# REPORT — update arc slice 4 documents, and a correction to this morning's golden-cadence page (2026-09-13)

*Overwritten each session. Nothing durable lives only here — every finding below has a register row.
The implementation report is `felhom-controller/REPORT.md`.*

> **The Update button is a guarded job, shipped as controller v0.237.0–v0.238.1 and proven live on
> demo-hp.** This repo carries its documents: `09-update-architecture.md` §6.1, the register, the
> capability map, ROADMAP, CONTEXT and STATUS. **It also carries a correction to what this repo said
> this morning:** under the weekly golden cadence a release does NOT reach the fleet by floor.

## What changed here

- `documentation/architecture/09-update-architecture.md` — slice 4 SHIPPED; §6.1 describes the sequence
  as shipped, the two knobs, the abort decision (not built, by measurement), the v0.238.1 finding and
  the live proof; §8.6 closed.
- `documentation/backlog/OPEN-ITEMS.md` — **R-448, R-443, R-439 CLOSED** and compressed to
  `CLOSED-ITEMS.md`; **R-472..R-476 opened**; R-469 unblocked, not lifted. 214 open / 174 closed;
  431 689 bytes, from 439 828.
- `documentation/architecture/00-capability-map.md` — "Update is GUARDED" row, PROVEN-LIVE, citing
  `audits/slice4-2026-09-13/`.
- `documentation/backlog/ROADMAP.md` — slice 4 collapsed.
- `documentation/audits/slice4-2026-09-13/` — live evidence, red-proof outputs, gate results.
- `STATUS.md` — item 14 (plain words), items 15 and 16 (two operator decisions).
- **The correction.** `RUNBOOK-manual-build.md` §4.2, `STATUS.md`, `CONTEXT.md`, R-468's row and the
  `golden_currency_gate.py` docstring said a release still reaches the demo boxes by floor in about
  20 seconds between bakes. **The hub holds a floor above the vouched golden**, so that is false. Each
  now says so and points at R-472. `scripts/CHANGELOG.md` records it.

## Observations

1. **The golden cadence and the hub's floor rule contradict each other.** **FILED: R-472.**
2. **The glance catalog template crash-loops on a fresh install.** **FILED: R-473.**
3. **App removal with "delete backups" leaves the recovery unit and Tier-2 copy.** **FILED: R-474.**
4. **The update precondition is Tier-2-only.** **FILED: R-475.**
5. **The Mentések page dates a copy by its manifest, which lags the data.** **FILED: R-476.**