CAMPAIGN 12 — the class sweep: golden 0.208.0 baked (awaiting vouch), R-256..R-263 filed, gating ranked

Part 1. Golden 0.208.0 baked on the drill VM, published and ROUND-TRIP VERIFIED — 656 150 362 B,
sha256 ba668f59..5ffb82, and ./etc/felhom-controller-image read OUT of the downloaded archive says
felhom-controller:0.208.0. Acceptance markers all green (overlay2 x1, mount points x2 rootfs+mp0,
upload HTTP 201 x1, excluding/FATAL/mp1 x0), Result=success. Token file->file, read inside the VM;
systemctl show grep = 0; committed-log grep = 0 WITH a control proving the grep works. Bake VM
destroyed, drill disk restored to virgin. NOT VOUCHED — the campaign halts there deliberately.

golden_currency_gate.py was correctly RED on arrival and is green after the bake. No --no-verify
was needed anywhere in this session.

Parts 2-4. Seven defect classes swept for siblings by class rather than by feature. Analysis only:
no product code, nothing deployed, no machine touched beyond the bake VM.

Eight new rows R-256..R-263 (ceiling moved from R-255), grouped by class in OPEN-ITEMS.md. C1
produced no new instance and has no row. The sharpest is R-260: the agent reports
operator_key_configured every heartbeat, the hub has no field for it, so the check that answers
"can the operator get into this box" returns ok for a box with no operator key installed.

Every class states whether its method re-found the known instances, because a method that cannot
re-find them has not been shown to work: C1 2/3 (verified by replaying the pre-fix templates),
C2 2/2, C3 2/3 + 1 as fixed, C4 fix-pattern re-found, C5 re-found, C6 deadcode 0/2 and bespoke 1/2,
C7 weakest and said so. Blind spots stated per class; seven suspicions investigated and DISPROVED,
including two of my own methods.

Part 4's ranking is in ROADMAP.md as G-1..G-8. Gate C5 (cross-repo tag reachability — cheap,
--fast-eligible, would have caught every R-260 instance on the introducing commit). Do NOT gate C6:
golang.org/x/tools/cmd/deadcode was measured against a PLANTED probe and is blind to unreachable
METHODS on widely-used types, which is exactly the shape both known instances have.

R-242's untouched half is recorded, not built: this bake demonstrated it, the currency gate flipping
green the moment the evidence DIRECTORY existed, before the round trip finished and with no vouch
near it.

Correction the campaign owed its own brief: escrow_stale was described as closed; it is R-247 and
READY. The live repo is the source.

Sampled rather than swept, exactly: C7 60 of 2652 production invariant comments and NONE of the 1440
test comments (that half is owed); C2 19 of 221 refusals; C3/C4 controller only. No finding was
reproduced live. STATUS.md is 100 lines against its 93-line one screen.

