REPORT + STATUS: gate enforcement session, hub v0.87.0 live

REPORT overwritten per the standing rule; every red-proof, the core.hooksPath probe's four
measured outcomes, Scenario C's refusal-and-bypass, the hub deployment and the live Setup-tab
read are recorded there, plus three observations and two deliberate deviations from the spec
(a comment-only edit to felhom-host-install.sh, and __pycache__ in .gitignore).

STATUS: the 'check that needs a person to remember it' line is rewritten — the checks now run
themselves before every push, with both honest limits stated in plain words; and one entry
records the thirteen-check cleanup and the deleted installer version number.

STATUS.md

@@ -37,8 +37,11 @@ lost: the last good copy is kept intact. *(R-163)*
 **When that happens, only one page says so** — no email, no alert. The page that answers "is this app
 backed up?" is the one that stays silent. *(R-158)*
 
-**The check that catches this needs a person to remember it.** One command, run by hand; nothing
-refuses a change that skipped it. *(R-161)*
+**The checks that catch this still can't stop a change on their own — but they now try.** Every
+repository has one command that runs all of its checks, and it runs by itself before every push, so a
+push carrying a broken check is refused rather than reported. Two limits are real: it has to be
+switched on once in each copy of the code, and it can be skipped on purpose. The version that can be
+neither is a build server, which we do not have yet. *(R-29, R-161, R-168)*
 
 ## What we're working on
 
@@ -59,8 +62,15 @@ refuses a change that skipped it. *(R-161)*
 
 ## Changed since last update
 
+- **2026-08-02** — Fixed: thirteen mechanical checks had built up across the four repositories and
+  nothing ran most of them. Two were failing quietly, one since 14 July; neither did harm, but nothing
+  would have said so. Both fixed; every repository now has one command that runs all its checks, and
+  it runs automatically before every push. One of the two was the setup page claiming the installer
+  was version 1.19.0 while machines got 1.22.0 — the number is now **gone** rather than corrected,
+  because the page cannot know it: the installer is fetched fresh each run, so any number there is a
+  guess. A check refuses to let one be added back.
 - **2026-08-02** — Decided: the 20 GB backup partition goes away and shares space with app data. That
   changes the disk layout, so it happens before any machine is installed outside the house.
 - **2026-08-02** — Decided: only this machine and the tester's box are protected; every other box,
-  both demo boxes included, may be broken or reinstalled freely.
-- **2026-08-02** — Two of the three apps that never saved their data are fixed; this page created.
+  demo boxes included, may be broken or reinstalled freely. Two of the three apps that never saved
+  their data are fixed; this page created.