# Golden 0.301.0 — bake + publish, 2026-10-06 (evening; R-518 + R-638 + R-717 release)

Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex.

| | Previous (`../golden-0.300.0-2026-10-06/`) | This bake |
|---|---|---|
| `build-golden.sh` | v3.2.0 | same file, unchanged (agent repo `configs/`) |
| Controller | `felhom-controller:0.300.0` | **`felhom-controller:0.301.0`** (MinAgent 0.131.0, unchanged) |
| Docker engine | approved set (the six pairs of the 0.300.0 `PINNED` line) | same six pairs, `GOLDEN_DOCKER_PKGS` set in the runner from the start |
| Template | `debian-13-standard_13.6-1_amd64.tar.zst` | same (after `pveam update`) |

## Pass markers (from `bake.log`, this folder)

```
[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-ce=5:29.8.2-1~debian.13~trixie …
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.301.0
GOLDEN_SHA256=96e94fed70ca3066486acf66902d18994be076e0a877d1e0ca78f4aa06c355b9
```

No `excluding`, no `FATAL`, no `GOLDEN_DOCKER_PKGS not set`. Round trip: the registry's file hashed = the bake's sha
(`02-round-trip.txt`). Token: the unit's properties grep = 0; the committed log grep = 0, with a working control (= 1 on
a copy with the token appended, the copy shredded).

## Vouch and floors

Hub, 2026-10-06 14:04Z: agent 0.149.0, golden 0.301.0, min_agent 0.131.0 (bundle sha kept); floors 0.301.0 with
MinAgent 0.131.0 for demo-hp, demo-felhom, tester-1 only. Global floor not touched; Tester 2 not touched
(`../../audits/design-build-2026-10-06/delivery/vouch-golden-floors.txt`).

## Teardown

Build guest 9100 destroyed (`pct list` empty); token, runner and log shredded in the VM; VM off (no qemu process); disk
on `virgin` (`03-teardown.txt`).