docs: R-110 + R-115 closed, R-182 re-scoped by measurement, R-183/R-184 filed

R-182's direction REVERSED by Part 0's measurement. Filed yesterday as "the
reserve re-alerts on every status refresh" — too many alerts, seen at the
sending end. Measured at the receiving end: 9 events received today, 2 operator
emails sent. When two apps are refused in the same second the operator is told
about ONE; the other is dropped before LogNotification, so it leaves no row on
any channel and cannot be audited. The operator cooldown key is
customerID:eventType(+tier) and the capture-failed event carries `app` but no
`tier`, so the key has no app identifier. Same failure mode as R-97a, in a
second event type that never opted into the narrow fix. Nothing changed —
Part 0 was investigation only.

Correction owed: yesterday's report said "one recovery_unit_capture_failed per
app, HTTP 200". True of what the CONTROLLER pushed; a reader would take it as
"the operator was told about each app", which is false.

R-110 CLOSED (installer v1.23.0). Both channels moved. The spec's mechanism for
channel 2 rested on a factual error — the run-time fetches are sixteen, not
nine, and come from felhom-agent, not this repo — so no tag here could cover
them; pinned to the agent version being installed instead, on the operator's
ruling. Channel 3 needed no change: the URL never carried a ref, so no hub
change and no hub bump.

R-115 CLOSED. release-agent.sh builds, tags, publishes and verifies by an
independent download; check-published-versions.py refuses a tag with no package;
CI now runs the full gate set so it actually runs.

R-183 NEW+CLOSED: a fresh install fetched the vouched agent binary and its
sixteen config files from two different refs, and nothing compared them.

R-184 NEW: nothing stops the hub vouching a version that was never released.
The R-115 gate cannot see it — measured, the hub manifest and Gitea's package
listing are both 401 anonymously.

capability map: new PROVEN-LIVE row for the published installer channel.
STATUS.md 138 -> 127 lines.

CONTEXT.md

@@ -97,6 +97,32 @@ not provide, and the fourth of those found on live hardware rather than by revie
   no run scope, so a refused app re-alerts on every status refresh (measured: a second identical alert
   pair 13 s after the run's). Pre-existing in v0.192.0; R-181 changed neither caller.
 
+**S-15 — publishing is an act, not a side-effect of pushing (2026-08-03, R-110 + R-115 + R-183).**
+Two rulings, one shape: something became live because someone pushed, not because anyone decided.
+
+- **The installer.** `/scripts/` now git-syncs the tag `installer-v<SCRIPT_VERSION>`; the **website
+  keeps tracking `main`** in a second sync, because pinning both would make every copy edit a
+  release. Publish = cut the next tag + bump the manifest `--ref` + sync. **Roll back = move the tag
+  back**, which takes ~30 s and needs no ArgoCD sync at all — git-sync v4.4.0 follows a moved tag,
+  and that half was measured before the manifest was touched because the whole model rests on it.
+- **The sixteen run-time fetches were NOT what the spec described** — sixteen, not nine, and from
+  `felhom-agent`, not this repo — so no tag here could cover them. They are pinned to
+  `raw/tag/v$ART_AGENT_VER` instead, which is strictly better: the agent's configs now come from the
+  same ref as the agent binary being installed. That closed a real skew (**R-183**), not just a
+  channel.
+- **The URL needed no change**, and that is worth knowing rather than re-deriving: it never carried
+  a ref, so both producers follow the tag automatically — and no hub change means no hub bump.
+- **The agent.** `scripts/release-agent.sh` is THE release path: build → tag → publish → **verify by
+  an independent download**. It does not vouch. `check-published-versions.py` refuses a `v<semver>`
+  tag with no downloadable package, and **CI now runs the full gate set** rather than `--fast`,
+  without which that gate would have been registered and never run.
+- **The gate's invariant is not the one specified, and P-C is why:** the hub manifest and Gitea's
+  package listing are both **401** anonymously; the package download and the tags api are not. So CI
+  can ask *is this installable* but not *what is vouched*. The residue is **R-184**.
+- **Neither gate asserts "the newest version is published."** That would go red on the very push
+  that bumps a version, before publishing — and a gate that fails on the normal path is one people
+  learn to ignore.
+
 **S-11 — D-c's routing, and why R-158's own proposal was overruled (2026-08-02, R-167 SHIPPED).**
 Decision D-c splits two signals by AUDIENCE, and the split is the ruling: **a fill warning is the
 CUSTOMER's** (they can free space, delete files, add a drive) and **a per-app backup capture failure