docs: R-166 SHIPPED — the desired/in-flight/observed split (D-b)

Controller v0.189.0 implements operator decision D-b. Docs only here; no hub
change and no hub version bump.

- architecture/02-controller-module-map.md §0a — NEW, and it is the S-1 contract:
  desired (app.yaml) / in-flight (own marker file) / observed (not persisted),
  with the rule that ties them — never derive one from another. Absent desired
  state means UNKNOWN, never "running". One file, one writer. D-b's binding
  safety rule quoted verbatim.
- 00-capability-map.md — the boot-recovery row now rests on a recorded signal,
  with the three live flows from 9201. The interrupted-operation half is marked
  IMPLEMENTED, not PROVEN-LIVE: nobody killed the controller mid-backup on metal.
- OPEN-ITEMS/ROADMAP — R-166 SHIPPED with both blocking facts and their answers;
  R-157 mechanism B CLOSED and A restated as the whole item; R-170 NEW (the
  drive-backed boot gate still infers a Stop from a container count).
- STATUS.md — the "an app can stay switched off and nothing says so" line
  rewritten to what is actually left: timing.
- CLAUDE.md — end-of-session checklist gains: confirm your own last push's CI run
  went green, BY RUN ID. The failure email is a push signal; this is the pull check.
- CONTEXT.md S-12 — the rulings, and the two lessons worth carrying: a test that
  constructs the thing it should prove the caller constructs is hollow (its
  red-proof will say so), and a field-by-field struct rebuild in a save path is a
  defect on sight.

STATUS.md

@@ -18,9 +18,13 @@ restore files and app data from the drive alone. Proven end to end on real hardw
 
 ## What's broken
 
-**After a power cut, an app can stay switched off — and nothing says so.** The machine looks for apps
-that didn't come back, but looks too early and never again. In one case it decides the customer
-switched it off deliberately, so it isn't even counted as down. *(R-157)*
+**After a power cut, an app can stay switched off — and the machine may look too early to notice.**
+It now knows the difference between an app the customer switched off and one that simply didn't come
+back: the customer's choice is written down, so an app meant to be running is started again however
+it went missing. What is left is timing — it looks about five seconds after starting, while the
+system is still coming up, and never looks again. *(R-157; the "decided the customer switched it off"
+half is fixed — R-166, 2026-08-02. The same guess still lives in one other place, for apps kept on a
+plug-in drive — R-170.)*
 
 **The off-site copy can be erased by the machine that made it** — the credential that writes it can
 also delete it. A daily snapshot is armed as a stopgap, and we have never restored from that copy.