R-385: make an UNRECORDED golden fail the currency gate; file R-386; own the alarm ladder

The gate failed only on `released > baked`, so it could catch a forgotten bake
and nothing else. A golden AHEAD of the record passed silently - and that is
how controller 0.221.1 was built, baked AND vouched while the newest CHANGELOG
heading still read v0.221.0, with every gate green. Reproduced on the real
history: newest released 0.221.0 / newest golden baked 0.221.1 -> exit 0.

The gate now asks whether the version being shipped is WRITTEN DOWN: the baked
version must have its own `## vX.Y.Z` heading anywhere in the CHANGELOG.
Membership rather than `baked > released` deliberately - a comparison against
the newest heading alone goes green the moment any later entry is written,
leaving the unrecorded version permanently unrecorded. INCONCLUSIVE (exit 2)
preserved; every refusal names a reason and a route.

Red-proofed both directions: old gate/old record exit 0, new gate/old record
exit 1, new gate/fixed record exit 0, absent clone exit 2, post-bake exit 0.

08-alarm-ladder.md is new, and its absence was itself the finding: no document
owned "when does a broken app raise an alarm?". The rules lived as comments in
four packages, each locally correct, with the ordering between them legible only
by reading one function top to bottom - which is how R-384 survived review.

R-383 and R-384 closed into CLOSED-ITEMS with their rules kept. R-385 filed
closed. R-386 filed OPEN: a single-container app stopped out of band raises no
alarm, and a comment claims the opposite - measured live, 9 scans, 0 events,
against a positive control from the same box 17 minutes earlier. Not fixed here.

Golden 0.222.0 baked and published; vouching is the operator's act.

STATUS.md

@@ -1,7 +1,7 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-08-22 — the off-site restore now works for all 53 apps, not 13. It is released and
-NOT yet delivered: two steps below are yours.**
+**Updated 2026-08-23 — an app whose database dies now raises an alarm. It did not before, and the
+watcher said "nothing is down" the whole time. Released and NOT yet delivered: step 1 is yours.**
 
 > **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
 > part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
@@ -12,14 +12,26 @@ NOT yet delivered: two steps below are yours.**
 *This section is allowed to be longer than one screen, and each item says what happens if you do
 nothing.*
 
-1. **Vouch the golden carrying controller 0.221.1** — Hub → Configuration → Day-0 artifacts.
+1. **Vouch the golden carrying controller 0.222.0** — Hub → Configuration → Day-0 artifacts.
    **It is already baked, published and round-trip verified**
-   (`documentation/tests/golden-0.221.1-2026-08-23/`); only the vouch is left, and only you can do it.
-   **It is a THREE-field save:** `golden_version` → **0.221.1**, `agent_version` → **0.130.0**,
-   `min_agent` → **0.129.0**. **Then** raise the floor to **0.221.1**, last, in its own save.
-   **If you do nothing:** the fleet stays on 0.219.0, so a failed database restore still leaves an app
-   broken with an unusable copy — the thing today's release fixes reaches nobody. New machines still
-   receive 0.219.0. The build system stays red about it and will mail you on every push.
+   (`documentation/tests/golden-0.222.0-2026-08-23/`); only the vouch is left, and only you can do it.
+   **It is a THREE-field save:** `golden_version` → **0.222.0**, `agent_version` → **0.130.0**,
+   `min_agent` → **0.129.0**. **Then** raise the floor to **0.222.0**, last, in its own save.
+   **If you do nothing:** the fleet stays on 0.221.1, where an app whose database has died reports
+   nothing at all — no banner, no event — and the watcher keeps printing "0 currently down". New
+   machines still receive 0.221.1.
+   *(Thank you — the 0.221.1 vouch from earlier today has landed; the hub reads golden 0.221.1 and
+   floor 0.221.1. Nothing is owed on that one.)*
+
+2. **An app that is stopped from outside still reports nothing** (R-386) — and this one I found today
+   and deliberately did **not** fix. If a single-container app is stopped by hand on the machine
+   rather than through the product, nothing is said: no banner, no e-mail, no operator event. I
+   measured it: nine checks ran over four minutes and every one stayed silent. A comment in our own
+   code claims the opposite, which is why nobody noticed. **The reason I stopped rather than fixed it:**
+   from the outside this looks exactly like a customer pressing Stop, and the obvious fix would start
+   alarming every time somebody legitimately stops their own app. That trade is a decision, not a
+   patch. **If you do nothing:** it stays as it is — this is not a new fault, it has always been so;
+   it is newly *known*.
 3. **Whether to change the hub password** (R-350). I printed it into my own session log on 20 August.
    Not in git, not in any saved file — in the log on this machine. **If you do nothing:** it stays as
    it is, at the risk you accept by leaving it. I can change it without ever showing you the new one.