# Golden 0.331.0 — bake + publish, 2026-10-18 (evening; the floor's version)

Why: the evening brief of 2026-10-18 (Part 7) asks for a golden at the floor that stands, as the LAST release step of the
night. The floor was raised to 0.331.0 (MinAgent 0.158.1) at 20:48:56 UTC and does not move again tonight. Procedure:
`documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex. The script came
from CC's `felhom-agent` clone at `origin/main` (`1693da4`; `build-golden.sh` sha256 `645b3b65…`, the same file as the
0.329.0 bake).

| | Previous (`../golden-0.329.0-2026-10-18/`) | This bake |
|---|---|---|
| `build-golden.sh` | v3.2.0 | same file |
| Controller | `felhom-controller:0.329.0` (MinAgent 0.158.1) | **`felhom-controller:0.331.0`** (MinAgent **0.158.1**) |
| Docker engine | the approved set (six pairs) | the same six pairs — the hub's newest approved Docker release `os-docker-20261004-142842` (read from the hub DB tonight) |
| Template | `debian-13-standard_13.6-1_amd64.tar.zst` | same (after `pveam update`; `_amd64` filtered) |

## Pass markers (from `bake.log`, this folder)

```
[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.331.0
[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-compose-plugin=5.6.0-1~debian.13~trixie
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.331.0
GOLDEN_SHA256=3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f
```

No `excluding`, no `FATAL`, no `GOLDEN_DOCKER_PKGS not set`; the unit `Result=success`. Round trip: the registry's file
downloaded and hashed = the bake's sha, 637,197,198 bytes (`02-round-trip.txt`). Token: the unit's properties grep = 0
(`00-boot.txt`); the committed log grep = 0, with a working control (= 1 on a copy with the token appended, the copy
shredded). Teardown: `03-teardown.txt` (CT 9100 purged, token/script/log shredded in the VM, VM off, disk back to
`virgin`). No controller push after the bake.

## Vouch — the operator's act (never CC's)

Three fields together (runbook §4.1 step 5), Configuration → Day-0 artifacts:

- golden **0.331.0**, sha256 `3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f`
- agent **0.159.2** (already vouched, unchanged), sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`
- min_agent **0.158.1** (0.331.0's MinAgent)

The R-120 gate accepts it: the golden equals the newest controller the fleet reports (0.331.0 on all three test boxes).