# Golden bake — 0.221.1 (2026-08-23)

Baked in the drill VM on DooPlex per `documentation/runbooks/RUNBOOK-manual-build.md` §4.0/§4.1,
carrying controller **v0.221.1** (R-361 — the safety dump no longer destroys the app's own database
backup, plus the follow-on that keeps the undo-copy cap reachable).

| | |
|---|---|
| `GOLDEN_VERSION` | **0.221.1** |
| `GOLDEN_SHA256` | **1c8bf6cf08cadabeca6331f38360d905e867c235067cd10c2716915b6e6df089** |
| package | `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.221.1/golden.tar.zst` |
| size | 656 966 079 B |
| controller image | `gitea.dooplex.hu/admin/felhom-controller:0.221.1` |
| template | `debian-13-standard_13.6-1_amd64.tar.zst` (**listed fresh**, checksum verified on download) |
| `build-golden.sh` | v3.0.0, from `felhom-agent` @ `40d857b52711` |
| `MinAgent` | **0.129.0** (from the controller CHANGELOG header — unchanged) |

## Why this bake happened in this session

The `golden-currency` gate refused the docs push: 0.221.1 was released with no golden carrying it.
**That block is not circular** — a golden needs the controller image, which was already built and
pushed, not the docs commit — so the gate was satisfied by doing the work it asked for rather than
bypassed. **No push in this session used `--no-verify`.**

## Pass markers — each checked, with the negative controls

```
docker OK (overlay2      : 1     ->  "  docker OK (overlay2; data-root /var/lib/docker)"
including mount point    : 2     ->  rootfs ('/') and mp0 ('/var/lib/felhom')  [there is no mp1]
upload OK (HTTP 201)     : 1     ->  pre-delete returned HTTP 404 (404/204 expected)
excluding                : 0     <- negative control
FATAL                    : 0     <- negative control
```

**The 404 pre-gate was controlled before it was believed:** the same URL shape for **0.220.2 returned
HTTP 200** in the same minute, so the 404 on 0.221.1 means absent, not a wrong URL.

## Verified by ROUND TRIP

Downloaded again — **HTTP 200, 656 966 079 bytes** — and the sha256 recomputed: `1c8bf6cf08ca…` on
both sides. What a machine receives is byte-identical to what was baked.

## Token hygiene

Copied **file → file**, read by a runner script inside the VM.
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"` → **0**,
and that grep was **proved able to convict first** (planted copy → **1**, copy shredded). The same
control was run on the **committed** `bake.log`: **0**, positive control **1**.

## Teardown

`pct destroy 9100 --purge`; token, runner, build script and in-VM log `shred -u`'d **after**
`bake.log` was copied out — all four confirmed absent; `poweroff`; waited for qemu to exit;
`qemu-img snapshot -a virgin`.

## NOT vouched

The hub's Day-0 artifact manifest was **not** changed and the floor was **not** raised. Both are the
operator's, and it is a **three-field** save:

| field | value |
|---|---|
| `golden_version` | **0.221.1** |
| `agent_version` | **0.130.0** |
| `min_agent` | **0.129.0** |