documentation/tests/golden-0.208.0-2026-08-08/README.md

@@ -0,0 +1,140 @@
+# Golden 0.208.0 — baked, published, round-trip verified, **NOT VOUCHED** (2026-08-08)
+
+**Closes the delivery gap opened by controller v0.208.0** (R-254 — the last two secrets leaving the
+page source, plus the gate against a fourth). Before this bake `golden_currency_gate.py` was correctly
+red and **a machine installed tonight would have received 0.207.0**. Evidence: `bake.log` (324 lines,
+beside this file).
+
+**⚠ THE VOUCH IS DELIBERATELY NOT DONE.** Campaign 12 §3 halts here and asks the operator for it. The
+hub still serves **0.207.0** to fresh installs until someone presses Save. See "The vouch, awaiting
+the operator" below.
+
+## Where it ran
+
+The **drill VM on DooPlex** (`/mnt/5_hdd/felhom.eu/drill/drill.qcow2`, internal snapshot `virgin`) —
+the accepted Tier-2 exception **for bakes**, per `runbooks/target-selection.md`. Launched with the
+canonical §4.0 line (`if=virtio` is load-bearing; the guest expects `/dev/vda`), cold-booted because
+the snapshot is disk-only (0 B `VM_SIZE`). **Restored to `virgin` afterwards**, snapshot list re-read.
+
+Liveness was checked with `ps -eo comm | grep -c qemu-system-x86`, never `pgrep -f`, which
+self-matches its own command line and reports a false "still running".
+
+## The inputs, listed rather than assumed
+
+| | |
+|---|---|
+| host | `drill-pve`, `pve-manager/9.2.2` (kernel 7.0.2-6-pve), 40 G free on `/` |
+| template | **`debian-13-standard_13.6-1_amd64.tar.zst`** — listed with `pveam available` on the day, because *the exact point release rots*; checksum verified on download |
+| build script | `felhom-agent/configs/build-golden.sh` **v3.0.0**, from a clean tree at `703db166e762` (`git status --porcelain` empty, `HEAD == origin/main`, both checked before the copy) |
+| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.208.0` — a **required** argument; `GOLDEN_VERSION` is derived from it. Registry manifest confirmed HTTP 200 before the bake started |
+
+## The token never crossed a shell
+
+Copied **file → file** (`scp ~/.gitea-token → /root/.gitea-token`, `0600`), and the bake launched
+through a runner script **inside** the VM that reads the file itself. The older `--setenv=` form put
+the value where `systemctl show` prints it.
+
+```
+systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"
+  → 0
+```
+
+## The 404 pre-gate, with a control so a 404 cannot mean "wrong URL"
+
+```
+felhom-golden/0.207.0/golden.tar.zst → 200   ← the control: the URL SHAPE is right
+felhom-golden/0.208.0/golden.tar.zst → 404   ← the pre-gate: nothing to overwrite
+```
+
+The filename is `golden.tar.zst`, **not** `felhom-golden-<VER>.tar.zst` — a wrong URL 404s for the
+wrong reason and passes even when the version already exists (R-233).
+
+## Acceptance markers — each grepped verbatim against this run's real log
+
+| marker | count | verbatim |
+|---|---|---|
+| storage driver | **1** | `  docker OK (overlay2; data-root /var/lib/docker)` |
+| mount points — rootfs **and mp0**, and **there is no mp1** | **2** | `INFO: including mount point rootfs ('/') in backup` · `INFO: including mount point mp0 ('/var/lib/felhom') in backup` |
+| upload | **1** | `[golden]   upload OK (HTTP 201)` |
+| `excluding` | **0** | — |
+| `FATAL` | **0** | — |
+| `mp1` | **0** | — (it stopped existing in `build-golden.sh` v3.0.0, R-165) |
+
+`Result=success`, `ExecMainStatus=0`. Archive 625 MB; volid
+`local:backup/vzdump-lxc-9100-2026_08_07-22_38_43.tar.zst` (rootfs 32 G + ONE data volume 24 G at
+`/var/lib/felhom`, all in the archive).
+
+## The publish, and the round trip — the published BYTES, not the local file
+
+```
+GOLDEN_VERSION=0.208.0
