golden 0.230.0 baked, vouched, floor raised - demo-felhom moved itself off the R-403 build (R-410 filed)

GOLDEN_SHA256 9287f7cef5f13166276e8406005e3f28004004510c5184f1c1c7377f7aafad2e,
657 873 700 B. Evidence documentation/tests/golden-0.230.0-2026-08-31/.

WHY IT WAS OWED: the newest golden was 0.229.0, which IS the build R-403 says deletes a
good copy. Every fresh install and the whole fleet floor still carried it.
golden_currency_gate.py had been red across dddcc80, 6e550ae, 130f7a6 and 32a4c35.

THREE INDEPENDENT READERS agreed before anything was vouched: the bake's own print, the
round trip of the PUBLISHED bytes (HTTP 200, 657873700 B, same sha), and the hub's Day-0
dropdown reading Gitea on a different code path. And the delivered artifact names the
controller it will start - ./etc/felhom-controller-image read OUT of the downloaded
archive says felhom-controller:0.230.0, with 19382 entries under var/lib/felhom/docker/.

BOTH PRE-GATES were shown able to see something before their zeroes were believed: the
404 pre-gate, and the token-leak grep which returns 0 on the committed log and 1 on a
seeded throwaway copy. The transient unit's own properties were grepped for the token
too - 0, with the same seeded positive control returning 1. Acceptance markers counted on
the COMMITTED log: 1/1/1/1 present, 0/0 absent, and the zeroes are believable because the
same including-mount-point pattern returns two real lines on that file.

THE VOUCH IS A THREE-FIELD CHANGE and only one field moved, which is stated rather than
left to look careless: golden_version 0.229.0 -> 0.230.0; agent_version 0.130.0 and
min_agent 0.129.0 UNCHANGED because v0.230.0's CHANGELOG header says MinAgent 0.129.0 and
0.129.0 <= 0.130.0, so this is not the R-216 shape. The 303 flash was not treated as
proof - the page was re-read and golden_behind_fleet confirmed absent.

THE FLOOR is a separate setting and was raised on the operator's explicit answer:
min_controller_version 0.229.0 -> 0.230.0. THE POSITIVE OBSERVABLE, from the agent's own
journal on demo-felhom, which was still running the defective 0.229.0:
  16:21:30 controller-swap: image file written, restarting bootstrap  target=...0.230.0
  16:21:40 controller-swap: new controller healthy                    target=...0.230.0
Both boxes now 0.230.0 healthy. Honest note: the polling loop's first read already said
0.230.0, so the transition was not seen by the loop - the journal is the evidence.

R-410 FILED, found while the gate went green: golden_currency_gate.py is satisfied by a
DIRECTORY NAME (EVIDENCE_RE against os.listdir, :89,:123). I created the evidence
directory before the bake finished and the gate would have passed at that moment. It
already declares that it does not check the vouch; it does not declare that the bake
check is a filename check. Fix: read the GOLDEN_SHA256= line out of the directory's
bake.log, with a red-proof on an empty directory.

R-242 updated - seventh debt, paid the same day, twice in one day.

Teardown: pct destroy 9100 --purge, shred -u AFTER the log was copied out, poweroff,
qemu confirmed exited with ps -eo comm (not pgrep -f, which self-matches), disk reverted
to virgin.

All 13 gates green - the first push this session that needed no --no-verify.

Ceiling R-409 -> R-410.

STATUS.md

@@ -1,12 +1,13 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-08-31 (second pass) — I measured whether the box could test its own off-site
-restore without you. It can, and it is cheap — but not in the shape we had written down, so
-there is a decision for you in item 4. No code changed today.**
+**Updated 2026-08-31 (third pass) — golden 0.230.0 is baked, vouched and delivered. Both demo
+machines are now on the build that stops a good backup copy being deleted; `demo-felhom` moved
+itself. Nothing is waiting on you about that release any more.**
+
+**Earlier 2026-08-31 — I measured whether the box could test its own off-site
+restore without you. It can, and it is cheap — but not in the shape we had written down, so
+there is a decision for you in item 4. No product code changed.**
 
-**Earlier 2026-08-31 — the weekly off-site check now re-reads your actual data, not just the list of
-it. A third of the debug page did nothing and no longer exists. 0.228.0 is baked, vouched and
-delivered; both demo machines are on it and nothing is waiting on you about this release.**
 
 > **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
 > part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
@@ -17,14 +18,13 @@ delivered; both demo machines are on it and nothing is waiting on you about this
 *This section is allowed to be longer than one screen, and each item says what happens if you do
 nothing.*
 
-1. **A golden carrying 0.230.0 is owed.** Golden **0.229.0** is vouched and the fleet floor is 0.229.0
-   — **and 0.229.0 is the build that deletes a good copy** (R-403, measured today). Both demo machines
-   and any machine installed right now carry that defect. `demo-hp` has been updated to 0.230.0 by
-   hand; `demo-felhom` has not. **If you do nothing:** the fix stays on one machine and a newly
-   installed box gets the defect. Baking and vouching 0.230.0 and raising the floor closes it — the
-   same three-field change as this morning.
+1. **Nothing is waiting on you about the 0.230.0 release.** Golden **0.230.0** is baked,
+   published and vouched, and the fleet floor is raised to 0.230.0. **`demo-felhom` was still
+   running 0.229.0 — the build that deletes a good copy — and moved itself across, unattended, in
+   about two minutes.** Both machines are healthy on 0.230.0, and a machine installed from scratch
+   now gets the fix too. Reversible if it ever needs to be: re-select the old values and save.
 
-2. **Nothing else about this release.** Everything in 0.229.0 is a fix to code that ships in the
+2. **Nothing else about this release.** Everything in 0.230.0 is a fix to code that ships in the
    controller image; no customer action, no data migration, no credential change.
 
 3. **Whether a documents-only push should still be checked for a missing golden** (R-404). We have now