golden 0.228.0 — baked, published, round-trip verified, vouched, floor raised

Bake: build-golden.sh v3.0.0 in the drill VM, reverted to virgin and cold-booted.
GOLDEN_SHA256 76a3a98b9e7cc23bf8ae51b38a6272f576df285cb34cd22235ac3f06a31e53ec,
658 079 744 B. All four acceptance markers counted 1; excluding/FATAL/mp1 counted 0.

The 404 pre-gate was proven to work before its 404 was believed — the target URL
404'd while the existing 0.227.1 package 200'd on the same command.

The evidence is the ROUND TRIP: the downloaded bytes match the bake's size and
sha, and ./etc/felhom-controller-image read OUT of the downloaded archive says
gitea.dooplex.hu/admin/felhom-controller:0.228.0.

Vouch: three fields together — golden_version 0.228.0, agent_version 0.130.0,
min_agent 0.129.0 (read from the controller CHANGELOG header, not assumed);
wrapper_sha256 carried through explicitly. agent >= min_agent, so not the R-216
shape. Verified by RE-READING the manifest, never the flash. R-120 gate passed.

Floor raised 0.227.1 -> 0.228.0 (impact preview {"below":3,"valid":true}).
The floor is ACTING: demo-felhom self-updated 0.227.1 -> 0.228.0 in under a
minute and re-registered offsite-integrity by itself. Both demo boxes now
re-read their whole off-site store on the weekly check.

Token hygiene: file->file scp, runner script inside the VM, unit properties
grepped 0. The leak grep on the committed log was proven with a planted copy
(1) before its 0 was believed. Teardown: guest 9100 purged, secrets shredded
after the log was copied out, VM off, disk reverted to virgin.

golden_currency_gate.py red -> green. All 12 felhom.eu gates OK.

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS — what works, what's broken, what's next
 
 **Updated 2026-08-31 — the weekly off-site check now re-reads your actual data, not just the list of
-it. A third of the debug page did nothing and no longer exists. One thing is waiting on you: the
-golden and the floor for 0.228.0.**
+it. A third of the debug page did nothing and no longer exists. 0.228.0 is baked, vouched and
+delivered; both demo machines are on it and nothing is waiting on you about this release.**
 
 > **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
 > part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
@@ -13,16 +13,20 @@ golden and the floor for 0.228.0.**
 *This section is allowed to be longer than one screen, and each item says what happens if you do
 nothing.*
 
-1. **Bake and vouch a golden that carries 0.228.0, and raise the floor.** The fleet is on **0.227.1**.
-   Controller **0.228.0** is built, deployed to `demo-hp` and proven there, but a golden and the floor
-   are yours to move. **If you do nothing:** a machine installed tomorrow gets 0.227.1, whose weekly
-   check reads only the catalogue.
+1. **Nothing about delivery — the golden train is current.** Golden **0.228.0** was baked, published,
+   round-trip verified, vouched, and the fleet floor raised to 0.228.0 on 2026-08-31. Both demo
+   machines run it; **`demo-felhom` got there by itself** in under a minute and re-registered its
+   off-site check without anyone touching it. A machine installed today receives 0.228.0 and
+   everything shipped today. Evidence: `documentation/tests/golden-0.228.0-2026-08-31/`.
 
-2. **Whether to change the hub password** (R-350). I printed it into my own session log on 20 August.
+2. **Nothing else about this release.** Everything in 0.228.0 is a fix to code that ships in the
+   controller image; no customer action, no data migration, no credential change.
+
+3. **Whether to change the hub password** (R-350). I printed it into my own session log on 20 August.
    Not in git, not in any saved file — in the log on this machine. **If you do nothing:** it stays as
    it is, at the risk you accept by leaving it. I can change it without ever showing you the new one.
 
-3. **`demo-hp`'s network setup does not match our own notes** (R-338) — the machine works, the page is
+4. **`demo-hp`'s network setup does not match our own notes** (R-338) — the machine works, the page is
    wrong, or the other way round. **If you do nothing:** the page keeps misleading the next session,
    as it misled one by an hour.