docs: golden 0.98.3 live — D.1b retired, drill B1/B5 fixed, backlog note resolved + evidence doc

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Felhom scripts — Changelog
 
+## docs — golden 0.98.3 live: D.1b RETIRED, drill ledger B1/B5 → FIXED, backlog note resolved (2026-07-03)
+
+Companion to felhom-agent's `build-golden.sh` v2.0.0 (@ `ceca355`): the golden now bakes the CURRENT
+controller (0.98.3, mandatory-tag convention — B5) and a `felhom-controller-bootstrap.path` unit
+(controller deploys on the bootstrap-mount hot-plug, no reboot — B1). Clean-room validated end-to-end
+BEFORE publish (bake → isolated hot-plug proof → local-golden Day-0 install → publish → vouch →
+`--force-gitea-golden` install); evidence: `documentation/audits/DRILL-golden-098-2026-07-03.md`.
+
+- `documentation/runbooks/day0-install.md`: **D.1b reduced to a one-line version check** (fresh boxes
+  land current + self-manage); old manual-update procedure moved to Part F troubleshooting keyed on
+  "golden older than 0.86.0 was vouched"; header validated-versions line → script v1.9.1 / agent
+  v0.63.0 / golden v0.98.3; A.3 records the drilled-known-good pair + "vouch ≥ 0.98.3"; A.4 floor
+  text rewritten (fresh boxes now floor-honoring; recommend raising the global floor after a golden
+  rebuild — operator, 1 min).
+- `documentation/audits/DRILL-day0-cleanroom-2026-07-03.md` ledger: **B1, B5 → FIXED** (pointers);
+  R6 note: the installer's post-provision reboot is retained as a belt, removal recorded as a
+  candidate cleanup (not done).
+- `documentation/backlog/FOLLOWUP-golden-default-controller-tag.md` + `backlog/README.md`:
+  **RESOLVED** per the M18/M19 convention (file kept + annotated; README entry marked FIXED).
+- New evidence doc: `documentation/audits/DRILL-golden-098-2026-07-03.md` (A–D transcripts, unit
+  states, resolution-order + fetch/sha proofs, cleanup, observations — incl. the SECURITY
+  observation that the customer `git.token` has package-WRITE rights → scope-down + rotate
+  follow-up).
+
 ## docs — day0-install D.1b narrowed + drill ledger B2/B3 → FIXED agent v0.63.0 (2026-07-03)
 
 Agent v0.63.0 fixed both drill findings (B3 token reload-on-miss + B2 guesthook snippets-dir