R-109 + R-122: the recipe assembly stops dropping sections (hub v0.83.0)

AssembleDRRecipe's hostHalfShape/appHalfShape are ALLOW-LISTS, not the
forward-compat their comment advertised: a section an emitter adds is silently
discarded until it is named in both the shape struct and AssembledRecipe. No
error, no log, no failing test.

R-122 (found this session): that already happened and shipped. The controller
has emitted offsite_restic since fork-4 — the offsite recovery LOCATION — the
hub stored it for all three real customers, and appHalfShape never listed the
key, so no delivered recipe has ever contained it. It stayed green because the
fixture drAppHalf is hand-written and omits the field.

R-109: the agent's new backup_target is a new top-level host-half section and
would have been dropped identically, making the fix read as shipped while
changing nothing an operator can see.

3 tests built on halves read verbatim out of the live dr_recipe table, plus
2 red-proofs (each mutation asserted to have landed). vet rc=0, suite rc=0, 17 ok.

Registers: R-106 + R-109 dispositioned; R-105/R-106 were READY in ROADMAP with
no OPEN-ITEMS row (→ R-123, registered); R-124 filed on the "root" spelling.

hub/internal/store/dr_recipe.go

@@ -79,22 +79,40 @@ type AssembledRecipe struct {
 	PBS           json.RawMessage `json:"pbs,omitempty"`
 	Drives        json.RawMessage `json:"drives,omitempty"`
 	PVEStorage    json.RawMessage `json:"pve_storage,omitempty"`
-	Apps          json.RawMessage `json:"apps,omitempty"`
+	// BackupTarget (R-109) names WHICH storage holds the local whole-guest archives — the agent's
+	// host-half emits it from v0.118.0.
+	BackupTarget json.RawMessage `json:"backup_target,omitempty"`
+	Apps         json.RawMessage `json:"apps,omitempty"`
+	// OffsiteRestic (R-122) is the offsite restic repo's non-secret coordinates — WHERE to recover from.
+	// The controller has emitted it since fork-4 and the hub dropped it for the whole time; see the
+	// allow-list warning on appHalfShape.
+	OffsiteRestic json.RawMessage `json:"offsite_restic,omitempty"`
 }
 
 // hostHalfShape / appHalfShape capture only the top-level keys the assembly stitches; encoding/json
 // drops any unknown top-level key (forward-compat — a newer half with extra sections still parses).
+//
+// THAT FORWARD-COMPAT IS ALSO A TRAP, and it has already cost one shipped section. These two structs are
+// ALLOW-LISTS: a section an emitter adds is silently discarded here until it is named in BOTH the shape
+// struct and AssembledRecipe. `offsite_restic` proved it — the controller emitted it from fork-4, the hub
+// stored it intact for every customer, and the delivered recipe never contained it because nothing here
+// listed the key. Nothing failed; the section simply was not there (R-122).
+//
+// SO: adding a section to either half is a TWO-REPO change. TestAssembleDRRecipe_CarriesEveryEmittedSection
+// pins the current set against captured real halves — extend it in the same commit as any new section.
 type hostHalfShape struct {
 	RecipeVersion int             `json:"recipe_version"`
 	Guests        json.RawMessage `json:"guests"`
 	PBS           json.RawMessage `json:"pbs"`
 	Drives        json.RawMessage `json:"drives"`
 	PVEStorage    json.RawMessage `json:"pve_storage"`
+	BackupTarget  json.RawMessage `json:"backup_target"`
 }
 type appHalfShape struct {
 	RecipeVersion int             `json:"recipe_version"`
 	Customer      json.RawMessage `json:"customer"`
 	Apps          json.RawMessage `json:"apps"`
+	OffsiteRestic json.RawMessage `json:"offsite_restic"`
 }
 
 // AssembleDRRecipe stitches the two stored halves into one operator-facing recipe. Either half may be
@@ -112,6 +130,7 @@ func AssembleDRRecipe(rec *DRRecipe) (AssembledRecipe, error) {
 			return out, err
 		}
 		out.Guests, out.PBS, out.Drives, out.PVEStorage = h.Guests, h.PBS, h.Drives, h.PVEStorage
+		out.BackupTarget = h.BackupTarget
 		if h.RecipeVersion > out.RecipeVersion {
 			out.RecipeVersion = h.RecipeVersion
 		}
@@ -122,6 +141,7 @@ func AssembleDRRecipe(rec *DRRecipe) (AssembledRecipe, error) {
 			return out, err
 		}
 		out.Customer, out.Apps = a.Customer, a.Apps
+		out.OffsiteRestic = a.OffsiteRestic
 		if a.RecipeVersion > out.RecipeVersion {
 			out.RecipeVersion = a.RecipeVersion
 		}