v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

R-399: monitoring.integrity.read_data_subset defaults to 100%. A pack damaged
without changing its size made plain `restic check` report "no errors were found"
on demo-hp 2026-08-30; every read-data form caught it. Cost on that 134 MB store:
35.0s structure vs 39.2s at 100%. "off" (any case) is the off token; empty means
not-configured, therefore the default; a malformed value falls back to the DEFAULT,
never to structure. A completed check over 5 minutes logs a WARN naming the
duration, the depth and R-401 — operator log only, no hub event, no depth change.
The depth is now recorded with the verdict (LastIntegrityDepth; empty = NOT
RECORDED, never "structure").

R-400: 24 debug-page references, 17 dispatched, 7 dead — three of which fetched on
page LOAD, so those panels were permanently blank. backup/crossdrive implemented;
backup/infra, hub/infra-push, dr/infra-status, storage/watchdog-status and both
storage/simulate-* deleted with their panels and JavaScript.
scripts/debug_route_gate.py fails in both directions and is registered after the
seven were resolved. 18 referenced, 18 dispatched, none orphaned.

Corrections: the dead-field warning in report/types.go said the controller runs no
integrity check and the notifiers are called from nowhere — both false since
v0.227.0. controller.yaml.example gains its missing integrity: block.
integrityCheckTimeout's "ships OFF" comment rewritten.

controller/scripts/controller_gates.py

@@ -15,7 +15,8 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   5. app-row-dedup      no duplicated app-row markup in the dashboard templates
   6. mojibake           no double-encoded UTF-8 in Hungarian copy
   7. docker-v           every `docker … -v` mount is a named volume or a proven host path
-  8. reuse-refs         every path cited by this repo's REUSE.md still resolves
+  8. debug-routes       every debug-page control resolves to a handler, and back (R-400)
+  9. reuse-refs         every path cited by this repo's REUSE.md still resolves
 
 WHY THIS FILE EXISTS (2026-08-02, closing R-29 leg (a) and half of leg (b)).
 
@@ -62,6 +63,10 @@ GATES = [
     ("docker-v",       os.path.join(SCRIPTS, "docker_run_volume_path_gate.py"), [],       True),
     ("secret-markup",  os.path.join(SCRIPTS, "secret_in_markup_gate.py"),       [],       True),
     ("retrieval-promise", os.path.join(SCRIPTS, "retrieval_promise_gate.py"),   [],       True),
+    # R-400 — every debug-page control resolves to a handler, and every handler is reachable.
+    # Registered AFTER the seven dead controls were implemented or deleted: a registered-but-failing
+    # gate refuses every push, so the order matters here exactly as it did for instructions_gate.
+    ("debug-routes",   os.path.join(SCRIPTS, "debug_route_gate.py"),            [],       True),
     ("reuse-refs",     SHARED_REUSE,                                            [REPO],   True),
     ("instructions",   SHARED_INSTRUCTIONS,                                     [REPO],   True),
     # R-389 — a REPORT.md observation with no register row behind it. Fast: stdlib file reads.