+GOLDEN_SHA256=ba668f59f063511dda122a5b05900f1350573cdc9619980872f87a58755ffb82
+```
+
+Downloaded back from `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.208.0/golden.tar.zst`:
+
+| | |
+|---|---|
+| size | **656 150 362 B** — identical to what the bake reported |
+| sha256 | **`ba668f59…5ffb82`** — hashed independently on DooPlex; identical |
+| **`./etc/felhom-controller-image` read OUT of the downloaded archive** | **`gitea.dooplex.hu/admin/felhom-controller:0.208.0`** |
+
+**That last line is the one that matters:** it is not a claim about what was built, it is the delivered
+artifact saying which controller it will start.
+
+**A fourth, independent confirmation:** the sha the hub's own dropdown offers for 0.208.0
+(`data-sha="ba668f59…"`, read from `/configuration`) matches the bake and the round trip. The package
+the hub would serve is the one baked here.
+
+## The vouch, awaiting the operator — a THREE-field change, all three checked
+
+`MinAgent` was **read from the golden's controller `CHANGELOG.md` header**, not assumed:
+`## v0.208.0 — … — MinAgent 0.127.0`.
+
+| field | now (live `hub_settings`) | after the vouch | why |
+|---|---|---|---|
+| `golden_version` | 0.207.0 | **0.208.0** | the new bake — **this is the only field that moves** |
+| `agent_version` | 0.127.0 | **0.127.0** (unchanged) | already **≥ MinAgent 0.127.0** — checked, not skipped |
+| `min_agent` | 0.127.0 | **0.127.0** (unchanged) | equals the controller's declared `MinAgent` |
+
+**`min_agent` is not above `agent_version`** — that is the R-216 shape, which hub v0.97.0 HOLDS rather
+than serving past. **In the event this is a one-field move, and it is recorded as three because
+checking all three is the point:** `golden_version` alone ships a controller onto an older agent than
+it declares it needs.
+
+**How:** hub → Configuration → Day-0 artifacts → Golden `0.208.0` → Save. The R-120 gate sits on that
+save and REFUSES a golden older than the newest controller the fleet reports; a refusal redirects to
+`?flash=golden_behind_fleet` and writes nothing.
+
+**Vouching is reversible** — re-select `0.207.0` and Save. The 0.207.0 package is **not** deleted by
+this bake (the publish step's pre-delete targets only its own version), so rolling back is a form
+submission, not a rebuild.
+
+## Teardown
+
+`pct destroy 9100 --purge` (`pct list` empty after) · token, runner script, build script and in-VM log
+`shred -u`'d, `/root` residue listing clean (`.bashrc .forward .profile .ssh` only) · `poweroff` ·
+qemu confirmed exited via `ps -eo comm | grep -c qemu-system-x86` → **0** ·
+**`qemu-img snapshot -a virgin` restored**, snapshot list re-read.
+
+**Token-leak grep on the log that is COMMITTED here — and a `0` is only evidence once the grep is
+shown to work:**
+
+```
+grep -c -F "<token>" bake.log                      → 0
+grep -c -F "<token>" <copy with the token appended> → 1   ← the control; copy then shredded
+```
+
+## What this does and does not change
+
+**Does:** the golden exists, is published, and is byte-verified. `golden_currency_gate.py` is **green**
+again.
+
+**Does NOT:** **a fresh Day-0 install still lands on controller 0.207.0.** The gate checks the BAKE,
+not the vouch — its own docstring says so, and this bake demonstrated the gap concretely:
+
+> **The gate flipped from red to green the moment this evidence DIRECTORY existed** — before the
+> round-trip download had finished, and with no vouch anywhere near it. Its positive signal is "a
+> directory named after the version is present in the repo". That is R-242's remaining half, measured
+> rather than argued: **nothing anywhere catches a skipped vouch.** Recorded, not built — see the
+> Campaign 12 report §8.

