Slice 4 shipped (R-448/R-443/R-439 CLOSED, proven live); R-472..R-476; the floor-between-bakes claim corrected

Controller v0.237.0-v0.238.1: the Update button is a guarded job — refusals, backup-first when the
proven Tier-2 copy is stale, safety dump, pin, pull (pin back on failure), health, HOLD on failure.
Proven live on demo-hp: A, B, E, F, H and the restore walk (audits/slice4-2026-09-13/).

Correction to this morning's pages: between golden bakes the hub HOLDS a floor above the vouched
golden, so a release does not reach the fleet by floor (R-472, operator decision). Corrected in the
runbook, STATUS, CONTEXT, R-468 and the gate docstring.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/RUNBOOK-manual-build.md

@@ -210,9 +210,10 @@ The full 0.188.0 run, with the observables: `documentation/audits/tester-gate-go
 **What was measured before the ruling:** 25 goldens in 26 days in August, almost one per release,
 because `golden_currency_gate.py` trips on every release by design and the only honest ways past it
 were a bake or a declared `--no-verify` (thirteen of those by 2026-09-01 — R-404/R-417). **The
-ruling:** bake on a cadence. Every release still raises the FLOOR (§4.1 step 5), so both demo boxes
-keep getting each release in ~20 s; only the golden — which protects a **fresh install** and nothing
-else — moves to a cadence.
+ruling:** bake on a cadence. The ruling assumed every release would still raise the FLOOR (§4.1 step
+5) and reach both demo boxes in ~20 s, with only the golden moving to a cadence. **⚠ CORRECTED THE SAME DAY (R-472): between bakes the floor does NOT carry a release — the hub holds any floor above the vouched golden (publish-train rule 1), so releases between bakes reach the demo boxes only by hand-deploy.** A
+release between bakes is hand-deployed per the `felhom-build-deploy` skill, and the floor is left at
+the vouched golden.
 
 **The cadence, and it is a step in a routine, not a memory:**