# REPORT — installer golden gate + golden 0.211.0 bake (2026-08-10)

Commits `eb60087` (R-297 installer) and `999b0a3` (bake evidence). CI run **299** → `success`.
All eight `repo_gates.py` gates OK, including `golden-currency`, which this run took from RED to GREEN.
**`--no-verify` was not used at any point** — the currency gate refused an earlier push and that
refusal was respected until the bake made it true.

## R-297 — an install takes the golden you approved

`felhom-host-install.sh` v1.26.0. Step 7 short-circuited on ANY local archive: no version compare,
no digest, no warning, so the manifest's sha256 — which vouches from a different trust root than the
code host — was consulted only on the fetch path. Discovery is `sort | tail -1`: correct by recency,
never by verification.

`golden_local_matches_manifest()` compares digest first (a match means it IS the vouched artifact),
then the controller tag baked at `/etc/felhom-controller-image`. Auto-discovered mismatch → ignore
and fetch the vouched one; operator-named (`--golden`) mismatch → REFUSE, never silently substitute;
unreadable manifest → refuse rather than pass.

**Measured on real hardware:** three goldens sit on `demo-hp` carrying controller **0.153.0** and
**0.210.0**, and nothing compared either to the vouched version before use.

**NOT PUBLISHED.** The task asked that a fresh install be watched taking a stale local golden on
`drill-r50` BEFORE the fix. That was not done, so `installer-v1.26.0` is deliberately not cut and
`webpage.yaml` is untouched — pushing to `main` publishes nothing (R-110). Publishing an unobserved
change to the one artifact that runs as root on a virgin box is the failure this project keeps
writing rules about.

## Golden 0.211.0 — baked, published, round-trip verified

Full evidence: `documentation/tests/golden-0.211.0-2026-08-10/` (`bake.log` + `RESULT.md`).

- `GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849`
- Served bytes re-downloaded and hashed → identical. 656 141 689 B.
- All six acceptance markers counted (two initially returned a false `0` through broken shell
  quoting and were re-run with `grep -F` — a 0 from a broken instrument is not a measurement).
- Token never on a command line; leak grep on the committed log = 0, and that 0 was made believable
  by first proving the grep finds a planted token.
- Drill VM reverted to `virgin` before and after; build guest destroyed `--purge`; `/root` residue empty.

## Registers

R-295 (PARTIAL — hub half open), R-296, R-297, R-298 filed. Ceiling moved R-294 → **R-298**.

## NOT DONE

- **The Day-0 vouch** — the operator's, deliberately not made here.
- **Part 2** (uninstall leaves `dnsmasq` bound to :53) — dropped first, per the task's drop order.
- **Part 4a** (hub half of the code naming, and its emails) — dropped second, filed as R-295 PARTIAL.