docs: R-86 closed and proven live; ep0 recorded as protected; R-185/186/187 filed

- OPEN-ITEMS: R-86 CLOSED with the trap in its own wording recorded (the literal
  reading is never true on a daily tier); R-87 re-ranked UP because R-86 built
  most of what it waited for; R-185 (the agent cannot list demo-felhom's host
  backup tier — a missing storage ACL, pre-existing), R-186 (a released binary's
  sha is not reproducible from its tag), R-187 (R-115's publish leg had never
  actually run) filed. R-184 was the highest ID in use.
- ROADMAP: R-86 collapsed, keeping the reasoning and correcting the shape the row
  itself proposed — which would have been the never-fires version.
- 07-backup-architecture: new contract section — restore-testing is per ARCHIVE
  GENERATION, with the trap and what did not change (S-1).
- 00-capability-map: the unattended restore-proof row upgraded to PROVEN-LIVE on
  the 635 s due-triggered offsite run, with the restart and teardown evidence.
- CONTEXT: S-17 (the rule, the trap, the config key, the hub's derivation) and
  S-18 (ep0 is Tier 2 — extends D-d's protected list to three machines).
  Numbered 17/18 because S-14 and S-15 were already duplicated in the file.
- STATUS: rewritten for the operator, trimmed back to one screen.

STATUS.md

@@ -29,6 +29,14 @@ Proven end to end on real hardware.
 
 ## What shipped recently
 
+- **Each backup is now proved, instead of the clock being obeyed.** The machine used to re-test a
+  backup every twenty-four hours on a timer that restarted whenever the software was updated, so the
+  test happened at an arbitrary time and a fresh backup could sit unproven while an old one was
+  re-checked. Now a copy is tested once, about a day after it is made, and not again until there is a
+  newer one — so the daily copy is proved daily and the weekly off-site copy weekly, each on its own.
+  The alert that says "this copy has not been proved lately" learned each copy's own rhythm in the
+  same change; without that it would have started complaining every night about a system that is
+  working. *(R-86)*
 - **A failed backup now tells you about every app, once.** When several apps fail in one night you get
   **one** email listing all of them, what kind of backup failed for each, why, and how much space is
   left — instead of an email about one app and silence about the rest. Measured before the fix: nine
@@ -42,21 +50,14 @@ Proven end to end on real hardware.
   refuses a release nobody can download. *(R-110, R-115)*
 - **The reserve now guards the step that fills the disk, and its promise is true.** It decides once
   per app, before writing anything, and no longer waves an app through at 96% full. *(R-181)*
-- **The backup partition is gone**; both demo machines were rebuilt on the new shape by two different
-  routes. Backup space went from 19 GB to 65 GB on the small machine, 45 GB to 233 GB on the big one.
-  *(R-165, R-178)*
-- **The last of the three apps that never saved their data is fixed.** *(R-156)*
-- **A filling disk warns the customer before anything breaks**, naming the drive and the space left.
-  *(R-167, R-158)*
-- **The checks have two nets** — one before every push, one on the build server that emails you.
-  *(R-29, R-161, R-168)*
 
 ## What we're working on
 
-- **Now:** nothing outstanding. Everything raised in the last three days is closed.
-- **Next:** restore-tests scheduled around each backup rather than on a free-running timer — now
-  unblocked, because the off-site endpoint has the memory for it. *(R-86)*
-- **After:** the off-site copy that the machine making it can still erase. *(R-95, R-87)*
+- **Now:** nothing outstanding.
+- **Next:** proving the off-site *app-data* copy can actually be restored — the one tier nothing
+  tests unattended. Most of the machinery it needed arrived with the restore-test change below.
+  *(R-87)*
+- **After:** the off-site copy that the machine making it can still erase. *(R-95)*
 
 ## Waiting on you
 
@@ -65,19 +66,20 @@ Proven end to end on real hardware.
 - **One small question, not urgent.** The automatic check cannot see which version you have told
   machines to install, only which ones exist. Closing that needs either a password given to the build
   server or a check inside the hub itself. *(R-184)*
-- **One older question still standing:** whether the off-site endpoint counts as protected. It was
-  never named either way, and it is yours to settle. *(target-selection.md)*
+- **Nothing else.** The question about whether the off-site endpoint counts as protected is
+  **settled — it does**, and the machine list now says so instead of asking.
 
 ## Changed since last update
 
+- **2026-08-03** — Backups are now proved one at a time, each about a day after it is made, instead of
+  on a timer; the "not proved lately" alert learned each copy's own rhythm so it does not complain
+  about a healthy weekly copy. You settled that the off-site endpoint is protected, and the machine
+  list records it. One thing found while testing: on the small demo machine the agent cannot see its
+  own local backups at all — a permission that was never granted — so that copy has never been
+  test-restored there. Written down, not yet fixed. *(R-86, R-185)*
 - **2026-08-03** — A failed backup now reports every app in one email, and nothing is dropped without
   a record. You rescaled the off-site endpoint to twice the memory, which closed one item and
   unblocked another; the documents describing the old machine were corrected, and the audit records
   of what it used to be were annotated rather than rewritten.
 - **2026-08-03** — Publishing became deliberate for both the installer and the agent, with a way back
   and a check that a release can actually be downloaded.
-- **2026-08-03** — The reserve was fixed to guard the step that fills the disk; the last unsaved app
-  was fixed; both demo machines were rebuilt on the merged disk layout and proven end to end.
-- **2026-08-02** — Thirteen mechanical checks had built up and nothing ran most of them; two were
-  failing quietly. Fixed. Decided the same day: the 20 GB backup partition goes away; and only this
-  machine and the tester's box are protected, every other box may be broken or reinstalled freely.