docs: R-165 merge built and proven at the bake; R-163 + R-175 closed, R-178 filed

07-backup-architecture.md gains §7.5.1 (S-1: the contract changed in the same
session): the ceiling §7.5 describes no longer exists for a box built from
golden >= 0.192.0, the bulkhead's replacement is recorded, and R-175 is FIXED
here rather than left standing — the bound is restated as a function of mp1
and scoped to split-layout boxes, naming all three real shapes.

Capability map: new row as IMPLEMENTED, deliberately NOT proven-live, with
the missing leg named — no box has been reinstalled from the golden, and
"the golden baked" is not "a box built from it works".

R-163 CLOSED: the ceiling it recorded stops existing. R-176(a) answered by
P1; (b) WITHDRAWN, since every node is reinstalled rather than migrated.
R-178 filed for the reinstalls, which were not done this session.

CONTEXT S-13 (the variant chosen on measurement; pruning rejected with its
reason) and S-14 (prove first, then vouch — the golden is published but
deliberately unvouched, because vouching is what makes a fresh install pick
up a layout no box has been proven from).

STATUS: plain-language section; both operator questions now answered, so the
waiting-on-you item is cleared. Two older entries trimmed so the page did
not grow.

CONTEXT.md

@@ -17,6 +17,35 @@
 
 ## Standing rulings
 
+**S-13 — the `mp1` merge landed, and the variant was chosen on measurement (2026-08-03, R-165 / D-a).**
+The appliance's two data volumes are one. **Variant V-c**: the volume mounts at the NEUTRAL path
+`/var/lib/felhom`, and both `/var/lib/docker` and `/mnt/sys_drive` are binds of subdirectories of it.
+**Three shapes were built and rebooted before choosing** (`audits/SPIKE-r165-phase0-2026-08-03.md`) —
+all three boot, reboot 3/3, give ONE `df` figure and keep a container's `statfs("/")` on the merged
+volume, so **the ordering risk that motivated the probe was not what mattered.** They differ only in
+which documented guarantee they break: volume-at-`/var/lib/docker` puts customer backups inside
+Docker's data-root, so the ordinary "clear `/var/lib/docker`" reflex destroys every local unit;
+volume-at-`/mnt/sys_drive` puts Docker's entire data-root under `/mnt`, which the controller container
+mounts wholesale — **measured: it then sees `/mnt/sys_drive/docker`**, falsifying the bootstrap's own
+comment that `/mnt` holds only Felhom's namespace mounts. **V-c breaks neither**, for one extra path.
+
+**B2 is the bulkhead replacement, and "or prune the oldest" is REJECTED with its reason**, because the
+question will be asked again: nothing on that filesystem is generational — a unit is ONE fixed path per
+app (`backups/primary/<app>`) refreshed in place, and a DB dump is `<stack>-<dbtype>.sql`, also fixed —
+so pruning could only mean deleting a **different** app's only local recovery unit.
+`pruneStalePrimaryDirs` is an ORPHAN sweep with no notion of age and must never be repurposed.
+
+**No migration exists, and that is a ruling not an omission:** every node is REINSTALLED. Both demo
+boxes are Tier 0; the colleague's box carries none of our customer data and is clean-installed shortly.
+So R-176's in-place migration rehearsal is **withdrawn**, not deferred.
+
+**S-14 — prove first, then vouch (2026-08-03).** Golden **0.192.0** is baked, published and verified in
+the registry, and is **deliberately UNVOUCHED**. Vouching is what makes a fresh install pick a golden
+up, so vouching one that no box has been proven from would put an unproven disk layout in front of the
+next install anywhere. The bake script already treats the hub record as a separate deliberate step; this
+makes the ordering a rule. **The remaining work is R-178** — reinstall each demo box from the merged
+golden, prove claim → deploy → back up → restore, **one box at a time**, and only then vouch.
+
 **S-11 — D-c's routing, and why R-158's own proposal was overruled (2026-08-02, R-167 SHIPPED).**
 Decision D-c splits two signals by AUDIENCE, and the split is the ruling: **a fill warning is the
 CUSTOMER's** (they can free space, delete files, add a drive) and **a per-app backup capture failure