docs: R-165 merge built and proven at the bake; R-163 + R-175 closed, R-178 filed

07-backup-architecture.md gains §7.5.1 (S-1: the contract changed in the same
session): the ceiling §7.5 describes no longer exists for a box built from
golden >= 0.192.0, the bulkhead's replacement is recorded, and R-175 is FIXED
here rather than left standing — the bound is restated as a function of mp1
and scoped to split-layout boxes, naming all three real shapes.

Capability map: new row as IMPLEMENTED, deliberately NOT proven-live, with
the missing leg named — no box has been reinstalled from the golden, and
"the golden baked" is not "a box built from it works".

R-163 CLOSED: the ceiling it recorded stops existing. R-176(a) answered by
P1; (b) WITHDRAWN, since every node is reinstalled rather than migrated.
R-178 filed for the reinstalls, which were not done this session.

CONTEXT S-13 (the variant chosen on measurement; pruning rejected with its
reason) and S-14 (prove first, then vouch — the golden is published but
deliberately unvouched, because vouching is what makes a fresh install pick
up a layout no box has been proven from).

STATUS: plain-language section; both operator questions now answered, so the
waiting-on-you item is cleared. Two older entries trimmed so the page did
not grow.

documentation/architecture/07-backup-architecture.md

@@ -545,11 +545,38 @@ decision D-c; controller v0.191.x + hub v0.89.0).** The last sentence of this se
   **operator-tier** (`notify.operatorOnlyEvents`) and deliberately not `backup_failed`: a customer can
   take no action on a capture failure.
 
-**A caveat this section must carry, because the bound below depends on it.** The `mp0 50G / mp1 20G`
-table above is **demo-hp's** shape, not the fleet's — demo-felhom ships `mp0 200G / mp1 50G`, where
-the same bound is ≈ 49 GB / ≈ 24 GB, and the golden's own defaults are `16 G / 8 G` before provision
-grows them. **The bound below is a FUNCTION of `mp1`, not a constant.** Measured 2026-08-02,
-`audits/SPIKE-r165-mp1-merge-2026-08-02.md` M1; correcting the numbers throughout is **R-175**.
+### 7.5.1 — THE CEILING THIS SECTION DESCRIBES HAS BEEN REMOVED (2026-08-03, R-165 / decision D-a)
+
+**Everything above describes the SPLIT layout, which is now the legacy shape.** A golden built by
+`build-golden.sh` **v3.0.0** ships **one** data volume; `mp1` does not exist. Both consumer paths are
+binds of subdirectories of it (variant **V-c**):
+
+```
+mp0 -> /var/lib/felhom      ├─ docker/    --bind--> /var/lib/docker
+                            └─ sys_drive/ --bind--> /mnt/sys_drive
+```
+
+**So the size bound below no longer applies to a box built from that golden.** A driveless app's
+recovery unit is limited by the box's actual free space, not by a partition set at build time. The
+mismatch table above (`mp0` 50 G vs `mp1` 20 G) describes what a merged box no longer has.
+
+**R-175, fixed here rather than left standing.** The bound below was stated as the fleet's and was
+**one box's**: it is derived from `mp1 = 20 G`, which is demo-hp exactly and never was demo-felhom
+(`mp0 200G / mp1 50G`, where the same arithmetic gives ≈ 49 GB / ≈ 24 GB), nor the golden (`16 G / 8 G`
+before provision grew them). **Read it as a function of `mp1`, and only for a box still on the split
+layout.** Measured: `audits/SPIKE-r165-mp1-merge-2026-08-02.md` M1.
+
+**What replaced the partition's second job.** `mp1` was also a BULKHEAD: an overflow was refused per
+app with the last good unit byte-identical, and it **could not reach `/var/lib/docker`**, because that
+was a different filesystem. On a merged box it can. Decision **B2**, shipped in controller
+**v0.192.0**, is that bulkhead made deliberate — a two-term capture floor (97% used or 1 GiB free) in
+`internal/fillwatch`'s shape, sitting beyond its critical band so the customer is always warned first.
+It **refuses per app and never deletes**: nothing on this filesystem is generational, so pruning could
+only destroy a different app's only local copy.
+
+**Status caveat, deliberately explicit:** as of 2026-08-03 **no box has been reinstalled from the
+merged golden** (R-178), so every box in the field is still on the split layout and everything above
+still describes them exactly. This subsection describes what a box built from golden ≥ 0.192.0 gets.
 
 Two things are deliberately **not** recorded here. **The sizing ratio is the operator's ruling**
 (**R-163**) — this section states the constraint, not a number. And **the same-device placement is