docs: R-43 + R-44 shipped in controller v0.148.0 (live acceptance still pending)

ROADMAP R-43/R-44 → SHIPPED with what actually landed:
  - R-43: ReconstituteFromOffsite — safety dump → stop → files overwritten to
    the snapshot version → start → the snapshot's own dump replayed from the
    SCRATCH unit (the live unit is still never overwritten). Invariants:
    nothing is ever deleted, and the undo is verified on disk before the act.
  - R-44: every run, manual AND nightly, refreshes dumps + units BEFORE the
    capture, so each snapshot is a coherent {DB@T, files@T} pair stamped with
    offsite_run_id + dumps_at. Nightly ordering is now structural rather than a
    coincidence of two scheduler entries at 02:30 and 04:15.

DIAG doc gains a "fixed in v0.148.0" header pointing at both.

Capability map deliberately NOT flipped: the DB half now exists but is PARTIAL,
not PROVEN-LIVE — shipped and deployed with no live acceptance behind it. The
customer-restore row stays MISSING, now blocked only on the evidence run rather
than on missing capability, and R-3 stays DRAFT.

Still open: the 00-capability-map.md:61 ruling — did CAMPAIGN-6D's "immich
end-to-end from offsite alone" exercise the DB half, or only the file half?

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P9Nn14TWGzKoqAJAiVwC2s

REPORT-diag-immich-restore.md

@@ -6,6 +6,13 @@
 
 **Date:** 2026-07-19 · **Box:** demo-felhom (felhom-pve guest 9201), controller 0.146.0, immich v3.0.3
 
+> **CLOSED IN CODE 2026-07-19 — controller v0.148.0.** Findings 1 and 2 shipped as R-43 (offsite
+> reconstitution: safety dump → stop → overwrite files → start → replay the snapshot's dump) and
+> R-44 (every run dumps before it captures; manifests carry `offsite_run_id` + `dumps_at`). Deployed
+> to demo 9201, healthy. **The §9 live acceptance has NOT run**, so no capability-map flip: the
+> offsite row is PARTIAL, the customer-restore row stays MISSING, R-3 stays DRAFT. Implementation
+> detail lives in `felhom-controller/REPORT.md`.
+
 ## What ran
 
 A diagnosis of "immich offsite restore succeeds but photos do not reappear". No product code was