v0.122.0: three ways the signals lied about themselves (R-189, R-188, R-186)

All three are the reporting and release path misreporting its own work. No
customer machine, no backup, no restore, no data. The restore-test itself and
when it runs are unchanged.

R-189 — a passing restore-test no longer vanishes on a restart. restore_tests[]
came only from the in-memory store, whose comment ("lost on restart; the cadence
re-populates") was true under a timer and stopped being true when R-86 made the
agent refuse to re-test a proven archive: the proof is then not repeated for a
whole archive generation. Observed live — a 14.5 GB offsite PASS reached no
host-report because the agent was restarted 2m43s later. RestoreTestState now
carries tier + verified beside the archive and renders reportable entries; the
collector merges them, one per tier, newest by TestedAt. It refuses to lie: a
record missing archive-or-tier produces no entry, and run mechanics are not
re-invented. Only successes are persisted, and the asymmetry is now written where
it will be read.

R-188 — a correct release stops emailing a failure. Only the tag PUSH moved
(build -> tag locally -> publish -> push tag): the push wakes CI, and a tag
visible before its package made the gate correctly fail a correct release about
half the time. The old order's invariant is asserted directly instead — the gate
now refuses a published version with no tag, as a bounded probe that prints its
own coverage, because the package listing api is still 401 without a token.

R-186 — a released binary can be verified by rebuilding it. -trimpath
-buildvcs=false: same source, same bytes, tag or no tag. Measured. publish-agent's
fallback also forced CGO_ENABLED=0 and produced a 74 KB different binary for the
same version; both paths now build identically. CLAUDE.md records the command.

CHANGELOG.md

@@ -1,3 +1,84 @@
+## v0.122.0 — three ways the signals lied about themselves (2026-08-03, R-189 · R-188 · R-186)
+
+All three are the reporting and release path misreporting its own work. **No customer machine, no
+backup, no restore, no disk layout, no data.** The restore-test itself and when it runs are unchanged
+from v0.121.1.
+
+### R-189 — a passing restore-test no longer vanishes on a restart
+
+`restore_tests[]` came only from the in-memory `backup.Store`, whose own comment read *"lost on
+restart; the cadence re-populates"*. That was true under a timer. It stopped being true when R-86 made
+the agent refuse to re-test an archive it has already proven: a proof lost to a restart is not
+repeated for a whole archive generation — **a week on the offsite tier** — and the hub calls the tier
+unproven for all of it.
+
+**Observed, not predicted (2026-08-03):** a real 14.5 GB offsite restore-test PASSED at 15:25:14, the
+agent was restarted 2 m 43 s later for a deploy, and the hub logged `0 restore-tests` on the next two
+host-reports.
+
+The durable proof already existed — `RestoreTestState`, on disk, per tier, with the archive since
+R-86 — and `Snapshot()` had carried the doc comment *"for the host-report gauge"* since the day it was
+written **with no caller at all**: a seam built, documented, and never connected. It now carries the
+`tier` and what was `verified` as well (stored at proof time, when they are known for certain, rather
+than derived later by a storage lookup that can fail), and `ProvenRestoreTests` renders them as report
+entries which the collector merges.
+
+- **Merge rule: one entry per tier, newest by `TestedAt` wins.** A fresh failure beats a stored
+  success — the failure is the news and lives nowhere else; a stored success beats a stale in-memory
+  entry after a restart; a tier never appears twice, which the hub would read as two tests. An
+  unparseable timestamp counts as older, so a malformed entry cannot displace a good one.
+- **It refuses to lie.** A record missing the archive or the tier produces NO entry, and run mechanics
+  (scratch VMID, duration) are not re-invented — an absent duration is not a claim, a fabricated one
+  would be. An unproven tier reading as proven would be worse than the defect being fixed.
+- **Only successes are persisted, and that asymmetry is now written down where it will be read:** a
+  success suppresses future work, so losing it leaves the system quietly less tested than it believes;
+  a failure causes future work and heals itself at the next evaluation.
+- The `Store` comment that stopped being true is corrected in place rather than left to mislead.
+
+### R-188 — a correct release no longer emails a failure
+
+`on: [push]` fires the gates workflow on the **tag** push, and the release pushed its tag *before*
+publishing, so CI ran the published-versions gate in the seconds before the package existed and
+correctly reported it missing. Measured across two releases in one session: runs 12/13 and 17/18, same
+sha each time, opposite results — a race, not a rule. R-168 made that mail the thing that cannot be
+missed; one that is wrong half the time is one you stop reading.
+
+**Only the tag PUSH moved** (build → tag locally → publish → push tag). The tag is still created before
+anything is published, so the build and the tag still describe the same commit; it simply becomes
+*visible* — to CI, and to any `raw/tag/…` fetch — once the package is downloadable.
+
+The invariant the old order protected is **not traded away**: `check-published-versions.py` now asserts
+the converse directly — **no published version may be missing its tag** — as a bounded probe of the
+frontier (where a failed tag push leaves an orphan) and of patch gaps, printing its probe set every
+run because a check whose coverage is invisible reads as a guarantee it is not making. The package
+listing api still answers **401** without a token (re-measured), so absence cannot be enumerated, and
+the script says so.
+
+A publish that succeeds and a tag push that then fails now **dies loudly**, printing the one-line
+recovery; and a publish that *fails* removes the local-only tag so the release can simply be retried
+instead of colliding with itself.
+
+### R-186 — a released binary can now be verified by rebuilding it
+
+`go build` stamps a module version derived from VCS state, so a build made before the tag existed and
+a rebuild made after it were different binaries. Measured at one commit, same source, same toolchain:
+
+```
+default flags, no tag yet ... 18f4a495…  14 085 464 B   (mod v0.121.2-0.2026…-3d0a1d61)
+default flags, tagged ....... 4a38f394…  14 085 440 B   (mod v0.121.99)
+-trimpath -buildvcs=false ... 7ffcdf1d…  14 064 574 B   IDENTICAL both ways
+```
+
+The stamp is removed rather than sequenced around — nothing in this repo reads it (no `ReadBuildInfo`
+caller) and the version comes from the explicit `-X main.version` ldflag. `-trimpath` additionally
+makes a rebuild from a different checkout directory match.
+
+**A second discrepancy fell out of it:** `publish-agent.sh`'s fallback build forced `CGO_ENABLED=0` and
+therefore produced a binary **74 KB smaller** than the release path built for the same version — one
+version name, two binaries, decided by which entry point was used. Both now build identically.
+
+`CLAUDE.md` records the exact command an operator can run to verify a published binary independently.
+
 ## v0.121.1 — "nothing is due" must be AUDIBLE (2026-08-03, R-86 + standing rule 3)
 
 **Found while live-validating v0.121.0, and it is this project's own rule pointed at the change that