hub v0.45.0: floor-UI separation + effective-floor source + per-box MinAgent conditional floor

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/runbooks/publish-train-rules.md

@@ -25,14 +25,28 @@ zero NAS shares.
 
 **Rule:** fill the floor field **last**, in a separate save, only after rule 3's fleet check passes.
 
-## 3. MinAgent fleet gate
+## 3. MinAgent fleet gate — HUB-ENFORCED PER-BOX since hub v0.45.0
 
 A controller release that depends on coupled agent behavior declares `MinAgent: X.Y.Z` in its
 CHANGELOG entry header line (felhom-controller convention, since v0.114.0; retroactively, 0.113.0's
-effective MinAgent was 0.81.0 for the NAS add). **The floor may not rise past a controller version
-whose MinAgent is not yet met fleet-wide:** check the hub dashboard — every reporting box must show
-agent ≥ MinAgent before the floor save. Manual at the current fleet size; hub-enforced per-box
-gating is the deferred option-3.
+effective MinAgent was 0.81.0 for the NAS add). The floor may not effectively push a box past a
+controller whose MinAgent that box's agent does not yet meet.
+
+**Hub-enforced per-box since hub v0.45.0 (the manual fleet check is retired):** the operator sets
+the golden's **`MinAgent`** in the Day-0 artifact manifest (Configuration → Day-0 artifacts →
+"Min agent"; blank = uncoupled release, no gating). At report-ACK time the hub compares each box's
+reported `hosts.agent_version` against that MinAgent
+(`store.ResolveManagedFloor`, `hub/internal/store/store.go`): agent ≥ MinAgent → the controller
+floor is served; agent below MinAgent **or unknown** → the floor is **HELD** (the ACK omits the
+directive) and the box is flagged on the Hosts dashboard (`floor held: agent <v> < MinAgent <w>`) —
+a held box is visible, never silently stale. The operator still SETS MinAgent at manifest time; the
+hub does the per-box gating. This mechanises the "agent BEFORE controller floor" ordering that rule
+2's incident violated by hand.
+
+Effective-floor visibility (same v0.45.0): the floor card shows the resolved value + its source
+(DB `hub_settings` vs env `DEFAULT_MIN_CONTROLLER_VERSION`, both raw values when they differ), and
+the floor save is behind a type-to-confirm dialog stating the live below-floor blast radius — so
+rule 2's "the floor acts immediately" is impossible to miss.
 
 ## 4. Box-level backstop: the controller's capability gate
 
@@ -42,6 +56,9 @@ transport/5xx ⇒ indeterminate, never "too old") and refuses up front with an h
 message instead of failing mid-pipeline. This turns a violated ordering into a graceful refusal —
 it does **not** license sloppy trains: rules 1–3 remain the primary control.
 
-Convention for new coupled features: add a row to the `featureProbes` table + a `Supports` gate
-call at the feature's entry point, and declare MinAgent per rule 3. When the agent someday reports
-an explicit version in its envelope, `Supports` should prefer the version comparison (roadmap).
+Convention for new coupled features: add a row to the `featureProbes` table AND the `featureMinAgent`
+table + a `Supports` gate call at the feature's entry point, and declare MinAgent per rule 3. Since
+controller v0.115.0 + agent v0.82.0 the agent reports its version in the `X-Felhom-Agent-Version`
+response header, so `Supports` decides by version comparison when the version is known and only
+falls back to the route probe for header-less (≤0.81) agents — capability detection is now explicit,
+not probe-inferred.