# Golden 0.329.0 — bake + publish, 2026-10-18 (night; the floor's version)

Why: the night brief of 2026-10-17 asks for a golden at the floor's version as the LAST release-affecting step, so the
operator can vouch it and agent 0.159.1 together in the morning. The floor was raised to 0.329.0 (MinAgent 0.158.1) at
21:36 UTC and does not move again tonight. Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1
steps 1–4, in the drill VM on DooPlex. The script came from CC's `felhom-agent` clone at `origin/main` (`6545ccc`).

| | Previous (`../golden-0.318.0-2026-10-16/`) | This bake |
|---|---|---|
| `build-golden.sh` | v3.2.0 | same version |
| Controller | `felhom-controller:0.318.0` (MinAgent 0.157.0) | **`felhom-controller:0.329.0`** (**MinAgent 0.158.1**) |
| Docker engine | approved set (six pairs) | the same six pairs — the hub's newest approved Docker release `os-docker-20261004-142842` |
| Template | `debian-13-standard_13.6-1_amd64.tar.zst` | same (after `pveam update`; `_amd64` filtered) |

## Pass markers (from `bake.log`, this folder)

```
[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.329.0
[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-compose-plugin=5.6.0-1~debian.13~trixie
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.329.0
GOLDEN_SHA256=58dc40df555676d87200e5cb24cdc65f39cbacb2417e15a1955013526de4f68c
```

No `excluding`, no `FATAL`, no `GOLDEN_DOCKER_PKGS not set`; the unit `Result=success`. Round trip: the registry's file
downloaded and hashed = the bake's sha, 637,840,967 bytes (`02-round-trip.txt`). Token: the unit's properties grep = 0
(`00-boot.txt`); the committed log grep = 0, with a working control (= 1 on a copy with the token appended, the copy
shredded). Teardown: `03-teardown.txt` (CT 9100 purged, token/script/log shredded in the VM, VM off, disk back to
`virgin`). The agent's registry hashes: `04-agent-sha.txt`.

## Vouch — the operator's act (never CC's)

Three fields together (runbook §4.1 step 5), Configuration → Day-0 artifacts:

- golden **0.329.0**, sha256 `58dc40df555676d87200e5cb24cdc65f39cbacb2417e15a1955013526de4f68c`
- agent **0.159.1**, sha256 `de8f6ad96860ec399757a88d8bbb0191c089c9bb99db8212482c12daab41aff9` (read from the registry
  tonight = the brief's), bundle `2af3d27d686fe611f3f44e89ba3d5123a5572f51eaf87e0ac63df00a41e67cd6`
- min_agent **0.158.1** (0.329.0's MinAgent)

The R-120 gate accepts it: the golden equals the newest controller the fleet reports (0.329.0 on all three test boxes).