Rule file: a release needs no golden; the floor carries it after the three test boxes; golden weekly (09 §3 decision 250, operator 2026-10-15)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

.claude/rules/unprompted-work.md

@@ -44,8 +44,12 @@ it **first** in the morning note. A decision you cannot write in that shape is o
    Throwaway apps only; the standing apps and `bentopdf` stay.
 5. **Evidence off the machine at the end of each phase**, before any revert (R-320).
 6. **One release per repo per session**, with a CHANGELOG entry (controller: with its `MinAgent`
-   line), REPORT overwritten, floor raised to deliver it. **No golden unless a drill or fresh install
+   line) and REPORT overwritten. **A controller release needs no golden** (operator ruling 2026-10-15
-   needs one** (the waiver, R-468). **No `--no-verify`.**
+   11:26, `09` §3 decision 250; decision 7 stands): push the image only when it is ready for EVERY box (the
+   household's update button offers the highest tag); raise the floor, MinAgent declared, only after it ran
+   on Tester 1, demo-hp and demo-felhom through the normal update path and the box walk's checks are green
+   on all three — not at night unless the night brief says so. **Agent releases still stop for the
+   operator's vouch.** The golden is baked weekly and vouched by the operator; CC never vouches. **No `--no-verify`.**
 7. **An enumerated gap becomes a row in the same session — or, if it is small, is fixed in it** (the size rule).
    Prose is not a record.
 8. **Hungarian text is searched with ASCII fragments**, with a positive and a negative control.

CHANGELOG.md

@@ -1,3 +1,38 @@
+## Unreleased (2026-10-15, afternoon) — the shared rule file; no code change
+
+- `.claude/rules/unprompted-work.md` §3 item 6: **a controller release needs no golden** — the floor carries it after the
+  three test boxes; agent releases still wait for the operator's vouch; the golden is weekly (operator ruling 2026-10-15
+  11:26, `09` §3 decision 250; the same morning's „bake first", decision 247, reversed). Same text in all five copies.
+
+## Unreleased (2026-10-15) — the shared rule file; no code change
+
+- `.claude/rules/unprompted-work.md` §3 item 6: **bake first** — a controller release is released only when its golden is
+  baked; bake → the operator vouches → the operator raises the floor; never ask for a floor for a version with no golden
+  (operator ruling 2026-10-15, `09` §3 decision 247, superseding decision 7). Same text in all five copies.
+
+## v0.156.1 — R-1008 by process liveness, not the clock; 0.156.0 superseded — do not vouch it (2026-10-14)
+
+Released by `scripts/release-agent.sh`: binary sha256 `83c7da27d457b63ba8a4cde5a8717b3e5f9db9f83a46e63f38902dc7471bffb9`, bundle
+`5a678def792c70ec1cbbd198c14542161fac91d11a69bd0ce23dd86469e96ec3` (tag `v0.156.1` = `7ae3081`). Step bundle `0.156.1-step1`
+sha256 `ac83ea41507616d4c1056cccfd35de1410ff01e0296f4e64ff925207a43a8490` (the 0.155.0 bundle with only `felhom-os-apply`
+replaced), published as package version `0.156.1-step1`. **Not vouched** (the operator's act). Delivery as 0.156.0: per box
+`agent_update 0.156.1` → `agent_config_update 0.156.1-step1` → `agent_config_update 0.156.1`.
+
+- **0.156.0 is superseded — never vouch it.** A background security review of the pushed commit flagged „fail-open state
+  drift": 0.156.0 called a listed vzdump task dead when its wall-clock start was before the kernel's `btime`. `btime` is
+  derived from the wall clock and moves when the clock is corrected after the boot (an NTP step after a power cut), so a
+  backup started between the boot and the correction could look „from before the boot" — and the stale-lock pass would
+  clear a LIVE backup's lock.
+- **Now:** `taskAlive` is Proxmox's own rule (`PVE::ProcFSTools::check_process_running`, read on demo-hp): the UPID's pid and
+  pstart against `/proc/<pid>/stat` — same start tick (field 22) and not a zombie. No clock is involved. Fails safe (running)
+  when the UPID does not parse, the stat cannot be read, or this agent cannot see root's processes at all (PID 1 not visible:
+  a `hidepid` /proc or `ProtectProc=` would hide every worker — demo-hp: `/proc` plain, `ProtectProc=default`).
+- Tests: worker gone, pid reused, zombie, live worker, a „clock step" (wall-clock start absurdly early, worker alive → still
+  running), doubt, hidden /proc — each red-proofed; 19 guards in all (`power-cut-fixes-2026-10-14/redproof.txt`).
+- R-1006 (the cleanup) is unchanged; its „before this boot" rule still reads `btime`, but a drifted `btime` cannot remove a
+  live partial: the Go side asks this liveness rule, and the root helper refuses while any vzdump runs or anything holds
+  the file open.
+
 ## v0.156.0 — after a power cut: the dead half-written backup is removed (R-1006); a backup task from before the boot is not „in flight" (R-1008) (2026-10-14)
 
 Released by `scripts/release-agent.sh`: binary sha256 `8db2278838dcb733d5201fba84b75a829b9adebdf899c89dd7de0939ec10d51a`, bundle