R-173 option A in force (hub DB nightly to ep0, restore-tested, alarmed); R-519 proven live on 9202 and closed; R-173/R-232 narrowed; R-882..R-885 opened (332 -> 335); runbook §3 tested; hubdb-check

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -140,8 +140,9 @@ mert a doboz vagy a vezérlő újraindult…"), kept until a run ends with every
 before this, both pages said nothing and the synthesised „Utolsó adatbázis mentés … OK" was read off the fresh `.sql`
 the cut run left beside last night's tars; that line now reads failed after a cut. Each restore point's time was
 already its OLDEST part (the data block, v0.275.0) — so a torn unit is dated by its stale tars, never by its new dump.
-*Live: unit-proven and red-proved; the live cut on 9202 was refused by the permission check and waits for the
-operator (R-519 narrowed).*
+*Live: PROVEN 2026-10-05 on 9202 (operator ruling 126): a run cut by a controller restart between bookstack's config
+dump and its database volume → both pages carry the notice, the restore point reads the older volume's time, the next
+complete run clears it (`audits/hub-db-offsite-2026-10-05/partD/r519/`; R-519 closed).*
 
 ### Lane 2 — the operator: guest and host recovery