09 §3 decision 250 (operator 2026-10-15 11:26/11:29): a release needs no golden, CC raises the floor after the three test boxes, the golden is weekly; 247 reversed, 7 stands. golden_currency_gate judges the golden's AGE (>7 days); Sunday golden step; rule files, CLAUDE.md, runbooks, build skill follow; R-1045 closed (floor 0.313.0); R-1051 floor route, R-1052 new-box path, R-1053 rc tags never moved

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/05-hub-architecture.md

@@ -128,6 +128,12 @@ reconciles only on change and reports which generation it has converged to).
 **Geo is *not* in the agent's desired state** — it's customer→hub→Cloudflare (§7); the agent never
 touches WAF.
 
+**The floor and the golden after `09` §3 decision 250 (operator, 2026-10-15).** A controller release needs no golden:
+the floor carries it to every box (MinAgent declared), raised after the release ran on the three test boxes and the box
+walk is green; the golden is baked weekly and vouched by the operator; a new box installs the vouched golden and updates
+itself to the floor (R-1052: not yet proven end to end). Setting the global floor today needs the operator page with the
+operator's password — there is no scoped route for CC (R-1051).
+
 **The controller floor and its agent requirement (hub v0.112.0, R-472).** The managed controller floor
 rides the report ACK. `store.ResolveManagedFloor` decides per box whether to serve it, from three
 inputs: the floor in force (per-customer override, else global), the vouched Day-0 manifest (golden

documentation/architecture/09-update-architecture.md

@@ -168,8 +168,9 @@ These are rulings, not proposals. Anything specced against a different assumptio
 
 ### 2026-09-13 (afternoon) — the floor carries a release without a golden, and every backup counts
 
-7. ~~**A floor carries a release past the vouched golden when the release's MinAgent is declared with
-   it**~~ **SUPERSEDED by decision 247 (operator, 2026-10-15): bake → vouch → floor; never a floor for a version with no golden.** The hub mechanism below still exists; the PROCESS no longer uses it. (R-472; hub v0.112.0.) Inside the golden the manifest's MinAgent governs, as before. Above it,
+7. **A floor carries a release past the vouched golden when the release's MinAgent is declared with
+   it** (R-472; hub v0.112.0). *Superseded by decision 247 at 07:48 on 2026-10-15 and REINSTATED by decision 250 at
+   11:26 the same day — it stands.* Inside the golden the manifest's MinAgent governs, as before. Above it,
    the MinAgent the operator declares with the floor — read from the release's CHANGELOG header, which
    `minagent_header_gate.py` now guarantees — goes into the same per-box agent comparison. An
    undeclared floor above the golden is still HELD, and both floor forms refuse to save one. **Why:** a
@@ -915,9 +916,28 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-15 (11:26/11:29) — a release needs no golden; CC raises the floor; the golden is weekly (recorded before the work)
+
+250. **A controller release needs no golden; CC raises the floor; the golden is baked weekly.** *Operator ruling 2026-10-15
+     11:26/11:29.* Reverses decision 247 (07:48 the same day); decision 7 stands again.
+     1. **The image goes to the registry only when it is ready for every box** — every household's manual update button
+        offers the HIGHEST tag in the registry (`TriggerUpdate("manual")`), while the floor path targets the floor.
+     2. **CC raises the floor itself**, with the release's MinAgent declared, when both guards hold: (a) the release ran on
+        the three test boxes (Tester 1, demo-hp, demo-felhom) through the normal update path; (b) the box walk's checks are
+        green on all three afterwards (`scripts/https_only_check.py` included). Not at night unless the night brief says so.
+        *Route:* the only way to save the global floor today is the operator page with the operator's own password; CC
+        does not use it for this until the operator grants a scoped route (R-1051).
+     3. **Agent releases (and their bundles) still stop for the operator's vouch;** a floor whose MinAgent is above the
+        vouched agent is never set.
+     4. **The golden is baked weekly** (Sunday night, `runbooks/nightly-rotation.md`); the operator vouches it. A new box
+        installs the vouched golden and updates itself to the floor (not yet proven end to end — R-1052).
+     5. The push gate judges the golden by its AGE (older than 7 days while the floor is above it), not by the newest
+        CHANGELOG heading (`scripts/golden_currency_gate.py`).
+
 ### 2026-10-15 (07:48–08:20) — bake first; Plex through its own key; HSTS one day (recorded before the media build)
 
-247. **Bake first.** A controller version is RELEASED only when its golden is baked. The order is always: bake the golden
+247. ~~**Bake first.** A controller version is RELEASED only when its golden is baked.~~ **REVERSED by decision 250,
+     the same day (11:26).** The original text, kept: A controller version is RELEASED only when its golden is baked. The order is always: bake the golden
      → the operator vouches it in the Day-0 manifest → the operator raises the floor. No report, STATUS line or brief may
      ask the operator to raise a floor for a version with no golden. **Supersedes decision 7 (2026-09-13).** Why: a floor
      above the golden left a fresh install on an older controller than the fleet, and a release with no golden could not