docs(R-71): SHIPPED (a)+(c) — the apply-bridge settle-gate (controller v0.162.0)

R-71(a) day-0 ordering fix shipped: offsiteapply settle-gate defers the offsite
one-time-password consume past a managed floor-update, reading the updater's own
floor/update-running state (no second floor path). Ordering-only; (b) two-phase
consume rejected-by-design. ROADMAP R-71 -> SHIPPED (a)+(c); DIAG-f10 final
annotation added. Layering: v1.25.0 build gate prevents, (a) defers, (c) heals.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N7Drmtm2RzoqbkJZCNSFNQ

documentation/audits/DIAG-f10-demo-hp-offsite-2026-07-23.md

@@ -129,6 +129,20 @@ now reflects the customer. Nightly offsite is scheduled (daily 04:15 guest-UTC).
   **→ PARTIAL 2026-07-23: (c) self-heal restage SHIPPED in hub v0.72.0** (R-39(a)-guarded, one
   restage/customer/24 h, every firing a warning event; unit-proven + red-proofed, NOT live-fired —
   arms on the next natural occurrence). (a) day-0 ordering stays open — its own spec.
+  **→ SHIPPED 2026-07-24: (a) the apply-bridge settle-gate (controller v0.162.0).** `AwaitSettle`
+  defers the one-time-password consume while a managed update is running OR the box is below the
+  known operator floor (the auto-floor update is imminent), reading the updater's OWN
+  `GetFloor()`/`IsUpdateRunning()` via a new `SettleProvider` seam (no second floor path). At/above
+  floor it GOes on the first poll with zero added latency (B′). Bounds 10 s / 90 s floor sub-bound /
+  5 min overall — both GO+WARN on the argument that **a hub which cannot serve a floor cannot serve a
+  consume, so proceeding on floor-unknown carries no burn risk** (R-71c is the belt if a genuinely
+  stuck update later burns one). Ordering-only: the consume/persist order and the 404-no-oracle
+  contract are untouched — **(b) two-phase consume is REJECTED-BY-DESIGN.** Finding: the floor is
+  in-memory (report-ACK ~5–10 s), not persisted → unknown on any restart until the first ACK; the
+  90 s sub-bound is sized to that. 5 scenarios + 4 red-proofs (all observed FAIL then restored);
+  deferral paths NOT live-fired — the v1.25.0 golden≥floor build gate now structurally PREVENTS the
+  precondition (the point). **R-71 → SHIPPED (a)+(c). Layering: build gate prevents, (a) defers,
+  (c) heals.** See `felhom-controller/REPORT.md` (2026-07-24) + controller CHANGELOG v0.162.0.
 - Audit F10 row annotated: **offsite leg RESOLVED** (this record); the PBS-DR-snapshot half of F10
   **stays open** pending F13 (cadence ruling) and the deliberate DR ceremony R-moment on demo-hp.