hub v0.91.1 — observation may only WIDEN a tier's window, never tighten it (R-86)

Found by checking v0.91.0 against the live box, not by review. demo-felhom's two
retained PBS snapshots sit 8h54m apart (one is a healing artefact), so the
mean-gap estimator reads a WEEKLY tier as nine-hourly: x4 = 36h, the 7-day floor
lifts it to 168h, and a weekly tier proved weekly reaches ~8.25d of proof age.
The false alarm this task exists to prevent would have returned within a week, on
the box it had just shipped to.

restoreProvenWindow now takes max(observed, declared). A gap SHORTER than the
declared rhythm is routine and means nothing (a retry, a manual run, a heal, a
catch-up); a gap LONGER than it is real information. Cost stated: a tier running
faster than its declared rhythm gets a slower stale signal — the right direction
for a signal that means 'unverified', since 'broken now' is a different event.

hub/CHANGELOG.md

@@ -1,3 +1,27 @@
+## v0.91.1 — observation may only WIDEN a tier's window, never tighten it (2026-08-03, R-86 Part 2)
+
+**Found by checking v0.91.0 against the live box before trusting it, not by review.** demo-felhom's
+offsite tier holds two retained snapshots — `2026-07-27T19:55:41Z` and `2026-07-28T04:49:43Z` —
+**8 h 54 m apart**, because one is a healing artefact and the other a real weekly run. The mean-gap
+estimator therefore reads a **weekly** tier as nine-hourly: ×4 gives 36 h, the 7-day floor lifts it to
+168 h, and a weekly tier proved weekly reaches ~8.25 days of proof age. **The false alarm this whole
+task exists to prevent would have returned within a week, on the box it had just shipped to.**
+
+`restoreProvenWindow` now takes `max(observed, declared)`. Observation refines a tier's rhythm
+**upward** and is ignored downward, which is right on its own terms and not merely cautious: a gap
+SHORTER than the declared rhythm is routine and means nothing — a retry, a manual run, a heal, a
+catch-up after an outage — while a gap LONGER than it is real information, saying this tier genuinely
+receives archives less often than the model assumes and its window must widen or it alarms.
+
+**The cost, stated rather than hidden:** a tier that truly runs faster than its declared rhythm gets a
+wider window than it strictly needs, i.e. a slower `restore_test_stale` signal. That is the right
+direction for a signal whose message is *"unverified"*. *"Broken now"* is `restore_test_failed`, which
+is immediate and untouched.
+
+Three live-derived cases added to `TestRestoreProvenWindow_Contract`, including the exact 8 h 54 m
+gap measured on the box; red-proved by restoring the tighten-too branch
+(`window(pbs, observed=8h54m) = 168h, want 288h`).
+
 ## v0.91.0 — a tier's staleness window learns the tier's own rhythm (2026-08-03, R-86 Part 2)
 
 **This ships WITH the agent's v0.121.0, not after it.** The agent now proves a tier once per ARCHIVE