# Golden 0.349.0 — bake + publish, 2026-11-03 (on the operator's word, 07:10 CET)

Why: the Sunday 2026-11-01 weekly bake was missed; golden 0.344.0 was 8 days old and `golden_currency_gate.py` was red.
The operator said „Please bake the golden" on the morning of 2026-11-03. The floor read from the hub (its own page and its
DB with the WAL, integrity ok, newest report 7 minutes old): **0.349.0**, MinAgent 0.158.1. Controller 0.350.0 is committed
but not released, so the bake is at the floor. Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1
steps 1–4, in the drill VM on DooPlex.

| | Previous (`../golden-0.344.0-2026-10-26/`) | This bake |
|---|---|---|
| `build-golden.sh` | v3.2.0 | same file (`645b3b65…`; `felhom-agent` `ecbb0cc`) |
| Controller | `felhom-controller:0.344.0` (MinAgent 0.158.1) | **`felhom-controller:0.349.0`** (MinAgent **0.158.1**) |
| Docker engine | `os-docker-20261004-142842` | **`os-docker-20261026-190351`**, the hub's newest approved release, read from `os_releases`: docker-ce 29.9.2, containerd.io 2.4.2-3, buildx 0.38.1, compose 5.6.1 |
| Template | `debian-13-standard_13.6-1_amd64.tar.zst` | same (after `pveam update`; `_amd64` filtered) |
| Token | from `sec`, file → file | same; no copy stays on DooPlex (`sec run --file`) |

## Pass markers (from `bake.log`, this folder)

```
[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.349.0
[golden] Docker engine set PINNED to the approved release: containerd.io=2.4.2-3~debian.13~trixie … docker-compose-plugin=5.6.1-1~debian.13~trixie
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.349.0
GOLDEN_SHA256=9d97e7c5ec3e7b7b18efeddf2f030f335bf6ccfc27e67ad1605381f18707d0a6
```

No `excluding`, no `FATAL`, no `GOLDEN_DOCKER_PKGS not set`; the unit deactivated successfully. Round trip: the registry's
file downloaded and hashed = the bake's sha, 640,164,739 bytes (`02-round-trip.txt`). Token: the unit's properties grep = 0;
the committed log grep = 0, with a working control (= 1 on a copy with the token appended, the copy shredded). The bake's
one `WARNING` is docker's own line about the login in the build guest; the script removes the login before it archives, and a
listing of the archive for `.docker/config.json` reads 0. Teardown: `03-teardown.txt` (CT 9100 purged, token/user/script/log
shredded in the VM, VM off, disk back to `virgin`). No controller push after the bake.

## What this golden does not carry

Its infra images are the ones controller 0.349.0 pins, **Traefik v3.7.16 included** — the version with the high notice
GHSA-xv5x-242w-7hf7 (R-1354). A box installed from this golden takes v3.7.17 when controller 0.350.0 reaches it. The
next weekly bake carries it. **Not proven here:** no fresh install from this golden was run; the bake, the archive and the round trip
are what was checked.

## Vouch — never vouched

Replaced the same morning by `../golden-0.350.0-2026-11-03/` (Traefik v3.7.17). The operator: „Do not vouch 0.349.0."