the truth: nothing was published. DEVIATION: the driver chose the template with `sort -V | tail -1`
## over both arches and picked debian-13-standard_13.6-1_arm64. CC saw it in the progress file and ran
## `systemctl stop golden-bake` in the VM during `pct create` (log: "unable to create CT 9100 - received
## interrupt"); no CT, no archive, no upload. Teardown ran normally. Fixed for attempt 2: the pick is
## restricted to `_amd64`, and "PUBLISHED" is printed only when the registry answers 200.
