felhom.eu/documentation/tests/golden-0.349.0-2026-11-03

Golden 0.349.0 — bake + publish, 2026-11-03 (on the operator's word, 07:10 CET)

Why: the Sunday 2026-11-01 weekly bake was missed; golden 0.344.0 was 8 days old and golden_currency_gate.py was red. The operator said „Please bake the golden" on the morning of 2026-11-03. The floor read from the hub (its own page and its DB with the WAL, integrity ok, newest report 7 minutes old): 0.349.0, MinAgent 0.158.1. Controller 0.350.0 is committed but not released, so the bake is at the floor. Procedure: documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex.

	Previous (../golden-0.344.0-2026-10-26/)	This bake
build-golden.sh	v3.2.0	same file (645b3b65…; felhom-agent ecbb0cc)
Controller	felhom-controller:0.344.0 (MinAgent 0.158.1)	felhom-controller:0.349.0 (MinAgent 0.158.1)
Docker engine	os-docker-20261004-142842	os-docker-20261026-190351, the hub's newest approved release, read from os_releases: docker-ce 29.9.2, containerd.io 2.4.2-3, buildx 0.38.1, compose 5.6.1
Template	debian-13-standard_13.6-1_amd64.tar.zst	same (after pveam update; _amd64 filtered)
Token	from sec, file → file	same; no copy stays on DooPlex (sec run --file)

Pass markers (from bake.log, this folder)

[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.349.0
[golden] Docker engine set PINNED to the approved release: containerd.io=2.4.2-3~debian.13~trixie … docker-compose-plugin=5.6.1-1~debian.13~trixie
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.349.0
GOLDEN_SHA256=9d97e7c5ec3e7b7b18efeddf2f030f335bf6ccfc27e67ad1605381f18707d0a6

No excluding, no FATAL, no GOLDEN_DOCKER_PKGS not set; the unit deactivated successfully. Round trip: the registry's file downloaded and hashed = the bake's sha, 640,164,739 bytes (02-round-trip.txt). Token: the unit's properties grep = 0; the committed log grep = 0, with a working control (= 1 on a copy with the token appended, the copy shredded). The bake's one WARNING is docker's own line about the login in the build guest; the script removes the login before it archives, and a listing of the archive for .docker/config.json reads 0. Teardown: 03-teardown.txt (CT 9100 purged, token/user/script/log shredded in the VM, VM off, disk back to virgin). No controller push after the bake.

What this golden does not carry

Its infra images are the ones controller 0.349.0 pins, Traefik v3.7.16 included — the version with the high notice GHSA-xv5x-242w-7hf7 (R-1354). A box installed from this golden takes v3.7.17 when controller 0.350.0 reaches it. The next weekly bake carries it. Not proven here: no fresh install from this golden was run; the bake, the archive and the round trip are what was checked.

Vouch — never vouched

Replaced the same morning by ../golden-0.350.0-2026-11-03/ (Traefik v3.7.17). The operator: „Do not vouch 0.349.0."