docs: rulings 7 and 8 shipped and proven live (R-470/R-472/R-475 CLOSED); R-477..R-480 opened

Hub v0.112.0 serves a floor above the golden with a declared MinAgent;
controller v0.239.0 reached both demo boxes by that floor in 14 s and 15 s
and updates on any backup tier. 09 §3 decisions 7 and 8, §6/§6.1; 07 §6
line; capability map row; STATUS items 15/16 done and the cadence line
corrected; CONTEXT; register: R-470/R-472/R-475 compressed to CLOSED-ITEMS
(full text at 2f5d3af), R-477..R-480 opened, R-474 reproduced a third
time. OPEN-ITEMS 431689 -> 432156 bytes, CLOSED-ITEMS 118051 -> 120598.
Evidence: documentation/audits/rulings-r472-r475-2026-09-13/.

CONTEXT.md

@@ -20,9 +20,10 @@
 on demo-hp — `documentation/audits/slice4-2026-09-13/`, design `09-update-architecture.md` §6.1.
 
 **Decisions a later session must not re-derive:**
-- **The precondition is the existing verified backup** (ruling 2026-09-02): `backup.Tier2UnitRestorePoint`,
-  the predicate the destructive Tier-2 unit restore already uses — extracted, not copied. Tier-2-only by
-  specification; that leaves apps with no Tier-2 copy un-updatable (R-475, operator decision).
+- **The precondition is the existing verified backup** (ruling 2026-09-02) **on ANY tier** (ruling
+  2026-09-13, controller v0.239.0, R-475 CLOSED): `backup.Manager.UpdateRestorePoints` walks Tier 2 →
+  Tier 1 → Tier 3 and the update leans on the first copy younger than `backup_max_age`; nothing
+  anywhere → back up first. `Tier2UnitRestorePoint` stays the Tier-2 half and the page's predicate.
 - **Age a copy by its last SUCCESSFUL Tier-2 copy, never by the unit manifest's `created_at`** — measured:
   the manifest moves only when the definition changes (R-476 is the page's side of this).
 - **No automatic rollback** — measured per-app in `SPIKE-upgrade-test-2026-09-06`. Health failure → stop +
@@ -30,8 +31,10 @@ on demo-hp — `documentation/audits/slice4-2026-09-13/`, design `09-update-arch
   successful unit restore lifts it.
 - **Anything that writes a restore point skips an app that is held OR updating** (capture, Tier 2, volume
   dump) — the updating half was found live (v0.238.1).
-- **A release does not reach the fleet by floor between golden bakes** — the hub holds a floor above the
-  vouched golden (R-472, operator decision). Slice 4's three releases were hand-deployed.
+- **A release reaches the fleet by floor between golden bakes when its MinAgent is declared with the
+  floor** (ruling 2026-09-13, hub v0.112.0, R-472 CLOSED). An undeclared floor above the golden is still
+  held, and the forms refuse it. v0.239.0 arrived on both demo boxes this way in ~15 s. Never hand-deploy
+  a release to route around this — the floor IS the delivery.
 
 ## Goldens move to a CADENCE, and the gate learns to read a dated waiver (2026-09-13, R-468 / R-242 / R-467)
 
@@ -41,7 +44,7 @@ design, and in August that produced **25 goldens in 26 days** plus thirteen decl
 bypasses (R-404/R-417). A guard bypassed that often teaches everyone to bypass it. Every release still
 raises the FLOOR, so the demo boxes keep getting each release in ~20 s; only the golden — which
 protects a fresh install and nothing else — moves to a cadence.
-**⚠ CORRECTED THE SAME DAY (R-472): between bakes the floor does NOT carry a release — the hub holds any floor above the vouched golden (publish-train rule 1), so releases between bakes reach the demo boxes only by hand-deploy.**
+**⚠ CORRECTED THE SAME DAY (R-472): the hub held any floor above the vouched golden, so releases between bakes reached the demo boxes only by hand-deploy. RESOLVED the same afternoon (hub v0.112.0): a floor above the golden is served when saved with the release's declared MinAgent.**
 
 **The mechanism, because a rule without one is a wish (R-242 recurred the day after it was written):**
 `documentation/tests/golden-waiver.yml` — `issued`, `expires` (≤ 14 days, enforced by the gate's