# Golden bake 0.242.0 — 2026-09-14

Baked, published, round-trip verified and **vouched**. The fleet floor was already 0.242.0 (raised by
the v0.242.0 release under hub v0.112.0's declared-MinAgent rule), so it did not move.
**This bake carries SIX releases: 0.237.0 … 0.242.0 were never baked.** It was baked because the
cadence rule says a golden comes **before any drill or fresh install** (R-468, `RUNBOOK-manual-build.md`
§4.2) — the drill it precedes is `audits/DRILL-fresh-install-0242-2026-09-14.md`.

| | |
|---|---|
| `GOLDEN_SHA256` | `3ab480ddb7c1e690492db1a56ac3052ffeccea8ccf59ed7b7927054aae8ee6d8` |
| size | **653 288 425 B** |
| baked controller | `gitea.dooplex.hu/admin/felhom-controller:0.242.0` |
| `MinAgent` | **0.129.0** — stated in v0.242.0's own header ("unchanged") |
| script | `build-golden.sh v3.0.0`, sha `7b0fb5cf…73b6a1`, **compared across the hop** (`02-template.txt`) |
| template | `debian-13-standard_13.6-1_amd64.tar.zst`, after `pveam update` |

## Acceptance markers — counted on the COMMITTED log (`04-markers.txt`)

```
docker OK (overlay2          : 1
including mount point rootfs : 1
including mount point mp0    : 1
upload OK (HTTP 201)         : 1
--- must be ZERO ---
excluding                    : 0
FATAL                        : 0
```

## Three independent readers agreed before anything was vouched

1. **The bake** printed `GOLDEN_SHA256=3ab480dd…e6d8`.
2. **The round trip** (`07-roundtrip.txt`) — `HTTP 200`, **653 288 425 B**, sha `3ab480dd…e6d8`, hashed
   from the **downloaded** bytes. The archive's `./etc/felhom-controller-image` reads
   `gitea.dooplex.hu/admin/felhom-controller:0.242.0`, with **19 382** entries under `var/lib/felhom/docker/`.
3. **The hub's Day-0 dropdown** (`08-hub-before-vouch.txt`): `0.242.0 sha=3ab480ddb7c1e690492db1a5`.

## Pre-gates, each proven able to see something first (`01-preconditions.txt`, `03-bake-launch.txt`)

| gate | result | control |
|---|---|---|
| 404 pre-gate | `HTTP 404` for 0.242.0 before the bake | the 0.236.0 package returns `HTTP 200` on the same URL shape |
| token-leak grep on the committed log | **0** | token appended to a throwaway copy greps **1**; copy `shred -u`'d |
| token off every command line | unit properties grep **0** | the same seeded control returns **1** |

## A slip, recorded (`02-template.txt`)

My first template pick (`pveam available | … | sort -V | tail -1`) selected the **arm64** image, which
sorts after amd64. Caught on read-back before the bake started; amd64 fetched by exact name, arm64
deleted. **The runbook's step 2 says "list the current one" — list and pick by the `_amd64` suffix.**

## The vouch — three fields, only one moved (`09-vouch.txt`, `11-vouch-verified.txt`)

| field | before | after |
|---|---|---|
| `golden_version` | 0.236.0 | **0.242.0** |
| `agent_version` | 0.130.0 | 0.130.0 |
| `min_agent` | 0.129.0 | 0.129.0 |

`POST /configuration/artifacts` → `303 flash=artifacts_set`; re-read: golden `0.242.0` selected with
sha `3ab480dd…`, R-120 refusal banner **absent**, floor `0.242.0`.

## Teardown (`05-teardown.txt`)

`pct destroy 9100 --purge`; token, runner, script and log `shred -u`'d **after** the log was copied
out (leftovers 0); `poweroff`; qemu confirmed exited with `ps -eo comm`; `qemu-img snapshot -a virgin`.