v0.185.0 — E-2 Parts 3+4: the offer, and the honest degraded state

The half that makes the rest work: a degraded backup target recorded only in
config is the silent-degradation pattern this arc has spent a week removing.

Part 3 -- POST /api/backup-target/assign moves the target via the agent's
POST /backup/target. It is the ONLY writer of the role: registration does not set
it, the drive-gate does not, no scheduler does. Declining is not calling it. The
agent returns restart_required rather than restarting itself, because restarting
with a backup in flight records a spurious tier failure for a backup that
actually succeeded (E-1 did exactly that).

Part 4 -- GET /api/backup-target returns the state and, when degraded, Hungarian
copy in FACT -> CONSEQUENCE -> REMEDY order, pinned by a test: a customer told
only the fact cannot act on it.

Healthy renders NOTHING -- no badge, no reassurance, no tonal change.
degradedMessageFor is the single decision point, so exactly one place could start
decorating a working box. Red-proofed: reassuring on the healthy branch fails
Scenario E.

UNKNOWN is not degraded: an unreachable or pre-R-82 agent means we could not ask,
which is not evidence of degradation (R-88 Part 2's class).

A HOLLOW TEST caught by its own red-proof: TestUnknownStateRendersNothing used
{Known:false} with Degraded left false, so it passed even with the !Known guard
deleted -- the second condition covered for it. Now {Known:false, Degraded:true},
which fails properly. Without the red-proof the test would have been decoration.

State is derived from the AGENT, never from our intent flag: on the two boxes
migrated by hand in E-1 the intent was never recorded while the drive really is
the target.

MinAgent: 0.113.0
Green gate: build + vet + test rc=0 (27 packages), run separately from this commit.

CHANGELOG.md

@@ -1,5 +1,43 @@
 ## Changelog
 
+### v0.185.0 — E-2 Parts 3+4: the offer, and the honest degraded state (2026-07-29) — MinAgent 0.113.0
+
+The half that makes the rest work. A degraded backup target recorded only in config is the
+silent-degradation pattern this arc has spent a week removing.
+
+**Part 3 — the offer.** `POST /api/backup-target/assign` moves the target via the agent's
+`POST /backup/target`. It is the **only** writer of the role: registration does not set it, the
+drive-gate does not, no scheduler does. Declining is simply not calling it.
+
+The agent returns `restart_required` rather than restarting itself, and the reason is E-1's own
+mistake: restarting with a backup in flight cancels the wait and records a spurious tier failure for
+a backup that actually succeeded. The restart belongs to whoever can re-check in-flight work
+immediately beforehand.
+
+**Part 4 — visibility.** `GET /api/backup-target` returns the state and, when degraded, the
+Hungarian copy:
+
+> „A rendszermentés jelenleg ugyanazon a lemezen van, mint a rendszer — így hibás fájlok ellen véd,
+> lemezhiba ellen nem. Csatlakoztass egy második meghajtót a teljes védelemhez."
+
+FACT → CONSEQUENCE → REMEDY, pinned by a test: a customer told only the fact cannot act on it.
+
+**Healthy renders NOTHING** — no badge, no reassurance, no tonal change. `degradedMessageFor` is the
+single decision point so there is exactly one place that could start decorating a working box.
+Red-proofed: adding „A rendszermentés védett…" to the healthy branch fails Scenario E.
+
+**UNKNOWN is not degraded.** An unreachable or pre-R-82 agent means we could not ask, which is not
+evidence of degradation — the absence-read-as-a-value mistake R-88 Part 2 closed.
+
+**A hollow test caught by its own red-proof.** `TestUnknownStateRendersNothing` originally used
+`{Known:false}` with `Degraded` left false, so it passed even with the `!Known` guard deleted — the
+second condition covered for it. The fixture is now `{Known:false, Degraded:true}`, which fails
+properly when the guard goes. The red-proof is what exposed it; without it the test would have been
+decoration.
+
+State is derived from the AGENT, never from our own intent flag: on the two boxes migrated by hand
+in E-1 the intent was never recorded while the drive really is the target.
+
 ### v0.184.1 — E-2b keying fix: the backup-target branch was unreachable (2026-07-29)
 
 **Caught before deploy by tracing, not by a failure — and the 0.184.0 image is therefore superseded