documentation/tests/golden-0.208.0-2026-08-08/bake.log

@@ -0,0 +1,324 @@
+[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.208.0
+[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) …
+  Logical volume "vm-9100-disk-0" created.
+  Logical volume pve/vm-9100-disk-0 changed.
+Creating filesystem with 8388608 4k blocks and 2097152 inodes
+Filesystem UUID: 264a5264-ce5b-4cbd-9df0-57815cd6afb7
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+	4096000, 7962624
+  Logical volume "vm-9100-disk-1" created.
+  Logical volume pve/vm-9100-disk-1 changed.
+Creating filesystem with 6291456 4k blocks and 1572864 inodes
+Filesystem UUID: 39af4c84-4e25-465c-b45f-1f893f74b7d0
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst'
+Total bytes read: 553512960 (528MiB, 168MiB/s)
+Detected container architecture: amd64
+Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
+done: SHA256:T1eshshAyQmblC2kzN0Orl8OUpUUcz436Okl9Ormfbk root@felhom-golden
+Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
+done: SHA256:N66mrs1433iZzugSQMgS5M/V14khU/dyjK8qCg+MB08 root@felhom-golden
+Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
+done: SHA256:tfiZgN0Pz+e/ZbICqw/WGJ3yGHVUf7F6DAx6Mbtku7c root@felhom-golden
+[golden] starting + installing Docker (official repo, trixie channel) …
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …
+[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds …
+[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) …
+Unable to find image 'hello-world:latest' locally
+latest: Pulling from library/hello-world
+4f55086f7dd0: Pulling fs layer
+4f55086f7dd0: Download complete
+4f55086f7dd0: Pull complete
+Digest: sha256:7f4da0fc94bcece205a8c0b6f4d11c8196924654ffe5c4d1aa439b7f632048b2
+Status: Downloaded newer image for hello-world:latest
+  docker OK (overlay2; data-root /var/lib/docker)
+  /var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4
+  /mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4
+  both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576
+[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.208.0 (no registry cred at deploy) …
+
+WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
+Configure a credential helper to remove this warning. See
+https://docs.docker.com/go/credential-store/
+
+0.208.0: Pulling from admin/felhom-controller
+039e6f9f9752: Pulling fs layer
+80fbb63a1167: Pulling fs layer
+9d6c7a1331cb: Pulling fs layer
+3f0ff4614786: Pulling fs layer
+97ccbd1fb75e: Pulling fs layer
+ff4c40ddcdf8: Pulling fs layer
+3f0ff4614786: Waiting
+97ccbd1fb75e: Waiting
+ff4c40ddcdf8: Waiting
+039e6f9f9752: Verifying Checksum
+039e6f9f9752: Download complete
+9d6c7a1331cb: Verifying Checksum
+9d6c7a1331cb: Download complete
+3f0ff4614786: Verifying Checksum
+3f0ff4614786: Download complete
+97ccbd1fb75e: Verifying Checksum
+97ccbd1fb75e: Download complete
+ff4c40ddcdf8: Verifying Checksum
+ff4c40ddcdf8: Download complete
+80fbb63a1167: Verifying Checksum
+80fbb63a1167: Download complete
+039e6f9f9752: Pull complete
+80fbb63a1167: Pull complete
+9d6c7a1331cb: Pull complete
+3f0ff4614786: Pull complete
+97ccbd1fb75e: Pull complete
+ff4c40ddcdf8: Pull complete
+Digest: sha256:398b8fdfed6f36cc3b5e0ef960b608c604d2be4378e60829cb1236419f9de9a7
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.208.0
+gitea.dooplex.hu/admin/felhom-controller:0.208.0
+[golden] asking the controller which infra images it manages …
