docs: rulings 7 and 8 shipped and proven live (R-470/R-472/R-475 CLOSED); R-477..R-480 opened

Hub v0.112.0 serves a floor above the golden with a declared MinAgent;
controller v0.239.0 reached both demo boxes by that floor in 14 s and 15 s
and updates on any backup tier. 09 §3 decisions 7 and 8, §6/§6.1; 07 §6
line; capability map row; STATUS items 15/16 done and the cadence line
corrected; CONTEXT; register: R-470/R-472/R-475 compressed to CLOSED-ITEMS
(full text at 2f5d3af), R-477..R-480 opened, R-474 reproduced a third
time. OPEN-ITEMS 431689 -> 432156 bytes, CLOSED-ITEMS 118051 -> 120598.
Evidence: documentation/audits/rulings-r472-r475-2026-09-13/.

STATUS.md

@@ -1,9 +1,13 @@
 # STATUS — what works, what's broken, what's next
 
+**Updated 2026-09-13 (fourth pass) — you decided both things. New releases reach the demo machines
+by themselves again, and an app with any backup can now be updated. Both are live and proven on the
+HP. Nothing needs you.**
+
 **Updated 2026-09-13 (third pass) — the Update button now takes a backup first and tells the truth. It
 is live on both machines and I walked every case on the HP, including putting a broken update back
 from its backup. TWO THINGS NEED YOU: item 15 (the demo machines no longer get new releases by
-themselves between golden images) and item 16 (apps with no second-drive copy cannot be updated).**
+themselves between golden images) and item 16 (apps with no second-drive copy cannot be updated).** Both done the same afternoon.
 
 **Updated 2026-09-13 (second pass) — you decided both open items. The database engine now finishes
 its own conversion on the four MariaDB apps; the upgrade machine proved it and it landed on the HP
@@ -252,31 +256,19 @@ nothing.*
     app came up, the regular backup copied the broken version into the app's local backup. It now
     leaves an app alone while it is updating. Live as 0.238.1.
 
-15. **The demo machines no longer get new releases by themselves between golden images. One decision.**
-    This morning we agreed to bake the golden image weekly, on the promise that every release still
-    reaches both machines in about 20 seconds. **That promise was wrong.** The hub will not move a
-    machine to a release newer than the golden image, so between bakes I install releases on the demo
-    machines by hand. Today I did that three times.
-    - **Bake a golden image for every release again.** Releases reach the machines by themselves. The
-      cost is the weekly routine we just ended.
-    - **Let the hub move machines past the golden image when a release says it needs no newer agent.**
-      Releases reach the machines by themselves and goldens stay weekly. It needs one small hub change,
-      and first each release must reliably say which agent it needs (R-470).
+15. **New releases reach the demo machines by themselves again.** You decided this, and it is done.
+    When I raise the floor for a release, I now also type which agent that release needs. The hub
+    then moves the machines past the golden image. If I leave that value out, the hub refuses to save.
+    Release 0.239.0 reached both machines this way in 15 seconds. Nothing needs you.
 
-    **My pick: the second.** **If you do nothing:** nothing breaks; I keep installing by hand and
-    saying so each time.
-
-16. **Apps with no copy on a second drive cannot be updated. One decision.** The update's safety rule
-    asks for the app's second-drive copy, as we decided on 2 September. On the HP, two apps (gokapi
-    and nextcloud) have no such copy, so their Update button refuses. A box with only one drive would
-    refuse every update.
-    - **Keep it.** Only apps with a second-drive copy can be updated. The refusal tells the customer how
-      to switch it on.
-    - **Also accept the backup on the same drive.** Updates work on one-drive boxes. That backup is lost
-      if that drive dies.
-
-    **My pick: keep it for now,** and revisit when the first one-drive customer exists. **If you do
-    nothing:** those apps show the refusal and nothing else changes.
+16. **Apps with no copy on a second drive can now be updated.** You decided this, and it is done.
+    The update now uses any backup: the second drive first, then the app's own copy, then the remote
+    copy. If none is younger than a day, it makes a fresh one first. If the new version fails, the page
+    names which backup to restore from. Proven on the HP: an app with only its own copy updated, a
+    broken update was held, and it came back from its own copy. Nothing needs you.
+    Four small things turned up and are written down: the remote check can take 15 seconds (R-477),
+    a leftover backup of a removed app counted as a fresh one (R-478), for some apps their own copy
+    holds only settings (R-479), and the card keeps the old failure sentence after a good restore (R-480).
 
 8. **`demo-hp`'s network setup does not match our own notes** (R-338) — the machine works, the page is
    wrong, or the other way round. **If you do nothing:** the page keeps misleading the next session,
@@ -288,9 +280,9 @@ nothing.*
   In August I baked 25 goldens in 26 days, almost one per release, because the check trips on every
   release on purpose. From today: one golden a week, and always before a drill or a fresh install.
   **Correction, same day:** I wrote that every release would still reach both demo machines in about
-  20 seconds between bakes. **That is wrong.** The hub will not move the machines past the image a new
-  machine starts from, so between bakes I install each release on the demo machines by hand. That is
-  item 15 below, and it is yours to decide. The check now reads a dated permission slip that runs out
+  20 seconds between bakes. **That was wrong at first:** the hub would not move the machines past the
+  golden image. **It is true again since the afternoon:** the floor now carries the release when I type
+  which agent it needs (item 15). Release 0.239.0 arrived in 15 seconds. The check now reads a dated permission slip that runs out
   after at most 14 days; while it is valid the check warns instead of refusing, and when it runs out
   the check is red again until someone bakes or renews. A dated slip cannot be forgotten — it just
   expires. Today's golden (0.236.0) is baked, checked three ways, and live.