RECON: what DooPlex's own backup actually protects (R-232) — read-only, nothing changed

Five sets, 14/14 successful runs in 14 days, and a file restored byte-identical from the data repo
-- the first time a restore has ever been demonstrated here.

What the failure matrix exposes: notify_failure is a no-op (NOTIFY_ON_FAILURE=true, webhook
commented out) so a failed backup tells nobody; NOTHING leaves the box (Longhorn's target is
DooPlex itself over NFS, the only outbound-looking cron pulls inbound for another project); the
backup tree is a single writable path with no append-only; two sets are same-disk (.claude-memory
and the postgres dumps, whose source sits inside the backup tree); Longhorn retains 1 generation;
secrets/restic-repo has never held a snapshot because backup-secrets.sh never calls restic; and
/opt/backup/docs/BACKUP-RESTORE.md does not exist though the unit advertises it.

NOT a finding: the restic passphrase. On-box copy is on a different disk from the backups and the
operator holds an offline copy out of band, so disk loss is recoverable. The residual is only that
it is operator-held rather than system-held escrow.

A stale lock in the data repo is MINE, from the previous task's verification. Fenced from clearing
it; recorded with its impact and the one command that fixes it.

CONTEXT.md

@@ -17,6 +17,14 @@
 
 ## Standing rulings
 
+**DooPlex's own backup, surveyed 2026-08-06 (R-232, read-only).** Five sets nightly, 14/14 in 14
+days, single-file restore proven byte-identical. Destination for **every** set is `/dev/sda1`;
+`.claude-memory` and the PostgreSQL dumps are the two same-disk cases. **Nothing leaves the box** —
+Longhorn's target is DooPlex itself over NFS, and the only outbound-looking cron pulls inbound.
+`notify_failure` is a no-op (no webhook), so a failure is silent. The restic passphrase has an
+**offline operator-held copy**, so disk loss is recoverable — it is not system-held escrow, which is
+the only residual. Full survey: `audits/RECON-dooplex-backup-2026-08-06.md`.
+
 **S-37 — A CLAIM IN AN INSTRUCTION FILE IS CHECKED, NOT TRUSTED (2026-08-06, R-229/R-230 close-out).**
 
 1. **The workspace-root `CLAUDE.md` is a SYMLINK** to `documentation/runbooks/workspace-CLAUDE.md`.