+[golden] baking infra images (4): traefik:v3.6.7 cloudflare/cloudflared:2026.6.0 gtstef/filebrowser:1.3.3-stable gitea.dooplex.hu/admin/felhom-samba:1.1.0 …
+v3.6.7: Pulling from library/traefik
+589002ba0eae: Pulling fs layer
+ef63511ea6cc: Pulling fs layer
+0738e5cb835e: Pulling fs layer
+3e6813f70c64: Pulling fs layer
+3e6813f70c64: Waiting
+ef63511ea6cc: Download complete
+589002ba0eae: Verifying Checksum
+589002ba0eae: Download complete
+3e6813f70c64: Verifying Checksum
+3e6813f70c64: Download complete
+0738e5cb835e: Verifying Checksum
+0738e5cb835e: Download complete
+589002ba0eae: Pull complete
+ef63511ea6cc: Pull complete
+0738e5cb835e: Pull complete
+3e6813f70c64: Pull complete
+Digest: sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a
+Status: Downloaded newer image for traefik:v3.6.7
+docker.io/library/traefik:v3.6.7
+2026.6.0: Pulling from cloudflare/cloudflared
+47de5dd0b812: Pulling fs layer
+c172f21841df: Pulling fs layer
+99515e7b4d35: Pulling fs layer
+99ba982a9142: Pulling fs layer
+d6b1b89eccac: Pulling fs layer
+2780920e5dbf: Pulling fs layer
+7c12895b777b: Pulling fs layer
+3214acf345c0: Pulling fs layer
+52630fc75a18: Pulling fs layer
+dd64bf2dd177: Pulling fs layer
+b839dfae01f6: Pulling fs layer
+ebddc55facdc: Pulling fs layer
+bdfd7f7e5bf6: Pulling fs layer
+2d4d7adf6272: Pulling fs layer
+40008157d8d2: Pulling fs layer
+bd8962e29291: Pulling fs layer
+cac2ae0193cb: Pulling fs layer
+74d1dac84ecc: Pulling fs layer
+99ba982a9142: Waiting
+dd64bf2dd177: Waiting
+b839dfae01f6: Waiting
+ebddc55facdc: Waiting
+bdfd7f7e5bf6: Waiting
+2d4d7adf6272: Waiting
+40008157d8d2: Waiting
+bd8962e29291: Waiting
+cac2ae0193cb: Waiting
+74d1dac84ecc: Waiting
+d6b1b89eccac: Waiting
+2780920e5dbf: Waiting
+7c12895b777b: Waiting
+3214acf345c0: Waiting
+52630fc75a18: Waiting
+47de5dd0b812: Download complete
+c172f21841df: Verifying Checksum
+c172f21841df: Download complete
+99515e7b4d35: Verifying Checksum
+99515e7b4d35: Download complete
+47de5dd0b812: Pull complete
+99ba982a9142: Verifying Checksum
+99ba982a9142: Download complete
+d6b1b89eccac: Verifying Checksum
+d6b1b89eccac: Download complete
+2780920e5dbf: Verifying Checksum
+2780920e5dbf: Download complete
+7c12895b777b: Download complete
+3214acf345c0: Verifying Checksum
+3214acf345c0: Download complete
+52630fc75a18: Verifying Checksum
+52630fc75a18: Download complete
+dd64bf2dd177: Verifying Checksum
+dd64bf2dd177: Download complete
+b839dfae01f6: Verifying Checksum
+b839dfae01f6: Download complete
+ebddc55facdc: Verifying Checksum
+ebddc55facdc: Download complete
+bdfd7f7e5bf6: Verifying Checksum
+bdfd7f7e5bf6: Download complete
+2d4d7adf6272: Verifying Checksum
+2d4d7adf6272: Download complete
+c172f21841df: Pull complete
+bd8962e29291: Verifying Checksum
+bd8962e29291: Download complete
+40008157d8d2: Verifying Checksum
+40008157d8d2: Download complete
+cac2ae0193cb: Verifying Checksum
+74d1dac84ecc: Verifying Checksum
+74d1dac84ecc: Download complete
+99515e7b4d35: Pull complete
+99ba982a9142: Pull complete
+d6b1b89eccac: Pull complete
+2780920e5dbf: Pull complete
+7c12895b777b: Pull complete
+3214acf345c0: Pull complete
+52630fc75a18: Pull complete
+dd64bf2dd177: Pull complete
+b839dfae01f6: Pull complete
+ebddc55facdc: Pull complete
+bdfd7f7e5bf6: Pull complete
+2d4d7adf6272: Pull complete
+40008157d8d2: Pull complete
+bd8962e29291: Pull complete
+cac2ae0193cb: Pull complete
+74d1dac84ecc: Pull complete
+Digest: sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f
+Status: Downloaded newer image for cloudflare/cloudflared:2026.6.0
