REPORT: add v0.103.0 (R-84) + demo-hp's first offsite backup landing (4.25 GB)

REPORT.md

@@ -13,6 +13,7 @@ Full cross-repo arc + the Phase-0 gates: `felhom.eu/REPORT.md`.
 | **v0.100.0** | the restore tier comes from the ARCHIVE, not the configured target |
 | **v0.101.0** | a leaked restore-test scratch can no longer auto-start (`onboot=0` at restore time) |
 | **v0.102.0** | an unprovisioned tier DEFERS instead of firing at a missing storage |
+| **v0.103.0** | **R-84** — an agent restart no longer triggers a redundant backup |
 
 ## Four defects found by RUNNING it, not reviewing it
 
@@ -28,6 +29,11 @@ Full cross-repo arc + the Phase-0 gates: `felhom.eu/REPORT.md`.
    that leaks.
 4. **v0.102.0** — a tier fires at a storage that does not exist yet (a fresh box before DR
    provisioning). Now deferred, going live with no restart once the storage appears.
+5. **v0.103.0 (R-84)** — three redundant local backups ran on demo-felhom in one afternoon of
+   deploys, because the in-memory `Store` is empty after a restart and the due-check read that as
+   "no backup ever". On the offsite tier that is a wasted multi-hour WAN upload after every agent
+   deploy. The due-check now consults the STORAGE (ground truth: a pruned archive correctly stops
+   counting, where a persisted record would keep claiming a backup that no longer exists).
 
 ## The frozen contract
 
@@ -62,8 +68,21 @@ prune_pbs_allowed=true`. First real PBS-targeted backup: **`TASK OK`, 41 minutes
 snapshot**, and it **restored cleanly** (`vzrestore: stopped OK`). Measured incremental cost:
 **+2.7 GB on disk** for a 14.46 GB logical snapshot (~81 % dedup).
 
-demo-hp: v0.102.0 deployed via the documented break-glass path (binary + config backed up first),
+**demo-hp — the box that had ZERO offsite snapshots, ever:** deployed via the documented break-glass
-tier armed, first-ever PBS backup triggered against a verifiably empty namespace.
+path (binary + config backed up first), tier armed, and its **first ever** PBS backup **landed** —
+`felhom-pbs:backup/ct/9201/2026-07-26T15:42:42Z`, **4.25 GB**, into a namespace that was verifiably
+empty beforehand. That is the R-82 finding closed on the box where it was worst.
+
+**R-84 proven live on both boxes** — immediately after a restart, with the in-memory store cold, the
+due-check reports real ages read from the storage instead of "no successful backup recorded yet":
+
+```
+demo-felhom  local age=5298s   felhom-pbs age=14373s   both due:false
+demo-hp      local age=498s    felhom-pbs age=2346s    both due:false
+```
+
+Before v0.103.0 every one of those would have said "no successful backup recorded yet" and triggered
+a redundant backup — on the offsite tier, a multi-hour upload.
 
 ## Tests
 
@@ -85,8 +104,5 @@ arc.
    is never automatically restore-tested — arguably the more important half of "is the DR tier real?".
 2. The agent does not report per-tier **cadences**, so the hub must infer "PBS ⇒ weekly" from storage
    type.
-3. The backup `Store` is still in-memory (**R-84**): every agent restart re-triggers a backup on every
+3. The boot+verify half of the restore round-trip has not run under the fixed code.
-   tier. On the local tier that is wasted minutes; on the offsite tier it is a wasted multi-hour
-   upload after every deploy — which makes R-84 closer to a prerequisite than a tidy-up.
-4. The boot+verify half of the restore round-trip has not run under the fixed code.