hub v0.45.0: floor-UI separation + effective-floor source + per-box MinAgent conditional floor

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Felhom Hub — Changelog
 
+## v0.45.0 — floor-UI separation + effective-floor source + per-box MinAgent conditional floor (2026-07-11)
+
+Two parts of the NAS/coupling backlog, both addressing the publish-train 0.81/0.113 floor footguns.
+
+- **Floor-UI separation + confirm (Part C):** the global controller-version floor is its own card with
+  a **type-to-confirm** dialog that first states the live blast radius —
+  `GET /configuration/global-floor/impact?v=X.Y.Z` (`countBoxesBelowFloor`, honoring per-customer
+  overrides) — so "the floor acts immediately" is impossible to miss. An **effective-floor + source
+  line** (`store.ResolveGlobalFloor` → `GlobalFloorResolution`) shows the resolved value and WHICH
+  source won (**DB `hub_settings`** vs **env `DEFAULT_MIN_CONTROLLER_VERSION`**, both raw values when
+  they differ) — the 9-minute-skew incident's root cause, now permanently visible. The Day-0 artifact
+  manifest save is unchanged and provably does NOT touch the floor (regression-tested).
+- **Per-box MinAgent conditional floor (Part D):** the artifact manifest gains **`MinAgent`** (the
+  golden's controller `MinAgent:` header; blank = uncoupled, no gating). At report-ACK time
+  `store.ResolveManagedFloor(customerID)` compares the box's `hosts.agent_version` against it: agent ≥
+  MinAgent → the controller floor is served; below **or unknown** → the floor is **HELD** (ACK omits
+  the directive) and the box is flagged on the Hosts dashboard (`floor held: agent <v> < MinAgent
+  <w>`). Mechanises the "agent BEFORE controller floor" rule per box — the manual fleet check is
+  retired (publish-train-rules.md rule 3 updated).
+- **THE one comparator:** `web.compareVersions`'s body moves to a leaf `internal/semver` package
+  (`Compare`/`Valid`); web delegates, store's MinAgent gate reuses it (no import cycle, no second
+  comparator; gitea's documented local copy is out of scope).
+- Tests + red-proofs: floor source precedence (DB-wins), manifest-save-doesn't-touch-floor,
+  impact-count with override exclusion, source-line render; managed-floor hold/serve/uncoupled/
+  unknown-agent + a fleet discriminator + the report-ACK wire test (held box omits the floor, served
+  once the agent qualifies). Every red-proof run → predicted failure → reverted.
+
 ## v0.44.0 — PBS DR tier SLICE 1: ep0 tenantsync surface + hub provisioning (2026-07-10)
 
 Builds on SPIKE-pbs-tier-provisioning (00afadc). The operator ticks "PBS DR tier (ep0)" on a