correct the vouch state: the operator vouched 0.208.0 DURING this session

Recorded on arrival as 0.207.0, re-read from live hub_settings at the end and it is 0.208.0 — the
operator acted while the session ran. The ask is therefore 0.208.0 -> 0.209.0, not 0.207.0 ->
0.209.0, and STATUS.md plus the golden evidence now say so.

Caught only because the state was re-read rather than carried forward from the arrival note. A fact
recorded at the start of a long session is a fact about the start of the session.

STATUS.md

@@ -69,11 +69,10 @@ per-guest network health, which we already lost 1 h 15 m to once.
 
 ## Waiting on you
 
-- **One approval, and now it is the only one: the new base image.** Baked, published, byte-checked —
-  and **installations receive an older version until you press Save.** Hub → Configuration → Day-0
+- **One approval: move the base image on by one.** You vouched **0.208.0** during the night —
+  thank you, that gap is closed. Today's release went one further, so: Hub → Configuration → Day-0
   artifacts → Golden **0.209.0** → Save. One field moves, the other two were checked and are right,
-  and it is reversible. It supersedes last night's unvouched 0.208.0, so this is one decision, not
-  two. *(R-242)*
+  and it is reversible. *(R-242)*
 - **Fourth time in three days, so worth a minute.** A check now catches the *baking* being forgotten
   — it caught it again today and refused the push until it was done. **Nothing catches the approval
   being forgotten.** Two ways to close that are written up, neither built. *(ROADMAP G-8)*

documentation/tests/golden-0.209.0-2026-08-08/README.md

@@ -6,9 +6,10 @@ no golden carried the newest release. The honest answer to that gate is the bake
 `--no-verify`; the gate's own docstring says the cost of a trip is "one bake, which is the operation
 the project wants to be routine anyway".
 
-**This also consolidates the operator's approval into ONE.** Golden **0.208.0** was baked last night
-and never vouched. It is superseded rather than wasted: 0.209.0 contains everything 0.208.0 did, plus
-R-247. **Vouch 0.209.0 and 0.208.0 needs no separate decision.**
+**⚠ UPDATED at the end of the session, because the fact changed under it.** On arrival the vouched
+golden was **0.207.0**; while this session ran, **the operator vouched 0.208.0**. Re-read from live
+`hub_settings` rather than assumed — which is why the table below reads 0.208.0 → 0.209.0 and not
+0.207.0 → 0.209.0.
 
 ## Where it ran
 
@@ -76,7 +77,7 @@ The delivered artifact saying which controller it will start — not a claim abo
 
 | field | now (live `hub_settings`) | after | why |
 |---|---|---|---|
-| `golden_version` | 0.207.0 | **0.209.0** | the only field that moves |
+| `golden_version` | **0.208.0** (vouched during this session) | **0.209.0** | the only field that moves |
 | `agent_version` | 0.127.0 | 0.127.0 | already ≥ `MinAgent 0.127.0` — checked |
 | `min_agent` | 0.127.0 | 0.127.0 | equals the declared `MinAgent`; **not above `agent_version`** (the R-216 shape hub v0.97.0 holds) |
 
@@ -101,6 +102,6 @@ grep -c -F "<token>" <copy with the token appended> → 1   ← the control; cop
 
 **Does:** `golden_currency_gate.py` is green; the push it was blocking can proceed.
 
-**Does NOT:** a fresh Day-0 install still lands on **0.207.0**. The gate checks the BAKE, not the
+**Does NOT:** a fresh Day-0 install still lands on **0.208.0**. The gate checks the BAKE, not the
 vouch — R-242's untouched half, demonstrated again here: the gate flips green on the presence of this
 directory, with no vouch anywhere near it.