architecture updated

documentation/architecture/07-backup-architecture.md

@@ -90,8 +90,14 @@ Row-level decisions folded in:
    HDD_PATH; guessing it from a stripped app.yaml risks capturing a stale or foreign tree. No
    protection regression vs today.
 5. **Declared-but-absent mandatory path** (compose/classes declare it, dir missing on disk): the
-   F-S2 pattern — skip that path, **loud WARN**, capture the rest. restic errors on a nonexistent
+   F-S2 pattern — skip that path, **loud WARN**, capture the rest. The stat-filter before the
-   source path, so the capture set is stat-filtered before invocation.
+   restic invocation is MANDATORY and is the ONLY detection point: restic 0.14.0 (the pinned
+   production binary) does NOT error on a nonexistent source path — it skips with a stderr
+   warning, exits 0, and silently writes a partial snapshot
+   (SPIKE-restic-snapshot-shape-2026-07-14.md, SP-3.4). 3a must never rely on a nonzero restic
+   exit to catch a missing mandatory path; the controller stat-filters to detect the absence
+   itself and raises the WARN from its own check. (If the container's restic is ever bumped,
+   SP-3.4 must be re-run — later releases changed this exit behavior.)
 
 ---