09 §3 decisions 247-249 (operator 2026-10-15): bake first (supersedes decision 7); D1=A Plex own token at use; D2=A HSTS one day. Rule file, CLAUDE.md, manual-build + publish-train runbooks follow; R-1041/R-1046 closed (decided); R-1050 dated HSTS check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -168,8 +168,8 @@ These are rulings, not proposals. Anything specced against a different assumptio
 
 ### 2026-09-13 (afternoon) — the floor carries a release without a golden, and every backup counts
 
-7. **A floor carries a release past the vouched golden when the release's MinAgent is declared with
-   it** (R-472; hub v0.112.0). Inside the golden the manifest's MinAgent governs, as before. Above it,
+7. ~~**A floor carries a release past the vouched golden when the release's MinAgent is declared with
+   it**~~ **SUPERSEDED by decision 247 (operator, 2026-10-15): bake → vouch → floor; never a floor for a version with no golden.** The hub mechanism below still exists; the PROCESS no longer uses it. (R-472; hub v0.112.0.) Inside the golden the manifest's MinAgent governs, as before. Above it,
    the MinAgent the operator declares with the floor — read from the release's CHANGELOG header, which
    `minagent_header_gate.py` now guarantees — goes into the same per-box agent comparison. An
    undeclared floor above the golden is still HELD, and both floor forms refuse to save one. **Why:** a
@@ -915,6 +915,20 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-15 (07:48–08:20) — bake first; Plex through its own key; HSTS one day (recorded before the media build)
+
+247. **Bake first.** A controller version is RELEASED only when its golden is baked. The order is always: bake the golden
+     → the operator vouches it in the Day-0 manifest → the operator raises the floor. No report, STATUS line or brief may
+     ask the operator to raise a floor for a version with no golden. **Supersedes decision 7 (2026-09-13).** Why: a floor
+     above the golden left a fresh install on an older controller than the fleet, and a release with no golden could not
+     be vouched. *Operator ruling 2026-10-15 07:48.*
+248. **D1 = A (R-1046): the box drives Plex with the server's own `PlexOnlineToken`**, read from the server's
+     `Preferences.xml` at the moment of use: never stored by the controller, never logged, never in evidence, never sent
+     anywhere but `http://<plex container>:32400`. Plex's „allowed without auth" list is NOT used. *Operator ruling
+     2026-10-15.*
+249. **D2 = A (R-1041): HSTS stays one day now**; raised to one year after a month with no https trouble; never preload,
+     never `includeSubDomains`. *Operator ruling 2026-10-15.*
+
 ### 2026-10-14 (22:13) — https-only is P1; drive events = option A (recorded before the night run)
 
 244. **R-1033 is P1.** Every public name of every box must answer only over https; plain `http://` (login pages