docs: R-189, R-188 and R-186 closed (agent v0.122.0); R-185 stays open

- OPEN-ITEMS: all three rows closed with their measurements. R-189 records the
  migration consequence seen live (a pre-R-189 record has no tier and is not
  reportable, so upgrading does not retroactively make an old proof visible).
  R-188 records both directions demonstrated and the fixture cleaned up. R-186
  carries the before/after sha values including the CGO_ENABLED discrepancy.
  The priority list states explicitly that R-185 is the one left open from that
  group and that this session did not touch it.
- capability map: the restore-proof row now says the evidence path itself had a
  gap — the proof reached the hub only because no restart intervened — and what
  closed it.
- CONTEXT: S-19 (a proof is durable and reportable, a failure is neither, and
  why) and S-20 (the release ordering, what each step protects, and how a binary
  is verified).
- STATUS: rewritten for the operator, back to one screen.

STATUS.md

@@ -29,6 +29,16 @@ Proven end to end on real hardware.
 
 ## What shipped recently
 
+- **Three ways the alarm system was misreporting its own work — all fixed.** None of them ever risked
+  data. **(1)** When the machine proved a backup restores, that result could vanish if the agent was
+  restarted in the following quarter-hour — and yesterday's change made the gap a week rather than a
+  day, because the machine correctly refuses to re-prove an archive it has already proven. It is now
+  written to disk with the result and survives. This was caught happening, not predicted: a real
+  14.5 GB off-site restore passed and left no record at all. **(2)** Every release had about a
+  fifty-fifty chance of emailing you a failure for a release that worked; the version tag is now
+  published after the binary, and a new check catches the opposite mistake so nothing is traded away.
+  **(3)** A released binary can now be rebuilt by anyone and checked against the fingerprint you
+  approve — until today, rebuilding produced different bytes. *(R-189, R-188, R-186)*
 - **Each backup is now proved, instead of the clock being obeyed.** The machine used to re-test a
   backup every twenty-four hours on a timer that restarted whenever the software was updated, so the
   test happened at an arbitrary time and a fresh backup could sit unproven while an old one was
@@ -37,19 +47,10 @@ Proven end to end on real hardware.
   The alert that says "this copy has not been proved lately" learned each copy's own rhythm in the
   same change; without that it would have started complaining every night about a system that is
   working. *(R-86)*
-- **A failed backup now tells you about every app, once.** When several apps fail in one night you get
-  **one** email listing all of them, what kind of backup failed for each, why, and how much space is
-  left — instead of an email about one app and silence about the rest. Measured before the fix: nine
-  failures, two emails. Separately, **every failure is now written down the moment it happens**,
-  whether or not it is emailed, and **a message the machine decides not to send now leaves a record
-  saying so**. A machine choosing not to tell you and nothing happening no longer look identical.
-  A run that finds nothing wrong stays silent, and a backup you trigger yourself always reports.
+- **A failed backup now tells you about every app, once**, with every failure written down whether or
+  not it is emailed, and a message the machine decides not to send now leaves a record saying so.
   *(R-182)*
-- **Publishing became something you do, not something that happens.** The installer that runs as root
-  on a new machine, and the agent, both moved onto labelled versions with a way back; a check now
-  refuses a release nobody can download. *(R-110, R-115)*
-- **The reserve now guards the step that fills the disk, and its promise is true.** It decides once
-  per app, before writing anything, and no longer waves an app through at 96% full. *(R-181)*
+
 
 ## What we're working on
 
@@ -71,15 +72,12 @@ Proven end to end on real hardware.
 
 ## Changed since last update
 
+- **2026-08-03** — Fixed three ways the alarm system misreported itself: a proof of a working backup
+  that could vanish on a restart (seen happening), a release that emailed a failure for a release
+  that worked, and a released binary nobody could rebuild and check. *(R-189, R-188, R-186)*
 - **2026-08-03** — Backups are now proved one at a time, each about a day after it is made, instead of
   on a timer; the "not proved lately" alert learned each copy's own rhythm so it does not complain
   about a healthy weekly copy. You settled that the off-site endpoint is protected, and the machine
   list records it. One thing found while testing: on the small demo machine the agent cannot see its
   own local backups at all — a permission that was never granted — so that copy has never been
   test-restored there. Written down, not yet fixed. *(R-86, R-185)*
-- **2026-08-03** — A failed backup now reports every app in one email, and nothing is dropped without
-  a record. You rescaled the off-site endpoint to twice the memory, which closed one item and
-  unblocked another; the documents describing the old machine were corrected, and the audit records
-  of what it used to be were annotated rather than rewritten.
-- **2026-08-03** — Publishing became deliberate for both the installer and the agent, with a way back
-  and a check that a release can actually be downloaded.