R-82 Slice D/E: installer default 1.20.0 + architecture docs brought current

Slice D.1 — host-install 1.20.0: a FRESH box defaults to local-daily +
offsite-weekly (felhom-pbs, 604800s, keep_last=2). setdefault semantics proven
both ways: fresh gets the tier, an UPGRADE preserves the existing backup block
verbatim — so an in-place upgrade can never silently start writing to an
offsite datastore. Existing boxes are migrated explicitly.

Slice E:
- 07-backup-architecture.md: honest status header per CONTEXT ruling S-2, with
  an explicit STALE-outside-the-PBS-tier verdict (the controller tiers were last
  verified 41 controller versions ago). The PBS row claimed 'PBS on DooPlex'
  (the retired spike store) with no cadence; it now names felhom-pbs ->
  felhom-offsite on ep0 over wg-felhom, weekly, keep_last=2. NOT marked
  ratified — that is Viktor's review of the section 10 list. Discharges R-83.
- 06-offsite-connectivity.md: the target-split remaining-work note collapsed
  (shipped), and records HOW S4.1's tier-aware timeout silently regressed — the
  mechanism was never removed, its INPUT changed when local_backup_target was
  retargeted to 'local'. Also notes S4.1 already diagnosed the teardown 403 as a
  phantom (a timeout consequence, not an ACL gap).
- capability map: new row for recurring offsite backups actually LANDING, as
  distinct from the existing row proving ACTIVATION. IMPLEMENTED, not
  PROVEN-LIVE — the restore round-trip has not completed under the fixed code.
- ROADMAP: R-82 SHIPPED with its remaining gate named, R-83 DISCHARGED, R-84
  left open.
- CONTEXT + REPORT: the arc, including the mid-arc correction I had to make.

scripts/CHANGELOG.md

@@ -1,3 +1,25 @@
+## felhom-host-install 1.20.0 — R-82: a fresh box defaults to local-daily + offsite-weekly (2026-07-26)
+
+The `backup` defaults gain `backup_targets: [{target_id: "felhom-pbs", cadence_seconds: 604800,
+keep_last: 2}]` — the offsite tier, weekly, two weeks retained (operator ruling 2026-07-26).
+
+**`setdefault` semantics preserved, and PROVEN both ways** against the exact line:
+
+```
+FRESH   -> backup_targets: [{"target_id":"felhom-pbs","cadence_seconds":604800,"keep_last":2}]
+UPGRADE -> preserved verbatim, no backup_targets
+```
+
+That second line is the load-bearing one: **an in-place upgrade can never silently start writing to
+an offsite datastore.** Existing boxes are migrated explicitly (R-82 Slice D.2), which is what keeps
+a routine host-install re-run from enrolling a box into offsite backups nobody asked for.
+
+**Why the tier is written before its storage exists:** `felhom-pbs` only appears when the hub
+provisions the DR tier. The agent (v0.102.0) DEFERS a tier whose target storage is absent, so the
+tier stays silent until it is real and goes live with no restart the moment it is provisioned.
+Writing it here means a box is never left with a DR tier that is provisioned but unscheduled — the
+exact "applied and empty" state R-82 exists to end.
+
 # Felhom scripts — Changelog
 
 ## felhom-host-install v1.19.0 — R-50 island control plane is the appliance default (2026-07-25)