docs: R-86 closed and proven live; ep0 recorded as protected; R-185/186/187 filed

- OPEN-ITEMS: R-86 CLOSED with the trap in its own wording recorded (the literal
  reading is never true on a daily tier); R-87 re-ranked UP because R-86 built
  most of what it waited for; R-185 (the agent cannot list demo-felhom's host
  backup tier — a missing storage ACL, pre-existing), R-186 (a released binary's
  sha is not reproducible from its tag), R-187 (R-115's publish leg had never
  actually run) filed. R-184 was the highest ID in use.
- ROADMAP: R-86 collapsed, keeping the reasoning and correcting the shape the row
  itself proposed — which would have been the never-fires version.
- 07-backup-architecture: new contract section — restore-testing is per ARCHIVE
  GENERATION, with the trap and what did not change (S-1).
- 00-capability-map: the unattended restore-proof row upgraded to PROVEN-LIVE on
  the 635 s due-triggered offsite run, with the restart and teardown evidence.
- CONTEXT: S-17 (the rule, the trap, the config key, the hub's derivation) and
  S-18 (ep0 is Tier 2 — extends D-d's protected list to three machines).
  Numbered 17/18 because S-14 and S-15 were already duplicated in the file.
- STATUS: rewritten for the operator, trimmed back to one screen.

CONTEXT.md

@@ -17,6 +17,45 @@
 
 ## Standing rulings
 
+**S-17 — restore-testing is PER ARCHIVE GENERATION, and the hub's staleness window follows each
+tier's own rhythm (2026-08-03, R-86; agent v0.121.0 + hub v0.91.0).**
+
+*The rule.* Let **A** be the newest archive on a tier that has settled for at least the settle lag
+(24 h). The tier is **DUE** when A exists and **A has not already been proven**. The daemon-start
+ticker survives only as the **evaluation interval** (6 h). A daily tier is proved daily on yesterday's
+archive; a weekly tier weekly on its own; a tier with no archive is UNKNOWN, never a fault.
+
+*The trap, written down so it is not reintroduced.* The literal reading of R-86 — *"due when the
+newest archive is ≥24 h old"* — is **never true on a daily tier**, because a new archive resets the
+newest-archive age to zero long before it reaches the lag. It would have switched restore-testing off
+for the tier that matters most, silently. Red-proved at 0 runs over 5 simulated days
+(`felhom-agent/internal/backup/restoretest_due_test.go`).
+
+*What the state holds now.* `RestoreTestState` records **which archive** was proven, not just when a
+tier passed — a timestamp cannot answer *"have we proven THIS archive"*. A pre-R-86 file keeps its
+time (rotation ordering survives a deploy) and yields no proven archive, so each tier is due exactly
+once after the upgrade.
+
+*The old config key.* `backup.restore_test_cadence_seconds` is DEPRECATED. **Negative still disables**
+verbatim; a positive value now seeds the **settle lag** only, and the daemon WARNs once at start-up
+naming `restore_test_eval_interval_seconds` (default 6 h) and `restore_test_settle_seconds`
+(default 24 h). It is deliberately NOT carried into the evaluation interval.
+
+*The hub half is not optional.* `restoreProvenStaleAfter` was a flat 7 days **derived from the cadence
+R-86 removes**, and a healthy weekly tier's proof age reaches EXACTLY 168 h just before its next
+proof — it sat ON the line. `restoreProvenWindow(tier, observed, ok)` now takes the tier's own
+observed archive interval × 4 generations, floored at 7 days, capped at 12 days (strictly inside the
+2-week offsite retention), falling back to the tier's **declared** rhythm (`backupStaleAfter` 26 h /
+`offsiteBackupStaleAfter` 8 d — the backup-freshness checker's own thresholds) when history is too
+short to observe one. Shipping Part 1 alone would have produced a nightly false alarm.
+
+**S-18 — `ep0` is Tier 2, PROTECTED (operator ruling, 2026-08-03).** D-d named two protected machines
+and did not name ep0 either way; `runbooks/target-selection.md` carried the question in writing for
+two days. The ruling **extends D-d's protected list to three machines**: DooPlex, Peti's cluster,
+**ep0**. It is a classification, not a new set of prohibitions — destroying datastores, prune jobs,
+tunnel config or nftables rules was already forbidden by what it would destroy, and the ordinary
+off-site READ a restore-test performs remains permitted.
+
 **S-13 — the `mp1` merge landed, and the variant was chosen on measurement (2026-08-03, R-165 / D-a).**
 The appliance's two data volumes are one. **Variant V-c**: the volume mounts at the NEUTRAL path
 `/var/lib/felhom`, and both `/var/lib/docker` and `/mnt/sys_drive` are binds of subdirectories of it.