Golden 0.226.1 baked, vouched, and the fleet floor raised — the debt is paid

golden_currency_gate.py had been CONVICTED four times today across three
controller releases. One bake covers all three, and the gate went red -> green
on the same command, which is its proof that it measures something real. THE
THREE DECLARED BYPASSES ARE NOW HISTORICAL RATHER THAN STANDING.

  GOLDEN_VERSION  0.226.1
  GOLDEN_SHA256   70ed8e9377dec22a9b493e55f222b0e25a49d7f3caec8c506e0412fd6baefe69
  size            657 197 592 B
  baked           gitea.dooplex.hu/admin/felhom-controller:0.226.1
  MinAgent        0.129.0  (read from the controller CHANGELOG header, not assumed)

THE EVIDENCE IS THE ROUND TRIP, NOT THE BUILD LOG. The published bytes were
downloaded back -- size and sha256 both identical to what the bake reported --
and ./etc/felhom-controller-image was read OUT of the downloaded archive:
`felhom-controller:0.226.1`. That is the delivered artifact naming the
controller it will start, from the bytes a customer's box would actually fetch.

Acceptance markers counted, not eyeballed, each string captured from this run's
own log rather than paraphrased from the runbook (two of the three the runbook
named until R-233 could not match anything the script prints): docker OK
(overlay2 = 1, including mount point rootfs = 1, mp0 = 1, upload OK (HTTP 201) =
1; excluding = 0, FATAL = 0, mp1 = 0. The 404 pre-gate passed before the run, so
nothing was overwritten.

THE VOUCH IS A THREE-FIELD CHANGE AND ALL THREE WERE CHECKED: agent_version
0.130.0 >= min_agent 0.129.0, so NOT the R-216 shape; wrapper_sha256 carried
through explicitly because the handler clears it when omitted. Verified by
RE-READING the manifest rather than trusting the flash -- golden option 0.226.1
SELECTED, all four shas matching.

THE FLOOR IS PROVEN ACTING, NOT MERELY SET. demo-felhom self-updated within 30
seconds: "[selfupdate] Post-update startup: update successful (0.225.0 ->
0.226.1)". Both demo machines now run 0.226.1 and only one of them was deployed
to by hand.

Token hygiene: copied file->file, read inside the VM by a runner script, never
on a command line (systemctl show ... | grep -c -F token = 0). THE LEAK GREP ON
THE COMMITTED LOG WAS PROVEN TO WORK BEFORE ITS 0 WAS BELIEVED -- a throwaway
copy with the token appended grepped 1, was shredded, and only then was the real
log's 0 taken as evidence.

Teardown: build guest 9100 destroyed --purge, secrets shredded AFTER the log was
copied out (standing rule 5), VM powered off, disk reverted to virgin.

R-242's OTHER half is untouched and still open: nothing gates the VOUCH itself.

documentation/tests/golden-0.226.1-2026-08-30/README.md

@@ -0,0 +1,81 @@
+# Golden bake 0.226.1 — 2026-08-30
+
+Baked to close `golden_currency_gate.py`, which had been CONVICTED across **three** controller
+releases (0.224.0 R-330, 0.225.0 R-331, 0.226.0/0.226.1 R-353/357/358/360). One bake covers all three.
+
+## What was produced
+
+| | |
+|---|---|
+| `GOLDEN_VERSION` | **0.226.1** |
+| `GOLDEN_SHA256` | `70ed8e9377dec22a9b493e55f222b0e25a49d7f3caec8c506e0412fd6baefe69` |
+| size | **657 197 592 B** |
+| package URL | `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.226.1/golden.tar.zst` |
+| baked controller | `gitea.dooplex.hu/admin/felhom-controller:0.226.1` |
+| `MinAgent` | **0.129.0** (read from the controller `CHANGELOG.md` header, not assumed) |
+| script | `build-golden.sh v3.0.0` |
+| venue | the drill VM on DooPlex, reverted to `virgin` and **cold-booted** first |
+| template | `debian-13-standard_13.6-1_amd64.tar.zst` — after `pveam update`, because the virgin snapshot's INDEX is stale too and the failure reads as a bogus `400 no such template` |
+
+## Acceptance markers — counted, not eyeballed
+
+Each string was captured from this run's own log rather than paraphrased from the runbook (two of the
+three markers the runbook named until 2026-08-06 could not match anything the script prints — R-233):
+
+```
+docker OK (overlay2             : 1     ← "  docker OK (overlay2; data-root /var/lib/docker)"
+including mount point rootfs    : 1
+including mount point mp0       : 1
+upload OK (HTTP 201)            : 1
+--- must be ZERO ---
+excluding                       : 0
+FATAL                           : 0
+mount point mp1                 : 0     ← mp1 stopped existing in build-golden.sh v3.0.0 (R-165)
+```
+
+**404 pre-gate before the run:** `HTTP 404` on the package URL, so nothing was overwritten.
+**The script's own pre-delete** then reported `HTTP 404 (404/204 expected)`.
+
+## The evidence is the ROUND TRIP, not the build log
+
+The published bytes were downloaded back and compared to what the bake reported:
+
+```
+downloaded size : 657197592          bake reported : 657197592
+downloaded sha  : 70ed8e93…baefe69   bake reported : 70ed8e93…baefe69
+```
+
+**And the delivered artifact was asked what it will start** — `./etc/felhom-controller-image` read
+*out of the downloaded archive*:
+
+```
+gitea.dooplex.hu/admin/felhom-controller:0.226.1
+```
+
+That is the golden naming the controller it will run, read from the bytes a customer's box would
+actually fetch — not from the build host, and not from the local file.
+
+## Token hygiene
+
+The Gitea token was copied **file → file** (`scp`), never crossing a shell on either side, and the
+bake ran through a runner script inside the VM that reads it itself — so it never reached a command
+line or a transient unit's properties:
+
+```
+systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"  → 0
+```
+
+**The leak grep on the committed log was PROVEN TO WORK before its `0` was believed.** A throwaway
+copy had the token appended, was grepped (**1**), and was `shred -u`'d; only then was the real log's
+**0** taken as evidence. A `0` from an untested grep is not a measurement.
+
+```
+POSITIVE CONTROL (token appended) : 1
+THE COMMITTED bake.log            : 0
+```
+
+## Teardown
+
+Build guest `9100` destroyed `--purge`; token, runner and log `shred -u`'d **after** this log was
+copied out (standing rule 5: evidence leaves at the end of the phase that produced it, not at the end
+of the session); VM powered off and the disk reverted to `virgin`.

