night fixes 2026-10-26: live proofs (R-1220, R-1232, R-1187, R-1298), register states, design lines; R-1300 filed; R-528 design

Evidence audits/night-fixes-2026-10-26/ (scanned: 0 secret hits).

documentation/architecture/03-host-agent.md

@@ -510,7 +510,7 @@ per Part 1: **snapshot** (LVM-thin, transient, whole-guest rollback — not a ba
   backup is due (`GET /backup/due`, §6) → **quiesces** (stops its app stacks) → `POST /backup` →
   polls `GET /backup/status` to `done` → **unquiesces** (restarts exactly the stacks it stopped).
   Implemented in `felhom-controller` v0.36.0 (`internal/quiesce`) + `felhom-agent` v0.11.0 (the
-  `/backup/due` cadence policy + `/backup/status` phases). **An agent-initiated vzdump is
+  `/backup/due` cadence policy + `/backup/status` phases). *[DESIGN] R-1232 (2026-10-26 night, agent main `3911cc6`, next agent release): on an encrypted tier the due-check counts only archives written with THIS storage's key (the R-727 discriminator — an archive carries no host id), so a reinstalled box does not read the old box's archive as its own last backup.* **An agent-initiated vzdump is
   crash-consistent only** (there is no inbound-to-guest channel to trigger a quiesce — §3/§5); the
   controller stopping its stacks first is what makes the captured state **clean-shutdown-consistent**
   (validated live: a quiesced postgres restore comes up clean — "database system was shut down" — vs