09 §3 decisions 247-249 (operator 2026-10-15): bake first (supersedes decision 7); D1=A Plex own token at use; D2=A HSTS one day. Rule file, CLAUDE.md, manual-build + publish-train runbooks follow; R-1041/R-1046 closed (decided); R-1050 dated HSTS check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CLAUDE.md

@@ -138,9 +138,10 @@ something, not only sessions that touch `documentation/` — which is why it is
 - **Root `STATUS.md`** — at the end of every session in which something shipped, broke or was
   decided. It is a **view** of `OPEN-ITEMS.md`; nothing may exist only there. One screen, written for
   the operator in plain language, and deliberately **not** `CONTEXT.md`.
-- **The golden, on its cadence** (operator ruling 2026-09-13): **weekly, and before ANY drill or
-  fresh install**, bake + vouch + raise the floor per `documentation/runbooks/RUNBOOK-manual-build.md`
-  §4.1. Not per release. Between bakes the dated waiver (§4.2, `documentation/tests/golden-waiver.yml`,
+- **The golden — bake first** (operator ruling 2026-10-15, `09` §3 decision 247, superseding the 2026-09-13
+  weekly cadence for releases): **a controller release is RELEASED only when its golden is baked** — bake → the
+  operator vouches → the operator raises the floor, per `documentation/runbooks/RUNBOOK-manual-build.md` §4.1. Never
+  ask for a floor for a version with no golden. Also before ANY drill or fresh install. Between bakes the dated waiver (§4.2, `documentation/tests/golden-waiver.yml`,
   ≤ 14 days) keeps `golden_currency_gate.py` advisory; **when it expires the gate is red and stays
   red until someone bakes or renews — that is the mechanism, so do not `--no-verify` past it.** A
   nightly or drill session that starts on a fresh install checks the golden FIRST.