diff --git a/.claude/rules/unprompted-work.md b/.claude/rules/unprompted-work.md
index 9a82377..bceccf4 100644
--- a/.claude/rules/unprompted-work.md
+++ b/.claude/rules/unprompted-work.md
@@ -44,8 +44,10 @@ it **first** in the morning note. A decision you cannot write in that shape is o
    Throwaway apps only; the standing apps and `bentopdf` stay.
 5. **Evidence off the machine at the end of each phase**, before any revert (R-320).
 6. **One release per repo per session**, with a CHANGELOG entry (controller: with its `MinAgent`
-   line), REPORT overwritten, floor raised to deliver it. **No golden unless a drill or fresh install
-   needs one** (the waiver, R-468). **No `--no-verify`.**
+   line) and REPORT overwritten. **A controller release is RELEASED only when its golden is baked:
+   bake → the operator vouches → the operator raises the floor** (operator ruling 2026-10-15, `09` §3
+   decision 247, which supersedes decision 7). Never ask for a floor for a version with no golden; CC
+   never vouches and never moves a floor. **No `--no-verify`.**
 7. **An enumerated gap becomes a row in the same session — or, if it is small, is fixed in it** (the size rule).
    Prose is not a record.
 8. **Hungarian text is searched with ASCII fragments**, with a positive and a negative control.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbd5cd0..bca28f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## Unreleased (2026-10-15) — the shared rule file; no code change
+
+- `.claude/rules/unprompted-work.md` §3 item 6: **bake first** — a controller release is released only when its golden is
+  baked; bake → the operator vouches → the operator raises the floor; never ask for a floor for a version with no golden
+  (operator ruling 2026-10-15, `09` §3 decision 247, superseding decision 7). Same text in all five copies.
+
 ## v0.156.1 — R-1008 by process liveness, not the clock; 0.156.0 superseded — do not vouch it (2026-10-14)
 
 Released by `scripts/release-agent.sh`: binary sha256 `83c7da27d457b63ba8a4cde5a8717b3e5f9db9f83a46e63f38902dc7471bffb9`, bundle