R-302 docs: register rows, the two rules earned twice, STATUS

Closes R-296 (verified: shipped in v0.212.0) and R-301 (premise confirmed, fixed in v0.213.0). Files R-302 with WHY the obvious condition was rejected, and R-303 for the missing markOrphaned guard - the co-render is now harmless, not impossible. Bake evidence for golden 0.213.0.
2026-08-12 15:38:11 +02:00
parent e1b679782a
commit fbe1155fbb
5 changed files with 397 additions and 12 deletions
@@ -0,0 +1,35 @@
+# Golden bake 0.213.0 — 2026-08-12
+
+Per `RUNBOOK-manual-build.md` §4.0/§4.1. Drill VM reverted to `virgin` before and after; guest 9100
+destroyed `--purge`; `/root` residue empty.
+
+| | |
+|---|---|
+| `GOLDEN_VERSION` | **0.213.0** |
+| `GOLDEN_SHA256` | **77429bfc7e39ffc8d25c05b1819b8e0affdc58ccca3d7bd80da4ed9a9e7d1f3c** |
+| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.213.0` |
+| `MinAgent` (CHANGELOG header) | **0.127.0** |
+| published | 656 657 008 B, `upload OK (HTTP 201)` |
+
+## Acceptance markers (`grep -F`, quoted loop variable)
+
+`docker OK (overlay2` 1 · `including mount point rootfs` 1 · `including mount point mp0` 1 ·
+`upload OK (HTTP 201)` 1 · `FATAL` 0 · `excluding` 0
+
+## Fetchability — the SERVED bytes
+
+```
+downloaded: 656657008 bytes
+sha256:     77429bfc7e39ffc8d25c05b1819b8e0affdc58ccca3d7bd80da4ed9a9e7d1f3c
+```
+Identical to `GOLDEN_SHA256`. Image confirmed retrievable via `docker manifest inspect`.
+
+## Secret handling
+
+Token file→file, read inside the VM by a runner script, never on a command line.
+`systemctl show golden-bake` grep = **0**. Leak grep on the committed log = **0**, believable because a
+planted-token control grepped **1**. All artefacts `shred -u`'d.
+
+## NOT DONE
+
+The Day-0 vouch — the operator's. Three fields: golden 0.213.0, agent 0.128.0, min agent 0.127.0.