v9.6.0 — the OCI media-type gate now covers the instance lane v9.4.0 added a permanent OCI creep-detector for bootc-dev/bootc#1703 at two image-promotion points: base-build-scratch's promote (each of base, base-zfs, base-zfs-nvidia, at the exact digest the boot smoke tested) and seal (the local artifact, before push). The plain instance lane was the one remaining promotion point with no assertion — promote moved :latest/:stable without checking the candidate's media types. instance's promote now asserts the candidate is OCI immediately after SRC_DIGEST resolves and before either skopeo copy, using base-build-scratch's condition verbatim: .config.mediaType must be the OCI config type (the load-bearing signal — composefs re-reads the config blob, so that is the field ABSENT (chunkah-rechunked images omit it) but never a present non-OCI type. .install_skopeo already provides skopeo and jq, so the job gains no new install step. This closes a gap rather than fixing a live defect: .buildah_job pins BUILDAH_FORMAT=oci and a job-level variables: deep-merges rather than replaces it, so instance builds already emit OCI. The gate is what keeps a future edit that drops or overrides that variable from promoting a v2s2 image to a tag a host performs a day-2 bootc upgrade from — the failure mode with no workaround, since bootc upgrade/switch has no --source-imgref escape. Verified before tagging: the condition was probed over a seven-case truth table (OCI, absent-top-level, v2s2, the three mixed forms, and empty inspect output) and run against the live registry — base-zfs-nvidia:stable is chunkah-rechunked and really does report an absent top-level .mediaType with an OCI config, so the absent-tolerance is load-bearing on a real artifact rather than hypothetical; base:stable reports both OCI. Both pass; every non-OCI config fails. Minor bump: a consumer whose candidate is somehow not OCI now fails promote instead of publishing. No input or interface change; consumers pick it up by moving the instance component pin.