D44/D45 = all picks applied (R-1265, R-1266 closed; R-1280–R-1283 opened); R-232 dated check done; release-2026-10-26 evidence: fix A/B live on rc.6, D47 set-aside alarm on rc.7

documentation/architecture/09-update-architecture.md

@@ -286,8 +286,11 @@ builds them (`audits/update-rulings-2026-09-23/`).
 13. **The test decides, not the tag** (Q3). **REPLACES decision 3's second half, "never across a
     major".** The box applies by itself every step the catalog holds, because **the catalog holds only
     tested steps**; the size of the version jump does not matter, the test does. The box does not
-    parse tags to decide. The tag rule (`stacks.CompareImageRefs`) moves to the **catalog gate** as a
-    push-time safety net: an image move with no test record is refused there. Two exceptions, both
+    parse tags to decide. ~~The tag rule (`stacks.CompareImageRefs`) moves to the **catalog gate** as a
+    push-time safety net:~~ **[DESIGN — corrected 2026-10-25, D45 = all picks, R-1266]** The tag rule (`stacks.CompareImageRefs`) did not move: it
+    stays in the controller (`internal/stacks/updateorder.go`), where it only tells whether an installed app is
+    AHEAD of the catalog; it never decides an update. The catalog gate is the push-time safety net, and it asks for a
+    proven test instead (§6.4 part 4): an image move with no test record is refused there. Two exceptions, both
     **marks the test sets on the step**: *files may change* → automatic only when a fresh copy holds
     the files, else a person (this is Q2's refinement); *needs a person* → the tester writes why.
     **Why:** decision 3 was a proxy. "Within a major" was standing in for "known to work", and the
@@ -299,7 +302,11 @@ builds them (`audits/update-rulings-2026-09-23/`).
     unchanged for every other move: a step a box takes was still tested, on at least the box venue.
 
 14. **The update ladder** (Q3). A box more than one step behind **climbs one tested step at a time, in
-    order, and never jumps**. Each step is the full guarded update of §6.1. **Why:** a step was tested
+    order, and ~~never jumps~~ the night leg never jumps**. Each step is the full guarded update of §6.1.
+    **[DESIGN — corrected 2026-10-25, D45 = all picks, R-1266]** An app older than the ladder (its installed version matches no entry's `from`) is never
+    pressed by the night leg (`internal/stacks/unattended.go`). A PERSON's press on such an app takes the catalog's
+    current definition, logged by name (`internal/stacks/ladder.go`, `TestLadder_UnknownInstalledJumpsAndSaysSo`); the
+    guarded update and its undo (decision 15) still run around it. **Why:** a step was tested
     from the version before it, not from three versions before it; R-40's multi-major jump is what
     this prevents. This is the "stepping" §6.1 already assigned to slice 6.
 
@@ -988,8 +995,11 @@ its length, and both fixes cost something the household would notice — operato
         installs the vouched golden and updates itself to the floor (not yet proven end to end — R-1052). **The golden
         stays weekly:** a CHANGED golden selection is still refused when it is older than the fleet's newest controller
         (`TestVouchGoldenChangedToOlderIsStillRefused`).
-     5. The push gate judges the golden by its AGE (older than 7 days while the floor is above it), not by the newest
-        CHANGELOG heading (`scripts/golden_currency_gate.py`).
+     5. The push gate judges the golden by its AGE, not by the newest CHANGELOG heading
+        (`scripts/golden_currency_gate.py`). **[DESIGN — corrected 2026-10-25, D45 = all picks, R-1266]** ~~(older than 7 days while the floor is above
+        it)~~ The gate runs offline and cannot read the floor, so „a release is ahead of the newest bake” stands in for
+        „the floor is above it”: it convicts when a release is ahead AND the newest bake is more than 7 days old; ahead
+        and at most 7 days old is an advisory. The floor follows a release within hours, so the gate is the stricter one.
 251. **Scripts use scoped hub tokens, not the operator password; CC's floor step uses its own.** *Operator ruling
      2026-10-15 11:38.* Tokens with groups (read/write per group), managed on the Configuration tab, shown once, stored
      hashed, every use logged by name (`05` §17, hub v0.152.0). Never by any token: a secret shown or minted, a delete or
@@ -2570,7 +2580,7 @@ and E are the ones that unblock a decision; leg A is the one that takes the time
 harness on DooPlex for the image-side ones.
 
 
-### 6.4.x Decisions in code no section records [DESIGN — undocumented, found 2026-10-24, review round 2 — the operator confirms them through one register row]
+### 6.4.x Decisions in code no section records [DESIGN — confirmed by the operator 2026-10-25 (D44 = all picks, R-1265)]
 
 Read at `file:line` on controller `main` (`321df1f`) by the main session: