docs: R-94 closed, R-29 leg (a) closed + leg (b) half, R-168 minted

hub/CHANGELOG v0.87.0 + scripts/CHANGELOG gate-enforcement entry. CONTEXT gains S-6 (the
hub renders no host-install version and the gate pins its absence) and S-7 (gates run from
one entry point per repo; reuse_refs_check was fixed rather than the REUSE.md convention,
with both rejected alternatives recorded).

OPEN-ITEMS: R-94 CLOSED all three legs, leg (a) by DELETION with its reason; R-29 leg (a)
CLOSED and leg (b) HALF-SHIPPED with the census result written into the row (13 gates; every
gate a CLAUDE.md names was green, two of the four unnamed were red); R-161 gains its
successor pointer. NEW R-168 (grep established R-167 was the highest in use): Gitea Actions
runner — measured 2026-08-02 as Gitea 1.26.2, Actions enabled on all four repos, 0 runners,
0 workflow runs, 0 branch protections, and the consequence that trunk-based direct-to-main
pushes leave no merge for a status check to gate, so CI here can detect but not block.
BLOCKED on a spike over host-mode vs privileged DinD on DooPlex and whether the workflow can
avoid JavaScript actions.

ROADMAP: R-94 collapsed to its one-liner, R-29 updated, R-168 added.

CONTEXT.md

@@ -17,6 +17,47 @@
 
 ## Standing rulings
 
+**S-6 — the hub renders no host-install version, and the gate pins its absence (2026-08-02, R-94).**
+The Setup tab's *"host-install 1.19.0"* label is **deleted, not derived**. Deriving it is not
+achievable honestly: the Option-1 command downloads `felhom-host-install.sh` from the website **at
+run time**, and the website git-syncs `main` every 30 seconds (R-110) — so the hub cannot know which
+version a given box will run, at build time or at render time, and any literal there is a guess
+wearing a version number's authority. The real one drifted to 1.19.0-vs-1.22.0 and stayed wrong for
+nineteen days. `hostInstallVersion`, `pageData.ScriptVersion` and the rendered label are gone; a NOTE
+sits where the const was so it is not helpfully re-added, and `scripts/hostinstall_gates.py` gate 1
+**inverted** — it now asserts the hub carries no host-install version literal in any of six code
+shapes across every `.go`/`.html` under `hub/`. Corollary that generalises past this row: the
+tautological `render_test.go` assertion (`html contains hostInstallVersion`, where the same constant
+put it there) **passed at `9.9.9`** — an assertion that compares a value to itself tests the
+plumbing, never the claim.
+
+**S-7 — gates run from ONE entry point per repo, and `reuse_refs_check` was fixed rather than the
+convention it polices (2026-08-02, R-29).** Two rulings from the same census.
+
+*Where gates run.* Thirteen gate scripts exist across the four repos. Measured 2026-08-02: **every
+check a `CLAUDE.md` tells a person to run was passing, and two of the four nobody is told to run were
+failing** — one since 14 July. The correlation was exact, so the fix is not more gates but one place
+to run them from: `scripts/repo_gates.py`, `felhom-controller/controller/scripts/controller_gates.py`,
+`felhom-agent/scripts/agent_gates.py`, `app-catalog-felhom.eu/scripts/catalog_gates.py` — each
+mandated in its `CLAUDE.md`, each wired to `.githooks/pre-push` with `--fast`. The canonical shape is
+`catalog_gates.py` (R-161), **not** `site_gates.py`, which is a gate (eight assertions in one file)
+and not a runner; copying it produces another monolith nobody invokes. **A missing gate script is a
+FAILURE with the path printed, never a skip.** The hook's limits are real and are written into the
+hook: per-clone (`core.hooksPath` is local config) and `--no-verify`-able on purpose. The
+unbypassable half is CI → **R-168**.
+
+*Why the checker moved and the docs did not.* `reuse_refs_check.py` was RED on all four repos with
+13 findings, of which a hand audit found **zero** genuine drift — twelve were package shorthand
+(`appbackup/userdata.go` → `controller/internal/appbackup/userdata.go`) and one, `wgsync/reconciler.go`,
+is cited by the controller and lives in the hub. `REUSE.md` cites by package shorthand and across
+repos deliberately; that convention is the useful one. **Rejected, so they are not revisited:**
+rewriting all four `REUSE.md` files to full paths (makes the docs worse to serve the tool), and
+deleting the checker (drift across four repos is a live risk). The checker now resolves
+exact → suffix → ambiguous → sibling repo → FAIL, **prints every non-exact hit and a per-rule tally**
+(because "0 failures" alone cannot tell a working checker from a blind one), and lists every
+resolution attempted on a failure. It stays in **one** place and is invoked across the workspace —
+never copied, which would recreate the drift it detects.
+
 **S-1 — N.5 gains a third leg: architecture docs are same-session coupled (2026-07-26, R-81).**
 Any task that changes an **architectural contract** — tiers, targets, cadences, trust boundaries —
 updates the owning `documentation/architecture/*.md` in the **same session**, under exactly the same