R-366 slice 2 (decision 168): one operator line when the box's whole-guest archives include another key's (edge-triggered)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -199,6 +199,16 @@ success, and oldest-proven ordering, which is now the tie-break **between due ti
 remains, but only as the **evaluation interval** (6 h by default, chosen from a measured cost: one
 due-check is 18 ms on a local dir storage and 392 ms on the PBS tier over the WAN).
 
+**[FACT, built 2026-10-07 — R-727 + R-366 slice 2, `09` §3 decisions 158 and 168] Archives written with another key.**
+On an encrypted (PBS) tier the pick takes only archives written with THIS box's key (R-727, agent v0.138.0): after a
+reinstall the namespace still holds the earlier install's archives, which this box cannot open. Until 2026-10-07 that
+skip was one INFO log line per archive and nothing else. **Now the host report carries, per tier, the count and the date
+range of such archives** (`foreign_key_archives.tiers`; the stanza is absent until a tier was evaluated since the agent started, `tiers: []`
+when none), and the hub records **one `restore_test_foreign_key_archives` info line per CHANGE of that set** on the operator's
+timeline — not per archive, not per report, never mailed, never the household's. It names the retained escrow count:
+the hub keeps the old key's escrow since hub 0.141.0 (R-366 slice 1). Tests `TestR366_*` (agent `internal/backup`,
+hub `internal/api`).
+
 **The hub's half is not optional.** `restoreProvenStaleAfter` was a flat 7 days derived from the very
 cadence this replaced, and a weekly tier proved weekly reaches a proof age of **exactly** one interval
 just before its next proof — 168 h against a 168 h window. It sat ON the line, so any ordinary delay