due-checks gate (R-341), floor raise recorded (R-343), snapshot coverage (R-342)

PART 1+2 — dated checks stop being wishes. R-341 booked two measurements as
prose in a register row; nothing read those dates and nothing would have
objected when they passed. The dates now live in a DUE-CHECKS block INSIDE
OPEN-ITEMS.md (inside, so no sidecar can drift from it) and a new gate reads
them. Registered as #10 in repo_gates.py, --fast, so it runs in BOTH the
pre-push hook and CI.

  exit 0  nothing due (prints pending count + nearest date; empty block too)
  exit 1  a row is due/overdue (due <= today, UTC -- due TODAY counts), or a
          row names an item with no R-row
  exit 2  block absent/duplicated/unparseable -- INCONCLUSIVE, never 0

It REFUSES rather than warns, and its docstring states the limitation: it is
NOT a scheduler, it fires on the next push, not on the date.

37 tests. BOTH red-proofs run and reverted -- and the first one earned its
keep by catching a hollow assertion of MINE rather than confirming the gate:
flipping <= to < left a due-today row in neither bucket, min() raised on an
empty list, and the TRACEBACK exited 1, so "rc == 1" passed while the
boundary was wrong. An exit code cannot tell a verdict from a crash. The test
now asserts the conviction banner and the absence of a traceback, and the gate
returns 2 rather than crashing if that partition breaks again.

PART 3 — the floor raise, and the premise was WRONG. Read back from the store
(not the form): min_controller_version = 0.216.0 @ 12:36:58Z, zero
per-customer overrides, no "managed floor HELD" line. But read 5 shows the
raise was NOT a no-op: demo-felhom had been on 0.214.0 since 12 Aug and
auto-updated 0.214.0 -> 0.216.0 at 12:37:07Z -- NINE SECONDS after the save,
exactly the immediate action publish-train rule 2 documents. No error events
followed; it restarted clean.

R-343 is therefore filed OPEN, not CLOSED: the closing condition was all five
reads clean and no directive served. It went well, but a record calling it
inert when it moved a customer box is what misleads the next reader. The row
also states why the floor was behind -- rule 2 policy, not drift, earned by
the 2026-07-11 skew onto Peti's box -- and cites ResolveManagedFloor
(store.go:2068) plus the two build-felhom-iso.sh facts (build-time at :267,
fails open at :78-82) rather than asserting them.

Two boxes are below the floor and neither reports: drill-r50 (blocked,
powered off) and peti-felhom (host row deleted). peti-felhom was NOT
contacted -- its row records that a report from a deleted host 401s and is
not persisted, so the raise cannot reach it.

PART 4 — R-342 filed READY, quoting stop2-snapshot.txt verbatim: Hetzner
server snapshot 421440873 covers /dev/sda only; /mnt/pbs-datastore is a
separate Volume that snapshots exclude, so a rollback restores software state
and NOT the datastore. Fine for that upgrade; the safeguard for any future
procedure that could touch the datastore does not exist and is Viktor's call.

Also: CLAUDE.md's gate list named 6 of 10 registered gates -- completed
rather than appending a 7th to a wrong list (124 -> 128 effective, ceiling
200). Capability map deliberately unchanged; no row cites a floor or golden
version. repo_gates.py fully green, 10/10.

scripts/CHANGELOG.md

@@ -1,3 +1,36 @@
+## due_checks_gate.py v1.0.0 — a dated check becomes a thing that bites (2026-08-18, R-341)
+
+**New gate, registered as #10 in `repo_gates.py` (`--fast`).** R-341 booked two dated measurements —
++24 h and +7 d — as a sentence inside a register row. Nothing read those dates, and nothing would
+have objected when they passed. That is the same shape as R-242 (a rule filed without a mechanism,
+which recurred the next day) and as the R-29 census, where the checks nobody was told to run were the
+ones failing for weeks.
+
+**The dates now live in a `DUE-CHECKS` block INSIDE `documentation/backlog/OPEN-ITEMS.md`** — inside,
+so there is no sidecar to drift from the register. The block is an index; the command and the
+preconditions stay in the R-row.
+
+**Exit-code semantics** (the runner's 0/1/2 taxonomy):
+
+| exit | when |
+|---|---|
+| **0** | nothing due — prints the pending count and the nearest date, because a passing run that says nothing teaches nobody what it watched. A well-formed EMPTY block is also 0, with its own message |
+| **1** | a row is due or overdue (`due <= today`, UTC — **due today counts as due**), or a row names an item with no `\| **R-xxx** \|` row in the register |
+| **2** | the block is absent, duplicated, or a row does not parse — INCONCLUSIVE, naming the exact line. **Never 0**: a gate that finds nothing to check and reports success is the inert-seam failure |
+
+**It REFUSES rather than warns**, deliberately — a warning is what gets scrolled past.
+
+**THE LIMITATION, stated in the docstring so it cannot be forgotten: this is NOT a scheduler.** It
+fires on the next push, not on the date. A real scheduler was deliberately not built; the mitigation
+is that CI runs the same entry point on every push and e-mails the operator on failure.
+
+Tests: `scripts/test_due_checks_gate.py`, 37 assertions. Two companion red-proofs were run and
+reverted. **The first one found a hollow assertion in this suite rather than confirming it:** flipping
+the boundary `<=` to `<` left the due-today row in neither bucket, `min()` raised on an empty list,
+and the traceback exited 1 — so the exit-code check passed while the boundary was wrong. The test now
+asserts the conviction banner and the absence of a traceback, and the gate returns 2 instead of
+crashing if that partition is ever broken again.
+
 ## felhom-host-install.sh v1.28.0 — the removal genuinely reverses the installation (2026-08-13, R-316)
 
 **v1.27.0's fix worked exactly once per machine, and this is the measurement.** Three full cycles on