RECON: what DooPlex's own backup actually protects (R-232) — read-only, nothing changed

Five sets, 14/14 successful runs in 14 days, and a file restored byte-identical from the data repo
-- the first time a restore has ever been demonstrated here.

What the failure matrix exposes: notify_failure is a no-op (NOTIFY_ON_FAILURE=true, webhook
commented out) so a failed backup tells nobody; NOTHING leaves the box (Longhorn's target is
DooPlex itself over NFS, the only outbound-looking cron pulls inbound for another project); the
backup tree is a single writable path with no append-only; two sets are same-disk (.claude-memory
and the postgres dumps, whose source sits inside the backup tree); Longhorn retains 1 generation;
secrets/restic-repo has never held a snapshot because backup-secrets.sh never calls restic; and
/opt/backup/docs/BACKUP-RESTORE.md does not exist though the unit advertises it.

NOT a finding: the restic passphrase. On-box copy is on a different disk from the backups and the
operator holds an offline copy out of band, so disk loss is recoverable. The residual is only that
it is operator-held rather than system-held escrow.

A stale lock in the data repo is MINE, from the previous task's verification. Fenced from clearing
it; recorded with its impact and the one command that fixes it.

STATUS.md

@@ -91,7 +91,13 @@ failed until someone walks it end to end with no help from us.
   held. It is now included in that machine's nightly backup. **Two things you should know before
   treating that as solved:** the copy lands on the **same physical disk** as the original, so it
   survives a mistake but not a dead drive, and the build machine's backups have **no off-site copy at
-  all**. Also tidied the same day: a quarter of those notes had become unreachable — filed but listed
+  all**. **A full survey of that machine's backup, done the same day, confirmed both and found two
+  more things worth knowing.** The good news first: it has run every night without missing a set, and
+  we pulled a file back out of it and checked it matched the original exactly — the first time that
+  has ever been demonstrated. The rest: **if a backup ever fails, nobody is told** — the alert was
+  configured but never given anywhere to send to — and **every copy it makes stays inside that one
+  box**, so it survives any single disk dying but not the room. Nothing was changed; the survey was
+  read-only and the decisions are yours. Also tidied the same day: a quarter of those notes had become unreachable — filed but listed
   nowhere, so nothing would ever read them — and the instructions the assistant reads at the start of
   every session were cut roughly in half, with a check added so they cannot quietly grow back. Nothing
   was deleted. *(R-229, R-230, R-231)*