documentation/tests/golden-0.226.1-2026-08-30/bake.log

@@ -0,0 +1,325 @@
+[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.226.1
+[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) …
+  Logical volume "vm-9100-disk-0" created.
+  Logical volume pve/vm-9100-disk-0 changed.
+Creating filesystem with 8388608 4k blocks and 2097152 inodes
+Filesystem UUID: 4c7ef416-2bf9-4370-8ee6-0d489b09d60a
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+	4096000, 7962624
+  Logical volume "vm-9100-disk-1" created.
+  Logical volume pve/vm-9100-disk-1 changed.
+Creating filesystem with 6291456 4k blocks and 1572864 inodes
+Filesystem UUID: 7ae65e7b-974d-4ed2-84b9-9ebe0b765a3c
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst'
+Total bytes read: 553512960 (528MiB, 97MiB/s)
+Detected container architecture: amd64
+Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
+done: SHA256:GiVCjRMdlF3+2P5j/DB6KzwlJ4NfdFh+QXC2ZWmL22A root@felhom-golden
+Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
+done: SHA256:KJsjK3uCM+ZXXUZ30WJPJkqakqd4Mk0h7CGNKzwq6jk root@felhom-golden
+Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
+done: SHA256:rIQliZGHSoTs+uZ2KzddRRaHuLhhdk4SitykIKLY/9g root@felhom-golden
+[golden] starting + installing Docker (official repo, trixie channel) …
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …
+[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds …
+[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) …
+Unable to find image 'hello-world:latest' locally
+latest: Pulling from library/hello-world
+4f55086f7dd0: Pulling fs layer
+4f55086f7dd0: Download complete
+4f55086f7dd0: Pull complete
+Digest: sha256:5dd0d3e6e255913fc30f90b9f2b1d359cc2cbdb48090cc4b65f1676e203243cc
+Status: Downloaded newer image for hello-world:latest
+  docker OK (overlay2; data-root /var/lib/docker)
+  /var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4
+  /mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4
+  both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576
+[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.226.1 (no registry cred at deploy) …
+
+WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
+Configure a credential helper to remove this warning. See
+https://docs.docker.com/go/credential-store/
+
+0.226.1: Pulling from admin/felhom-controller
+a8ac7f6c67ab: Pulling fs layer
+bf30769d36e7: Pulling fs layer
+044b66fbe46c: Pulling fs layer
+b5c41a28e83f: Pulling fs layer
+a95c936abb71: Pulling fs layer
+96a9d451dd61: Pulling fs layer
+b5c41a28e83f: Waiting
+a95c936abb71: Waiting
+96a9d451dd61: Waiting
+a8ac7f6c67ab: Verifying Checksum
+a8ac7f6c67ab: Download complete
+b5c41a28e83f: Verifying Checksum
+b5c41a28e83f: Download complete
+a95c936abb71: Verifying Checksum
+a95c936abb71: Download complete
+96a9d451dd61: Verifying Checksum
+96a9d451dd61: Download complete
+044b66fbe46c: Verifying Checksum
+044b66fbe46c: Download complete
+bf30769d36e7: Verifying Checksum
+bf30769d36e7: Download complete
+a8ac7f6c67ab: Pull complete
+bf30769d36e7: Pull complete
+044b66fbe46c: Pull complete
+b5c41a28e83f: Pull complete
+a95c936abb71: Pull complete
+96a9d451dd61: Pull complete
+Digest: sha256:eb1c14fd93df3c22159ffc03361220971c2feacdb2b9b9bb1fbb89e871c56565
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.226.1
+gitea.dooplex.hu/admin/felhom-controller:0.226.1
+[golden] asking the controller which infra images it manages …
+[golden] baking infra images (4): traefik:v3.6.7 cloudflare/cloudflared:2026.6.0 gtstef/filebrowser:1.3.3-stable gitea.dooplex.hu/admin/felhom-samba:1.1.0 …