+docker.io/cloudflare/cloudflared:2026.6.0
+1.3.3-stable: Pulling from gtstef/filebrowser
+6a0ac1617861: Pulling fs layer
+ef8806083e82: Pulling fs layer
+b74107c861c7: Pulling fs layer
+adc935def003: Pulling fs layer
+4f4fb700ef54: Pulling fs layer
+18695ccc900a: Pulling fs layer
+45d119d5c397: Pulling fs layer
+dac52db4fc51: Pulling fs layer
+6d598f86b2f2: Pulling fs layer
+8aa349c8396c: Pulling fs layer
+adc935def003: Waiting
+8aa349c8396c: Waiting
+4f4fb700ef54: Waiting
+18695ccc900a: Waiting
+45d119d5c397: Waiting
+dac52db4fc51: Waiting
+6d598f86b2f2: Waiting
+6a0ac1617861: Verifying Checksum
+6a0ac1617861: Download complete
+adc935def003: Verifying Checksum
+adc935def003: Download complete
+4f4fb700ef54: Verifying Checksum
+4f4fb700ef54: Download complete
+b74107c861c7: Verifying Checksum
+b74107c861c7: Download complete
+ef8806083e82: Verifying Checksum
+ef8806083e82: Download complete
+45d119d5c397: Verifying Checksum
+45d119d5c397: Download complete
+6a0ac1617861: Pull complete
+dac52db4fc51: Verifying Checksum
+dac52db4fc51: Download complete
+6d598f86b2f2: Verifying Checksum
+6d598f86b2f2: Download complete
+18695ccc900a: Verifying Checksum
+18695ccc900a: Download complete
+8aa349c8396c: Verifying Checksum
+8aa349c8396c: Download complete
+ef8806083e82: Pull complete
+b74107c861c7: Pull complete
+adc935def003: Pull complete
+4f4fb700ef54: Pull complete
+18695ccc900a: Pull complete
+45d119d5c397: Pull complete
+dac52db4fc51: Pull complete
+6d598f86b2f2: Pull complete
+8aa349c8396c: Pull complete
+Digest: sha256:eb3733681db8757412632c61a99ad656f0d94ed6781bb2ea114b4d70babab78c
+Status: Downloaded newer image for gtstef/filebrowser:1.3.3-stable
+docker.io/gtstef/filebrowser:1.3.3-stable
+1.1.0: Pulling from admin/felhom-samba
+897d797d2723: Pulling fs layer
+3051591aa250: Pulling fs layer
+ce57a3f93416: Pulling fs layer
+fb94eeec2fe1: Pulling fs layer
+fb94eeec2fe1: Waiting
+ce57a3f93416: Verifying Checksum
+ce57a3f93416: Download complete
+fb94eeec2fe1: Verifying Checksum
+fb94eeec2fe1: Download complete
+897d797d2723: Verifying Checksum
+897d797d2723: Download complete
+897d797d2723: Pull complete
+3051591aa250: Verifying Checksum
+3051591aa250: Download complete
+3051591aa250: Pull complete
+ce57a3f93416: Pull complete
+fb94eeec2fe1: Pull complete
+Digest: sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.1.0
+gitea.dooplex.hu/admin/felhom-samba:1.1.0
+[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'.
+[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'.
+[golden] baking the first-boot SSH host-key regeneration unit (F3) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'.
+[golden] identity-clean + minimize …
+[golden] stop + archive …
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: archive file size: 625MB
+INFO: Finished Backup of VM 9100 (00:00:35)
+[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_08_07-22_38_43.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive)
+[golden] publishing golden (656150362 bytes, sha256 ba668f59f063511d…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.208.0/golden.tar.zst
+[golden]   pre-delete existing: HTTP 404 (404/204 expected)
+[golden]   upload OK (HTTP 201)
+GOLDEN_VERSION=0.208.0
+GOLDEN_SHA256=ba668f59f063511dda122a5b05900f1350573cdc9619980872f87a58755ffb82
+[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.208.0 / ba668f59f063511dda122a5b05900f1350573cdc9619980872f87a58755ffb82
+[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge)