09 §3 decisions 247-249 (operator 2026-10-15): bake first (supersedes decision 7); D1=A Plex own token at use; D2=A HSTS one day. Rule file, CLAUDE.md, manual-build + publish-train runbooks follow; R-1041/R-1046 closed (decided); R-1050 dated HSTS check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

.claude/rules/unprompted-work.md

@@ -44,8 +44,10 @@ it **first** in the morning note. A decision you cannot write in that shape is o
    Throwaway apps only; the standing apps and `bentopdf` stay.
 5. **Evidence off the machine at the end of each phase**, before any revert (R-320).
 6. **One release per repo per session**, with a CHANGELOG entry (controller: with its `MinAgent`
-   line), REPORT overwritten, floor raised to deliver it. **No golden unless a drill or fresh install
-   needs one** (the waiver, R-468). **No `--no-verify`.**
+   line) and REPORT overwritten. **A controller release is RELEASED only when its golden is baked:
+   bake → the operator vouches → the operator raises the floor** (operator ruling 2026-10-15, `09` §3
+   decision 247, which supersedes decision 7). Never ask for a floor for a version with no golden; CC
+   never vouches and never moves a floor. **No `--no-verify`.**
 7. **An enumerated gap becomes a row in the same session — or, if it is small, is fixed in it** (the size rule).
    Prose is not a record.
 8. **Hungarian text is searched with ASCII fragments**, with a positive and a negative control.