R-436 measured on the provider: append-only forced key HOLDS (403 on every delete), but the sub-account password defeats it (R-820); design proposal + ep0 options

Spike, no product change. Venue u629488-sub4 (tester-1, operator ruling); scratch repo removed,
authorized_keys restored byte-identical. Closed R-436 (due-check cleared), R-430. Opened R-820,
R-821, R-822. R-95 and R-342 updated. 07 §D [FACT] block. STATUS: two operator decisions.
Register 326 -> 327.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -1367,6 +1367,19 @@ answered by calling the provider API with the production token. Accept explicitl
 > spike stopped here rather than answering it by acting**, and left it as R-429 — ten minutes in
 > the Storage Box panel, and it re-ranks R-95. `audits/SPIKE-r95-offsite-delete-2026-09-01.md` §Q1.
 
+> **`[FACT]` 2026-10-03 — append-only on the Storage Box, MEASURED (R-436).** On the provider
+> (`u629488-sub4`, scratch repo, since removed), a key pinned in `authorized_keys` to
+> `command="rclone serve restic --stdio --append-only <dir>",restrict` backs up, lists, restores and
+> checks, and every delete is refused: `blob not removed, server response: 403 Forbidden (403)`; the
+> same command through an unpinned key deletes. The pinned key gets no shell, sftp, scp, rsync or port
+> forward. **But the PASSWORD logs in on ports 22 and 23 and can rewrite `authorized_keys`, and a box can
+> obtain that password from the hub's off-site self-heal at will** — so the pin protects nothing until
+> the box stops receiving the password (R-820). Port 22 accepts no OpenSSH-format key; 23 does.
+> Locks: a crash lock blocks `check`, not `backup`; `unlock --remove-all` clears it through the pinned
+> key. An add-only key can still plant future-dated snapshots that make the box's retention policy
+> select every real snapshot (R-822). Who prunes is a PROPOSAL awaiting the operator, not design:
+> `audits/offsite-append-only-2026-10-03/DESIGN.md`; evidence `…/live/`, `…/lab/`.
+
 **E. `local` vzdump shares a physical device with the guest it backs up.** LIVE on both hosts:
 `/var/lib/vz` (the archive target) and `local-lvm` (the guest's rootfs and both `backup=1`
 mountpoints) are both on `/dev/sda3` → VG `pve`. The tier therefore protects against **corruption