+v3.6.7: Pulling from library/traefik
+589002ba0eae: Pulling fs layer
+ef63511ea6cc: Pulling fs layer
+0738e5cb835e: Pulling fs layer
+3e6813f70c64: Pulling fs layer
+3e6813f70c64: Waiting
+589002ba0eae: Verifying Checksum
+589002ba0eae: Download complete
+ef63511ea6cc: Verifying Checksum
+ef63511ea6cc: Download complete
+3e6813f70c64: Verifying Checksum
+3e6813f70c64: Download complete
+589002ba0eae: Pull complete
+0738e5cb835e: Verifying Checksum
+0738e5cb835e: Download complete
+ef63511ea6cc: Pull complete
+0738e5cb835e: Pull complete
+3e6813f70c64: Pull complete
+Digest: sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a
+Status: Downloaded newer image for traefik:v3.6.7
+docker.io/library/traefik:v3.6.7
+2026.6.0: Pulling from cloudflare/cloudflared
+47de5dd0b812: Pulling fs layer
+c172f21841df: Pulling fs layer
+99515e7b4d35: Pulling fs layer
+99ba982a9142: Pulling fs layer
+d6b1b89eccac: Pulling fs layer
+2780920e5dbf: Pulling fs layer
+7c12895b777b: Pulling fs layer
+3214acf345c0: Pulling fs layer
+52630fc75a18: Pulling fs layer
+dd64bf2dd177: Pulling fs layer
+b839dfae01f6: Pulling fs layer
+ebddc55facdc: Pulling fs layer
+bdfd7f7e5bf6: Pulling fs layer
+2d4d7adf6272: Pulling fs layer
+40008157d8d2: Pulling fs layer
+bd8962e29291: Pulling fs layer
+cac2ae0193cb: Pulling fs layer
+74d1dac84ecc: Pulling fs layer
+52630fc75a18: Waiting
+dd64bf2dd177: Waiting
+b839dfae01f6: Waiting
+ebddc55facdc: Waiting
+bdfd7f7e5bf6: Waiting
+2d4d7adf6272: Waiting
+40008157d8d2: Waiting
+bd8962e29291: Waiting
+cac2ae0193cb: Waiting
+74d1dac84ecc: Waiting
+d6b1b89eccac: Waiting
+2780920e5dbf: Waiting
+7c12895b777b: Waiting
+3214acf345c0: Waiting
+99ba982a9142: Waiting
+47de5dd0b812: Download complete
+c172f21841df: Download complete
+99515e7b4d35: Verifying Checksum
+99515e7b4d35: Download complete
+99ba982a9142: Verifying Checksum
+99ba982a9142: Download complete
+d6b1b89eccac: Verifying Checksum
+d6b1b89eccac: Download complete
+2780920e5dbf: Verifying Checksum
+2780920e5dbf: Download complete
+7c12895b777b: Verifying Checksum
+7c12895b777b: Download complete
+52630fc75a18: Verifying Checksum
+52630fc75a18: Download complete
+47de5dd0b812: Pull complete
+3214acf345c0: Verifying Checksum
+3214acf345c0: Download complete
+dd64bf2dd177: Verifying Checksum
+dd64bf2dd177: Download complete
+b839dfae01f6: Verifying Checksum
+b839dfae01f6: Download complete
+ebddc55facdc: Verifying Checksum
+ebddc55facdc: Download complete
+bdfd7f7e5bf6: Verifying Checksum
+bdfd7f7e5bf6: Download complete
+40008157d8d2: Verifying Checksum
+40008157d8d2: Download complete
+bd8962e29291: Download complete
+2d4d7adf6272: Verifying Checksum
+2d4d7adf6272: Download complete
+c172f21841df: Pull complete
+cac2ae0193cb: Verifying Checksum
+cac2ae0193cb: Download complete
+99515e7b4d35: Pull complete
+74d1dac84ecc: Verifying Checksum
+74d1dac84ecc: Download complete
+99ba982a9142: Pull complete
+d6b1b89eccac: Pull complete
+2780920e5dbf: Pull complete
+7c12895b777b: Pull complete
+3214acf345c0: Pull complete
+52630fc75a18: Pull complete
+dd64bf2dd177: Pull complete
+b839dfae01f6: Pull complete
+ebddc55facdc: Pull complete
+bdfd7f7e5bf6: Pull complete
+2d4d7adf6272: Pull complete
+40008157d8d2: Pull complete
+bd8962e29291: Pull complete
+cac2ae0193cb: Pull complete
+74d1dac84ecc: Pull complete
+Digest: sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f
+Status: Downloaded newer image for cloudflare/cloudflared:2026.6.0
