docs: golden 0.161.0 published+vouched (R-71 gap CLOSED) + v1.25.0 ISO built; nested drill remains

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

REPORT.md

@@ -14,13 +14,20 @@ hub **v0.72.0→v0.73.0**. Commits: `b620435` (scripts code), hub `0.73.0` train
 | **2 — apt no-subscription** | ✅ code + **LIVE aligned on both boxes** (`apt-get update` clean) |
 | **3 — R-63 console font** | ✅ code (Lat2 font, verified font names) — nested-render proof pending the drill |
 | **4 — R-71 build-gate + rule** | ✅ code + red-proofed + **LIVE-demonstrated blocking the real gap**; standing rule 5 added |
-| **4 — golden republish** | ⏳ **REQUIRED NEXT** — see the critical finding below (blocks a valid v1.25.0 ISO) |
-| **5 — ISO rebuild + nested drill** | ⏳ gate-blocked until golden lifted; drill pending |
+| **4 — golden republish** | ✅ **built + published + vouched** — golden **0.161.0** (sha `77624408…`), floor stays 0.156.0; the LIVE gap is CLOSED |
+| **5 — ISO v1.25.0 build** | ✅ **built** (`…v1.25.0-nested-vm-generic-mkimage.iso`, sha `99b38420…`); gate passed live; rootpw+R-63 present |
+| **5 — nested drill** | ⏳ the last validation leg (R-63 console capture + fresh-install code-path proof) |
 | **6 — felhom-pve root vault** | ✅ rotated + vaulted + **verified authenticating over :22** |
 
-## CRITICAL FINDING — the R-71 gap is LIVE in production right now
+## CRITICAL FINDING — the R-71 gap was LIVE, now CLOSED
 
-The hub's current artifacts are **golden 0.153.0 < managed floor 0.156.0**. Every fresh install
+**RESOLVED 2026-07-23:** golden republished at controller **0.161.0** (built on felhom-pve via
+`build-golden.sh`, published to Gitea 618 MB, sha `77624408bd86ec21f3de25eb57f0d9c30d9c374f6e2c19bfcea0816ccb347188`,
+Gitea-served copy sha-verified), **operator-vouched** in the manifest (golden 0.153.0 → 0.161.0;
+floor unchanged at 0.156.0; agent 0.93.0). The gate now passes live and the v1.25.0 ISO built. The
+gap below is the finding as discovered; it no longer exists.
+
+The hub's current artifacts *were* **golden 0.153.0 < managed floor 0.156.0**. Every fresh install
 today boots a controller BELOW the floor, so the day-0 managed update fires within minutes —
 the exact update-vs-bridge race that burned demo-hp's offsite credential (DIAG-f10 / R-71). The
 new build-gate **correctly refuses** to build a v1.25.0 ISO in this state (demonstrated live:
@@ -72,16 +79,17 @@ shredded. felhom-pve now has G1 vault parity with demo-hp. (Note: the vault's `s
 original day-0 stamp — not bumped on rotation; cosmetic, the SECRET is the rotated one, proven by
 the auth test.)
 
-## Remaining (the two heaviest legs, now enforced-sequenced)
+## Remaining — the nested drill (last validation leg)
 
-1. **Golden republish** (Part 4): `build-golden.sh 9100 … gitea.dooplex.hu/admin/felhom-controller:0.161.0`
-   on a Proxmox host → publish to Gitea → **operator vouches** `artifact_golden_version=0.161.0` +
-   sha in the manifest UI (password-gated). This closes the LIVE golden<floor gap. Managed floor
-   stays 0.156.0.
-2. **ISO v1.25.0 rebuild + nested drill** (Part 5): once golden ≥ floor, build the pairing ISO
-   (gate now passes) and run the v1.24.0-style nested drill (belt present+active, apt=no-sub,
-   R-63 console capture, golden boots 0.161.0 with NO managed-update firing = the R-71 proof,
-   `.rootpw.txt` opens the console, build-gate red-proof in the nest).
+Golden republish + vouch + the v1.25.0 ISO build are DONE. The one remaining leg is the
+v1.24.0-style **nested drill** — the deep end-to-end proof of the fresh-install code path:
+belt installed+active by the default appliance leg, apt=no-subscription, **R-63 console capture**
+(the ő/ű closure evidence the spec asks for — ellenőrizze/telepítő rendered), golden boots 0.161.0
+with **NO managed-update firing** (structurally guaranteed now that golden 0.161 ≥ floor 0.156 —
+the drill confirms it live), `.rootpw.txt` opens the console (R-61 regression), and the build-gate
+red-proof in the nest. Heavy (~15–20 min: 1.7 GB ISO transfer + nested install + boot + verify on
+the remote N100); the belt + apt legs are already proven live on the two real boxes, so this drill
+adds the fresh-install-path + R-63-visual proofs specifically.
 
 ## Observed / not acted on
 

scripts/CHANGELOG.md

@@ -32,6 +32,8 @@ felhom-bootstrap R-63 font.
   added to `publish-train-rules.md`. Closes the day-0 update-vs-bridge race window at its source
   (DIAG-f10 / R-71). ISO_VERSION → 1.25.0.
 
+  **Golden lift EXECUTED (2026-07-23):** golden republished at controller 0.161.0 (`build-golden.sh` on felhom-pve), published to Gitea (618 MB, sha `77624408…`, served-copy verified), operator-vouched (golden 0.153.0→0.161.0; floor stays 0.156.0) — the LIVE golden<floor gap is CLOSED. **v1.25.0 ISO built** (`felhom-pve-9.2-1-v1.25.0-nested-vm-generic-mkimage.iso`, sha `99b38420…`) with the gate passing live; rootpw sibling + R-63 font present. Nested drill = the remaining validation leg.
+
 ## ISO train v1.24.0 — the box that can never call home learns to say so, heal itself, and let you in (R-59 + R-60 + R-61) (2026-07-22)
 
 All three findings are from the HP t740 install (2026-07-21). Proven end-to-end on a nested