felhom.eu/documentation/tests/golden-0.298.0-2026-10-06

Golden 0.298.0 — bake + publish, 2026-10-06 (release window 1 of the burn-down night)

Procedure: documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex.

	Previous (../golden-0.297.0-2026-10-05/)	This bake
build-golden.sh	sha256 645b3b659cba… (v3.2.0)	same file, unchanged
Controller	felhom-controller:0.297.0	felhom-controller:0.298.0 (MinAgent 0.131.0, unchanged)
Docker engine	the approved set os-docker-20261004-142842	same pinned set (PINNED line in bake.log; the hub's approved Docker release read on the System page 2026-10-06 00:41 = os-docker-20261004-142842)

Said plainly: the first bake was unpinned, and was replaced before any vouch

The first run (00:33) was started WITHOUT GOLDEN_DOCKER_PKGS — the runbook's runner script did not name it — so it installed the newest stable Docker set and printed GOLDEN_DOCKER_PKGS not set (log kept: bake-unpinned-not-vouched.log, sha b524a96f…). It was NEVER vouched. The second run (00:40) pinned the set and re-published 0.298.0 over it (the script pre-deletes its own version). The runbook now carries the step (§4.1 step 3).

Pass markers (from bake.log, this folder)

[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-ce=5:29.8.2-1~debian.13~trixie …
  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.298.0
GOLDEN_SHA256=a2e730e91148d390b6dc76221db9d19aa221ba3a27e2ccbc64df17793ea4470e

Round trip: the registry's file downloaded and hashed = the bake's sha (02-round-trip.txt). Token: systemctl show … | grep -c -F <token> = 0 for both units; token grep on both saved logs = 0, with a working control (the same grep on a copy with the token appended = 1).

Teardown

Build guest 9100 destroyed (pct list empty); token, runner script and logs shredded in the VM; VM powered off (no qemu process); disk reverted to virgin.