Rule file: a release needs no golden; the floor carries it after the three test boxes; golden weekly (09 §3 decision 250, operator 2026-10-15)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

.claude/rules/unprompted-work.md

@@ -44,10 +44,12 @@ it **first** in the morning note. A decision you cannot write in that shape is o
    Throwaway apps only; the standing apps and `bentopdf` stay.
 5. **Evidence off the machine at the end of each phase**, before any revert (R-320).
 6. **One release per repo per session**, with a CHANGELOG entry (controller: with its `MinAgent`
-   line) and REPORT overwritten. **A controller release is RELEASED only when its golden is baked:
+   line) and REPORT overwritten. **A controller release needs no golden** (operator ruling 2026-10-15
-   bake → the operator vouches → the operator raises the floor** (operator ruling 2026-10-15, `09` §3
+   11:26, `09` §3 decision 250; decision 7 stands): push the image only when it is ready for EVERY box (the
-   decision 247, which supersedes decision 7). Never ask for a floor for a version with no golden; CC
+   household's update button offers the highest tag); raise the floor, MinAgent declared, only after it ran
-   never vouches and never moves a floor. **No `--no-verify`.**
+   on Tester 1, demo-hp and demo-felhom through the normal update path and the box walk's checks are green
+   on all three — not at night unless the night brief says so. **Agent releases still stop for the
+   operator's vouch.** The golden is baked weekly and vouched by the operator; CC never vouches. **No `--no-verify`.**
 7. **An enumerated gap becomes a row in the same session — or, if it is small, is fixed in it** (the size rule).
    Prose is not a record.
 8. **Hungarian text is searched with ASCII fragments**, with a positive and a negative control.

CHANGELOG.md

@@ -1,3 +1,9 @@
+## Unreleased (2026-10-15, afternoon) — the shared rule file; no code change
+
+- `.claude/rules/unprompted-work.md` §3 item 6: **a controller release needs no golden** — the floor carries it after the
+  three test boxes; agent releases still wait for the operator's vouch; the golden is weekly (operator ruling 2026-10-15
+  11:26, `09` §3 decision 250; the same morning's „bake first", decision 247, reversed). Same text in all five copies.
+
 ## v0.313.0 — media apps on every drive; drive events; a real restart; Plex without the race (R-1023, R-1024, R-1026, R-1027, R-1028, R-1031, R-1032, R-1037, R-1038, R-1044, R-1045, R-1047) (2026-10-15)
 
 **MinAgent: 0.155.0** (unchanged — the eject, guest-attach and disk calls already exist). **Hub:** v0.151.0 mails a returned

CONTEXT.md

@@ -9,12 +9,15 @@
 
 Last updated: 2026-10-15 (v0.313.0 — media apps on every drive, R-1023)
 
+> **2026-10-15 (afternoon) — release rule `09` §3 decision 250:** a release needs no golden; the floor carries it after
+> the three test boxes; the golden is weekly. Test images use `-rc.N` tags — the household button skips them, but the
+> floor never moves a box running one (`maybeAutoUpdate: not parseable — skip`, R-1053): write the release tag back.
+
 > **2026-10-15 — v0.313.0, the media build (R-1023 and the rows under it; `09` §3 decisions 245, 247, 248).** Media apps bind
 > every PRESENT drive through an owned `docker-compose.override.yml` (`media_library:` marker in the template); a real
 > restart (force-recreate + start times); the drive wiring (`internal/mediawire`, keys read at use — Plex's own token,
 > decision 248; Jellyfin's key named „felhom"); drive events with the notice, „restart now/later" and a stream check; safe
-> removal keeps the drive; Plex's code asked after the start (`after_start`). Released only with golden 0.313.0 (bake →
+> removal keeps the drive; Plex's code asked after the start (`after_start`). Floor 0.313.0 and golden 0.313.0 vouched by the operator 2026-10-15 11:29. Traps found on Tester 1 and fixed: qBittorrent 5 logs in with 204; the agent's disk
-> vouch → floor, decision 247). Traps found on Tester 1 and fixed: qBittorrent 5 logs in with 204; the agent's disk
 > `state` stays „attached" for a pulled registered disk (presence = backing device); the drive gate raced a safe removal.
 > A Plex status probe (`/library/sections`, 401) OPENED an unclaimed Plex while Plex started — removed within the hour;
 > never gate on a status a starting app also returns.