The golden waiver (R-468) expired 2026-10-13 and the gate refused every push.
Operator: bake a golden, vouch, then push. Baked per RUNBOOK-manual-build §4.0-4.1
in the drill VM: build-golden.sh v3.2.0, controller 0.309.0 (MinAgent 0.131.0),
the approved Docker set, round trip sha-equal, token grep 0 with a working control,
VM back on virgin. Vouch saved by the operator in the hub UI (this session's save was
refused by Claude Code's permission check); read back: golden 0.309.0, agent 0.150.0,
min_agent 0.131.0. Floor untouched.
