# Golden 0.284.2 — baked, published and vouched 2026-09-30 (late evening)

Baked because a new controller release (v0.284.2 — image retention, decision 53; the install hold, R-741) came out,
and the golden rule wants one before 4 October once a new version exists. RUNBOOK-manual-build.md §4.0/§4.1 verbatim.

| | |
|---|---|
| `GOLDEN_VERSION` | 0.284.2 (controller image `gitea.dooplex.hu/admin/felhom-controller:0.284.2`) |
| `GOLDEN_SHA256` | `f72810065b26d0e118e5ffeedc64f984222f0cc9aafc91ec885cd0513451ff67` |
| archive | 652 295 660 B; downloaded again from Gitea and hashed: identical (`02-round-trip.txt`) |
| template | `debian-13-standard_13.6-1_amd64.tar.zst` — after `pveam update`, `_amd64` filtered (`01-launch.txt`) |
| markers | `docker OK (overlay2` · `including mount point` rootfs + mp0 · `upload OK (HTTP 201)` · `excluding` 0 · `FATAL` 0 (`bake.log`) |
| token leak | **0** in the committed `bake.log` and in every file here; the planted control read **1** (`04-leak-check.txt`); 0 in the unit's properties |
| teardown | CT 9100 destroyed `--purge`; token, runner and log shredded inside the VM; qemu exited; `drill.qcow2` reverted to `virgin` |
| vouched | `Artifact manifest set: agent=0.138.0 golden=0.284.2 min_agent="0.131.0"` — three fields: agent 0.138.0 kept (≥ MinAgent), min_agent 0.131.0 from the controller CHANGELOG v0.284.2 header (`05-vouch.txt`) |

No agent release: the controller's MinAgent is unchanged (0.131.0) and the vouched agent 0.138.0 satisfies it.