+docker.io/cloudflare/cloudflared:2026.6.0
+1.3.3-stable: Pulling from gtstef/filebrowser
+6a0ac1617861: Pulling fs layer
+ef8806083e82: Pulling fs layer
+b74107c861c7: Pulling fs layer
+adc935def003: Pulling fs layer
+4f4fb700ef54: Pulling fs layer
+18695ccc900a: Pulling fs layer
+45d119d5c397: Pulling fs layer
+dac52db4fc51: Pulling fs layer
+6d598f86b2f2: Pulling fs layer
+8aa349c8396c: Pulling fs layer
+dac52db4fc51: Waiting
+6d598f86b2f2: Waiting
+8aa349c8396c: Waiting
+adc935def003: Waiting
+4f4fb700ef54: Waiting
+18695ccc900a: Waiting
+45d119d5c397: Waiting
+6a0ac1617861: Verifying Checksum
+6a0ac1617861: Download complete
+adc935def003: Verifying Checksum
+adc935def003: Download complete
+4f4fb700ef54: Verifying Checksum
+4f4fb700ef54: Download complete
+6a0ac1617861: Pull complete
+18695ccc900a: Verifying Checksum
+18695ccc900a: Download complete
+45d119d5c397: Verifying Checksum
+45d119d5c397: Download complete
+b74107c861c7: Verifying Checksum
+b74107c861c7: Download complete
+6d598f86b2f2: Verifying Checksum
+6d598f86b2f2: Download complete
+dac52db4fc51: Verifying Checksum
+dac52db4fc51: Download complete
+ef8806083e82: Verifying Checksum
+ef8806083e82: Download complete
+8aa349c8396c: Verifying Checksum
+8aa349c8396c: Download complete
+ef8806083e82: Pull complete
+b74107c861c7: Pull complete
+adc935def003: Pull complete
+4f4fb700ef54: Pull complete
+18695ccc900a: Pull complete
+45d119d5c397: Pull complete
+dac52db4fc51: Pull complete
+6d598f86b2f2: Pull complete
+8aa349c8396c: Pull complete
+Digest: sha256:eb3733681db8757412632c61a99ad656f0d94ed6781bb2ea114b4d70babab78c
+Status: Downloaded newer image for gtstef/filebrowser:1.3.3-stable
+docker.io/gtstef/filebrowser:1.3.3-stable
+1.1.0: Pulling from admin/felhom-samba
+897d797d2723: Pulling fs layer
+3051591aa250: Pulling fs layer
+ce57a3f93416: Pulling fs layer
+fb94eeec2fe1: Pulling fs layer
+fb94eeec2fe1: Waiting
+ce57a3f93416: Verifying Checksum
+ce57a3f93416: Download complete
+fb94eeec2fe1: Verifying Checksum
+fb94eeec2fe1: Download complete
+897d797d2723: Verifying Checksum
+897d797d2723: Download complete
+3051591aa250: Verifying Checksum
+3051591aa250: Download complete
+897d797d2723: Pull complete
+3051591aa250: Pull complete
+ce57a3f93416: Pull complete
+fb94eeec2fe1: Pull complete
+Digest: sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.1.0
+gitea.dooplex.hu/admin/felhom-samba:1.1.0
+[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'.
+[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'.
+[golden] baking the first-boot SSH host-key regeneration unit (F3) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'.
+[golden] identity-clean + minimize …
+[golden] stop + archive …
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: archive file size: 626MB
+INFO: Finished Backup of VM 9100 (00:00:47)
+[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_08_30-20_09_42.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive)
+[golden] publishing golden (657197592 bytes, sha256 70ed8e9377dec22a…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.226.1/golden.tar.zst
+[golden]   pre-delete existing: HTTP 404 (404/204 expected)
+[golden]   upload OK (HTTP 201)
+GOLDEN_VERSION=0.226.1
+GOLDEN_SHA256=70ed8e9377dec22a9b493e55f222b0e25a49d7f3caec8c506e0412fd6baefe69
+[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.226.1 / 70ed8e9377dec22a9b493e55f222b0e25a49d7f3caec8c506e0412fd6baefe69
+[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge)