R-243: offsite_escrow_pending — an operator alarm when off-site is on and the escrow never done (7 days); 09 decisions 177-179; 07 R-899 note

Hub code unreleased; ships with tomorrow's hub release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -405,6 +405,18 @@ read **only when the storage cannot be read**: a fresh saved copy → not due; a
 unknown, as before. A storage that answers always wins, so a pruned archive still makes the tier due. Tests:
 `TestBackupDue_R894_*` (felhom-agent `internal/localapi`).
 
+**[DESIGN — operator ruling 2026-10-08, `09` §3 decision 177; built on controller and agent main the same day, ships
+with their next releases — R-899] A daytime press never moves the night's backup. Every night takes its own.** The
+agent's due-check reads the newest archive on the tier, and a „Mentés most" press is an archive like any other, so a
+press at 08:49 made the 24 h tier due at 08:49 the next day — after the window closed — and that night had no
+whole-guest backup, no OS leg and no kernel step (demo-hp, 2026-10-07 → 08). Now the controller keeps a ledger of the
+last successful press and the last successful SCHEDULED run per tier (`whole-guest-ledger.json` beside the quiesce
+marker); a tier the agent calls „not due" is still due on the scheduled path when a press came after the last scheduled
+success and that success is older than tonight's gate opening. Such a tier waits for the window (it never fires the
+safety valve); a scheduled success inside tonight's window ends it. And a press reaches the agent as
+`trigger=manual`, after which the agent runs no OS leg (before, a press ran it at once, in the day). Pinned by
+`TestR899_*` (controller) and `TestAfterPrimaryBackup` (agent).
+
 **[FACT, 2026-10-04 — agent v0.140.0, `11-os-updates.md` §8.1] The OS leg closes the night.** After the
 whole-guest backup (the controller drives it, inside [W+2h, W+6h)) ends SUCCESSFULLY on the primary tier, the agent
 waits 90 s and runs the guest's Debian fast lane — still holding the host-wide heavy-op gate, so it never overlaps a