v0.234.0: a known limitation written on 2026-09-02 was a defect by the next morning

The operator looked at demo-felhom and found OpenGist - up 15 hours, running
exactly the catalog pin, showing no badge at all. 09-update-architecture.md had
recorded that as an accepted limitation the day before: 'the fleet view fills in
gradually'. On a quiet box gradually means never, and a feature that fills itself
in on an event nobody triggers is, on the quiet installations, not shipped. That
limitation row is now struck with the reason kept.

The living document gains slice 1b, the two admission rules of the backfill (it
never overwrites, and it refuses to seed a partial observation because the badge
reads a service-count mismatch as BEHIND), and the note that the same field having
two writers with two different admission rules is deliberate.

Live evidence added: all nine apps already had records by the time 0.234.0 was
ready, so the natural fleet state could no longer exercise the new code - said
plainly rather than papered over. The pre-0.233.0 shape was recreated on demo-hp
by stripping two records; the backfill re-seeded exactly those two with digests
matching independently-read ground truth and left the other seven alone.

The refusal half was deliberately NOT staged live: it needs a degraded app, and
manufacturing one risks the false-customer-email class that already cost 61 mails
(R-330). Unit-tested with a red-proof, and recorded as unproven-live.

R-457: a test that hardcodes a date and asserts an age derived from it is green
only on the day it is written. Mine was, and it went red overnight. Six other
files carry both a date literal and time.Now() - named as candidates, not accused.

REPORT.md

@@ -1,4 +1,4 @@
-# REPORT — update arc slices 1 & 2: documents, register, roadmap, capability map (2026-09-02)
+# REPORT — update arc slices 1, 1b & 2: documents, register, roadmap, capability map (2026-09-03)
 
 *Overwritten each session. Nothing durable lives only here.*
 
@@ -29,7 +29,7 @@
 
 ## Register
 
-**194 rows before, 205 after.** Nothing closed, and that is stated rather than implied: R-438 and
+**194 rows before, 206 after** (205 on 2026-09-02, plus R-457 on 2026-09-03). Nothing closed, and that is stated rather than implied: R-438 and
 R-440 are **amended and stay OPEN** — the mechanism is now documented, not changed — so nothing moved
 to `CLOSED-ITEMS.md` and that file is untouched.
 
@@ -46,6 +46,7 @@ to `CLOSED-ITEMS.md` and that file is untouched.
 | R-454 | five `gofmt`-unclean `internal/web` test files, and no gate notices | READY, P3-LOW |
 | R-455 | **DooPlex has no Docker Hub login — the ceiling now blocks BUILDS, not just gates.** The mirror workaround is **MEASURED byte-identical** to Hub, so it is a sound fallback, not a hope | **WAITING-ON-OPERATOR**, P2-MEDIUM |
 | R-456 | a partly-dead stack is not a boot orphan, and that rule is written down nowhere | READY, P3-LOW |
+| R-457 | **a test that hardcodes a date and asserts an age is green only on the day it is written** — one proven, six candidate files named | READY, P3-LOW |
 
 ## Live validation
 
@@ -66,4 +67,9 @@ double quotes from a single-quoted value.** The operator caught it in one line.
 ## Sibling repos
 
 - `felhom-controller` **v0.233.0** — `8025304acc0a`, deployed to demo-hp and verified healthy.
+- `felhom-controller` **v0.234.0** — `38d28b5b624c`, the startup backfill. Deployed to **both** demo
+  boxes and verified: 2 apps seeded on demo-hp with digests matching ground truth, 7 left untouched;
+  all 9 then badged. **Its cause is worth keeping: `09-update-architecture.md` §8.3 was written as an
+  accepted limitation on 2026-09-02 and was a defect by the next morning** — the operator found an app
+  that simply ran and therefore showed nothing.
 - `app-catalog-felhom.eu` — `69761cf91bfc` (backfill) + `8220f8d` (REPORT).