R-274: the BYO disclosure names the golden it reuses; the local-golden check is pinned

The check itself shipped with R-297 (golden_local_matches_manifest: sha256 or controller version
against the hub manifest; mismatch re-fetches, a named --golden is refused). This adds the
disclosure line the row also asked for and tests that pin the check's place before the adopt.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/felhom-host-install.sh

@@ -1881,6 +1881,9 @@ EOF
     else
         echo "    guest:  the provisioned Felhom LXC (vmid ${VMID}, capped ${CPU_CORES} cores / ${MEM_MIB} MiB) + its volumes"
         echo "            + the golden vzdump imported onto storage '${ARCHIVE_STORAGE}'"
+        # R-274: the disclosure names what the install REUSES, not only what it creates.
+        echo "    reuse:  a golden already on '${ARCHIVE_STORAGE}' is used only if its sha256 or its controller version"
+        echo "            matches the hub's vouched golden; otherwise the vouched one is fetched (a --golden you name is refused)"
     fi
     echo "    update: operator-signed self-update authority: ${RESOLVED_OP_ID:-NONE (self-update stays dormant)}"
     echo "    NOT touched in byo mode: root@pam (no break-glass), host DNS (:53), OOB sshd."

scripts/test_hostinstall.py

@@ -11,7 +11,7 @@ functions act on are variables the test points into the temp directory. Nothing
 Where behaviour cannot be isolated, a STATIC test checks the wiring (the function is CALLED, from the
 right place) — a helper defined and never called is the seam-built-never-wired shape.
 
-Rows: R-275, R-276, R-881 (uninstall residue); R-306 (--preflight-only writes no state); R-130 (lvm minimum wording); R-180 (archive storage outside the ACL set); R-179 (NAS units); R-310 (golden refusal wording, the uninstall's terminal).
+Rows: R-275, R-276, R-881 (uninstall residue); R-306 (--preflight-only writes no state); R-130 (lvm minimum wording); R-180 (archive storage outside the ACL set); R-179 (NAS units); R-310 (golden refusal wording, the uninstall's terminal); R-274 (local golden reuse).
 Run: python3 scripts/test_hostinstall.py
 """
 import os
@@ -588,6 +588,21 @@ def test_require_tty_guards_the_uninstall_prompt():
     assert g > 0 and g < r, "the vmid confirmation is not guarded by _require_tty"
 
 
+# ── R-274: a local golden is checked against the manifest, and the disclosure says it is reused ──
+def test_local_golden_is_checked_before_use():
+    body = func("step_golden")
+    chk = body.find('golden_local_matches_manifest "$GOLDEN_VOLID"')
+    use = body.find('log_skip "  using local golden')
+    assert 0 < chk < use, "step_golden adopts a local golden without checking it against the manifest"
+    g = func("golden_local_matches_manifest")
+    assert "ART_GOLDEN_SHA" in g and "ART_GOLDEN_VER" in g, "the check no longer compares sha256 and version"
+
+
+def test_byo_disclosure_names_the_golden_reuse():
+    body = func("_byo_disclosure_ack")
+    assert re.search(r"reuse:.*golden.*vouched", body, re.S), "the BYO disclosure does not say a local golden is reused (R-274)"
+
+
 def main():
     tests = [(n, f) for n, f in sorted(globals().items()) if n.startswith("test_") and callable(f)]
     fails = 0