Both rulings built: same-tag re-tests (decision 52), image retention + the install hold (controller 0.284.2); golden 0.284.2

- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202
  through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today.
- Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored — two wiring faults found live on 9202);
  floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger.
- Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK.
- Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446.
- register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red.

Evidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/.
Report: REPORT-night-rulings-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -587,6 +587,12 @@ R-636's louder repeated alarm.
     reached no box at all (R-740: the catalog never recorded a same-tag re-test, and the leg skips a digest-only
     change); measured that the box's leg presses such an entry with no controller change. Decision 30's cost line
     ("or the automatic leg") is corrected by the dated note there; decision 30's ruling is unchanged.
+    **Outcome (2026-09-30 late):** catalog `6a3ead9` — the re-test entry (`from` == `to`, `digest_from`, `box_evidence`),
+    its gates and decoys, `upgrade-test.py --retest`, and the ONE command `scripts/retest-floating.py`. Proven end to end
+    on 9202: docmost at an older `redis:7-alpine` digest → the re-test → "run tonight's chain now" → the leg pressed the
+    step, the new digest ran, the data read back, the badge went back to current. The box needed no change. No
+    database/redis line differs today; two exact tags do (R-743). The monthly run is a runbook, not a cron job
+    (`runbooks/monthly-floating-retest.md`).
 53. **A box keeps, per app service, the image it runs now and the image before it (the undo's); it deletes older images
     of that app by itself** — *operator ruling 2026-09-30 evening (R-736, option A).* It never deletes an image that any
     container (running or stopped) or any installed app's compose still names. Removing an app deletes that app's
@@ -595,6 +601,9 @@ R-636's louder repeated alarm.
     that filled the Docker disk until the box refused an install (R-736). **Cost, stated:** a restore to a version
     older than the previous one re-pulls it — as every restore already does (R-698: a backup stores the image's name,
     not the image).
+    **Outcome (2026-09-30 late):** controller v0.284.2 (floor 0.284.2; 0.284.0 and 0.284.1 never floored — two wiring
+    faults found live on 9202). The one-time sweep: 9202 26.6 → 5.7 GB, demo-hp 24.3 → 13.5 GB, the N100 6.15 → 6.07 GB,
+    every app healthy. Old CONTROLLER images are outside this decision and stay (R-745).
 
 ### 2026-09-30 (day) — operator notes, recorded before the work