R-82 Slice D/E: installer default 1.20.0 + architecture docs brought current

Slice D.1 — host-install 1.20.0: a FRESH box defaults to local-daily +
offsite-weekly (felhom-pbs, 604800s, keep_last=2). setdefault semantics proven
both ways: fresh gets the tier, an UPGRADE preserves the existing backup block
verbatim — so an in-place upgrade can never silently start writing to an
offsite datastore. Existing boxes are migrated explicitly.

Slice E:
- 07-backup-architecture.md: honest status header per CONTEXT ruling S-2, with
  an explicit STALE-outside-the-PBS-tier verdict (the controller tiers were last
  verified 41 controller versions ago). The PBS row claimed 'PBS on DooPlex'
  (the retired spike store) with no cadence; it now names felhom-pbs ->
  felhom-offsite on ep0 over wg-felhom, weekly, keep_last=2. NOT marked
  ratified — that is Viktor's review of the section 10 list. Discharges R-83.
- 06-offsite-connectivity.md: the target-split remaining-work note collapsed
  (shipped), and records HOW S4.1's tier-aware timeout silently regressed — the
  mechanism was never removed, its INPUT changed when local_backup_target was
  retargeted to 'local'. Also notes S4.1 already diagnosed the teardown 403 as a
  phantom (a timeout consequence, not an ACL gap).
- capability map: new row for recurring offsite backups actually LANDING, as
  distinct from the existing row proving ACTIVATION. IMPLEMENTED, not
  PROVEN-LIVE — the restore round-trip has not completed under the fixed code.
- ROADMAP: R-82 SHIPPED with its remaining gate named, R-83 DISCHARGED, R-84
  left open.
- CONTEXT + REPORT: the arc, including the mid-arc correction I had to make.

CONTEXT.md

@@ -21,6 +21,29 @@ reader meets the warning before the content, not after acting on it. Origin:
 versions stale (live v0.173.0), and cited as authoritative throughout the R-80 diagnostic. Ratifying
 or retiring it is → **R-83**.
 
+- **2026-07-26 — R-82 SHIPPED: the backup target split (local daily + offsite weekly).** agent
+  v0.97→v0.102.0, controller v0.174→v0.175.0, hub v0.76.0, host-install 1.20.0. `BackupTarget()`
+  returned ONE string and `BackupCadence()` ONE 24h window, so "local daily AND PBS weekly" was not
+  expressible — which is why the DR tier was `applied` since 07-21 with **one** snapshot on
+  demo-felhom and **zero, ever** on demo-hp. Now: `backup_targets[]` per-tier cadence+retention;
+  ONE quiesce window for both due tiers (never two app outages for one night); per-tier hub
+  thresholds (host 26h / offsite 8d); fresh-install default; an unprovisioned tier DEFERS.
+  **Operator rulings:** 2-week offsite retention, first backup runs as long as it needs, one backup
+  at a time per guest, drill box dropped from the rollout.
+  **Four defects found by RUNNING it, not reviewing it** — a 30-min wait bound against a 41-min
+  backup (the agent recorded `success:false` while the backup was still going); the restore tier read
+  from the configured target instead of the archive (**a silent regression of the S4.1 fix** — the
+  mechanism was never removed, its INPUT changed when `local_backup_target` was retargeted to
+  `local`); a leaked scratch keeping `onboot:1`; and a tier firing at a not-yet-provisioned storage.
+  **A correction I had to make mid-arc:** I reported that the restore-test would boot a
+  network-conflicting clone and break the control plane. It does not — step 2 link-downs every NIC
+  before boot, and it is unit-tested. I read a config artifact and inferred behaviour without reading
+  the code path that consumes it, then escalated before finishing the check.
+  **NOT done:** the offsite tier is never AUTOMATICALLY restore-tested (the scheduled test only ever
+  selects the primary tier); the hub infers "PBS ⇒ weekly" from storage TYPE rather than a reported
+  cadence; every agent restart re-triggers an offsite backup (R-84). The installer-default fleet flip
+  waits on a full weekly cycle. Evidence: `audits/SPIKE-r82-phase0-2026-07-26.md`, `REPORT.md`.
+
 - **2026-07-26 — hub v0.75.0: R-81 SHIPPED — "no signal" is not "bad signal".** Third instance of
   one class (hub v0.12.0 `expected_backup_missed` daily-for-everyone; hub v0.73.0 `offsite_stale`
   minutes after a healthy repair; now this), fixed **as a class**, with the invariant written at the