docs: R-110 + R-115 closed, R-182 re-scoped by measurement, R-183/R-184 filed

R-182's direction REVERSED by Part 0's measurement. Filed yesterday as "the
reserve re-alerts on every status refresh" — too many alerts, seen at the
sending end. Measured at the receiving end: 9 events received today, 2 operator
emails sent. When two apps are refused in the same second the operator is told
about ONE; the other is dropped before LogNotification, so it leaves no row on
any channel and cannot be audited. The operator cooldown key is
customerID:eventType(+tier) and the capture-failed event carries `app` but no
`tier`, so the key has no app identifier. Same failure mode as R-97a, in a
second event type that never opted into the narrow fix. Nothing changed —
Part 0 was investigation only.

Correction owed: yesterday's report said "one recovery_unit_capture_failed per
app, HTTP 200". True of what the CONTROLLER pushed; a reader would take it as
"the operator was told about each app", which is false.

R-110 CLOSED (installer v1.23.0). Both channels moved. The spec's mechanism for
channel 2 rested on a factual error — the run-time fetches are sixteen, not
nine, and come from felhom-agent, not this repo — so no tag here could cover
them; pinned to the agent version being installed instead, on the operator's
ruling. Channel 3 needed no change: the URL never carried a ref, so no hub
change and no hub bump.

R-115 CLOSED. release-agent.sh builds, tags, publishes and verifies by an
independent download; check-published-versions.py refuses a tag with no package;
CI now runs the full gate set so it actually runs.

R-183 NEW+CLOSED: a fresh install fetched the vouched agent binary and its
sixteen config files from two different refs, and nothing compared them.

R-184 NEW: nothing stops the hub vouching a version that was never released.
The R-115 gate cannot see it — measured, the hub manifest and Gitea's package
listing are both 401 anonymously.

capability map: new PROVEN-LIVE row for the published installer channel.
STATUS.md 138 -> 127 lines.

CLAUDE.md

@@ -213,6 +213,22 @@ local and skippable, and only CI is neither.
 - **Website** auto-deploys via git-sync; just push to `main` (live in 1–2 min). Website changes go
   through `repo_gates.py` above (it runs `site_gates.py`); new pages go into that gate's `PAGES`
   list. Emergency edits: https://files.felhom.eu. All `website/` HTML is **UTF-8 with BOM** — preserve it.
+- **THE INSTALLER DOES NOT (R-110, 2026-08-03).** `manifests/webpage.yaml` runs **two** git-syncs:
+  the website from `main` as above, and `/scripts/` from the tag **`installer-v<SCRIPT_VERSION>`**.
+  Pushing `scripts/felhom-host-install.sh` therefore changes nothing that any machine downloads —
+  which it used to, within thirty seconds, for the one artifact that runs as **root on a virgin box**.
+  - **To publish:** cut `installer-v<new SCRIPT_VERSION>`, bump the `--ref` in `webpage.yaml`
+    (both the sidecar and the init container), commit, and sync. `hostinstall_gates.py` gate 6
+    fails if the manifest stops naming an `installer-v…` tag or if the website stops tracking `main`.
+  - **To roll back:** move the tag back to the previous commit and wait ~30 s. **No ArgoCD sync and
+    no deploy** — git-sync picks up a moved tag on its next period, measured live on 2026-08-03 in
+    both directions. That is the emergency lever; fix forward with a new version afterwards.
+  - **Do NOT pin the website to the tag.** The sparse-checkout used to cover `/website/` and
+    `/scripts/` in one sync, and pinning that would turn every copy edit into a release.
+  - The **URL never carries a ref** (`https://felhom.eu/scripts/felhom-host-install.sh`), so
+    `felhom-bootstrap.sh` and the hub's day-0 command follow the tag with no edit — do not add one.
+  - The installer's own sixteen run-time fetches are pinned separately, to `raw/tag/v$ART_AGENT_VER`
+    in the **agent** repo (R-183) — they are the agent's configs, not this repo's.
 - **Manifests** are GitOps via the `felhom` app — commit to `main`, then deliberate sync.
 
 ## Key patterns