09 §3 decisions 247-249 (operator 2026-10-15): bake first (supersedes decision 7); D1=A Plex own token at use; D2=A HSTS one day. Rule file, CLAUDE.md, manual-build + publish-train runbooks follow; R-1041/R-1046 closed (decided); R-1050 dated HSTS check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/RUNBOOK-manual-build.md

@@ -98,8 +98,9 @@ the manifest vouches the target FIRST; any MinAgent must be satisfied fleet-wide
 boxes below it automatically, and flags them); **save the floor LAST** — the DB row acts immediately
 on every box below it, on their next report.
 
-**Raise the floor to a release with no golden (hub v0.112.0+, R-472).** Between bakes this is the
-normal route — do not hand-deploy.
+**Raise the floor to a release with no golden (hub v0.112.0+, R-472).** **⚠ NOT USED SINCE 2026-10-15 (`09` §3
+decision 247): bake → vouch → floor; never ask for a floor for a version with no golden.** The mechanism is kept
+here because the hub still has it.
 
 1. Build and push the controller image (above). Do not install it on any box.
 2. Read the MinAgent from the release's header: `grep -m1 -A3 '^## v<VER>' CHANGELOG.md` shows
@@ -251,6 +252,10 @@ after reading the dry-run; nothing schedules it. The August 2026 `--keep 7` run
 
 ### 4.2 Cadence — goldens are WEEKLY and before any install, not per release (operator ruling 2026-09-13)
 
+> **⚠ SUPERSEDED for releases on 2026-10-15 (`09` §3 decision 247):** every controller release gets its golden before
+> its floor — bake → the operator vouches → the operator raises the floor. The weekly bake and the before-any-install
+> bake below still hold for weeks with no release; the waiver keeps the gate's own mechanism.
+
 **What was measured before the ruling:** 25 goldens in 26 days in August, almost one per release,
 because `golden_currency_gate.py` trips on every release by design and the only honest ways past it
 were a bake or a declared `--no-verify` (thirteen of those by 2026-09-01 — R-404/R-417). **The

documentation/runbooks/publish-train-rules.md

@@ -10,6 +10,9 @@ Publish and vouch the artifacts in the Day-0 manifest **before** any floor movem
 points at an unvouched (or unpublished) version bricks self-updates: boxes are told to move to a
 version they cannot verify. (GL-1 supply-chain arc; see the go-live package records.)
 
+**⚠ Since 2026-10-15 (`09` §3 decision 247) the process never uses a floor above the golden: bake → vouch → floor.**
+The mechanism below stays in the hub and is described for reading the hub, not as a route.
+
 **Since hub v0.112.0 (operator ruling 2026-09-13, R-472): the manifest leads the floor inside the
 golden; above it, the release's own declared MinAgent does.** A controller image is pulled by tag from
 the registry, so a floor above the golden does not need a golden to be delivered — it needs to know