Vouch delivered fleet-wide; the MinAgent hold observed firing and releasing for the first time

Operator vouched golden 0.214.0 / agent 0.129.0 / min agent 0.129.0 and raised the
floor to 0.214.0. Both artifact shas in hub_settings match the bake and the release
byte-for-byte.

With the floor at 0.214.0 and demo-hp still on agent 0.128.0, the hub HELD the
controller floor - 'agent 0.128.0 < MinAgent 0.129.0 (controller floor withheld)' -
and released it 6 seconds after the agent was brought up. That is the R-216 guard
doing exactly what it exists for, seen firing for the first time, and it is the
argument for declaring MinAgent in the CHANGELOG header.

Both demo boxes verified on the boxes: controller 0.214.0, agent 0.129.0, healthy.

STATUS.md

@@ -8,8 +8,13 @@
 
 ## Waiting on you
 
-*(The golden-vouch and floor-raise asks that stood here are **done** — the hub reads golden **0.213.0**,
-floor **0.213.0**, agent **0.128.0**. Checked live, not assumed.)*
+*(Vouched and delivered 2026-08-12 night: golden **0.214.0**, agent **0.129.0**, min agent **0.129.0**,
+floor **0.214.0**. **Both demo machines are now on controller 0.214.0 + agent 0.129.0** — checked on the
+boxes, not assumed. The safety guard was watched doing its job on the way: `demo-hp` was **held** at
+0.213.0 while its agent was still 0.128.0 (*"agent 0.128.0 < MinAgent 0.129.0 — controller floor
+withheld"*), and took the update 6 seconds after the agent caught up. That guard exists because a box
+once landed on a controller newer than its agent and a customer was told a correct recovery code was
+wrong; this is the first time it has been seen firing.)*
 
 - **R-312 — one decision, and it is the interesting one.** The customer is now told the truth about an
   older code, but there is still no button: restoring from a set-aside copy means either threading an
@@ -24,8 +29,9 @@ floor **0.213.0**, agent **0.128.0**. Checked live, not assumed.)*
 
 ## What works
 
-Both demo machines are home, healthy and reporting on the approved pair. Off-site is credentialed on
-`demo-hp` and its repository still opens with the machine's own key. `drill-r50` is blocked, as intended.
+Both demo machines are home, healthy and reporting on the approved pair — **controller 0.214.0, agent
+0.129.0**, delivered by the floor rather than by hand. Off-site is credentialed on `demo-hp` and its
+repository still opens with the machine's own key. `drill-r50` is reverted to `virgin`, powered off.
 
 ## Shipped