docs: R-168 SHIPPED, R-29 CLOSED on the demonstrated alarm, R-169 minted

SPIKE-ci-runner-2026-08-02.md: all six probes with method, measurement and ruling; none
STOPped. P2 (stock image has git but no python3) and P6 (a runner that loses its state
re-registers and orphans the old record) changed the design; P5 (a failed run signals
NOTHING) is why the alarm exists at all.

R-168 SHIPPED with its evidence. R-29 CLOSED — on the demonstrated alarm and not on a green
run, as required: the class it opened is answered at both ends, the hook refusing locally and
CI catching a --no-verify bypass and emailing. R-161 noted: its automatic half now exists for
the STATIC gate, while its original scope, the runtime gate, is deliberately still not
automatic and should stay that way.

NEW R-169 (grep established R-168 was the highest in use): CI can only report, because there
is no gate in the road. Making it blocking needs branch protection plus a PR workflow, both
of which change how the operator works — so it is theirs to decide, and the row states the
cost honestly rather than recommending it.

CONTEXT gains S-8 (CI detects, does not block, and why that is structural), S-9 (a detector
that tells no one is not finished, plus the curl and Cloudflare-1010 traps), S-10 (the runner
is unprivileged because DooPlex is Tier 2), S-11 (CI reproduces the sibling layout).

CLAUDE.md gains the rule earned by red-proofing: a go test -run pattern that matches no test
prints ok and exits 0, and an instrument that can silently drop results is not a measurement.

STATUS.md

@@ -37,11 +37,14 @@ lost: the last good copy is kept intact. *(R-163)*
 **When that happens, only one page says so** — no email, no alert. The page that answers "is this app
 backed up?" is the one that stays silent. *(R-158)*
 
-**The checks that catch this still can't stop a change on their own — but they now try.** Every
-repository has one command that runs all of its checks, and it runs by itself before every push, so a
-push carrying a broken check is refused rather than reported. Two limits are real: it has to be
-switched on once in each copy of the code, and it can be skipped on purpose. The version that can be
-neither is a build server, which we do not have yet. *(R-29, R-161, R-168)*
+**The checks now have two nets, and the second one emails you.** Every repository has one command
+that runs all of its checks; it runs by itself before every push and refuses a push that fails. That
+one lives on the workstation and can be skipped. So the build server now runs the same checks again,
+on a machine that does not care who pushed or what they typed — and **when they fail it sends you an
+email**, because a red mark on a page nobody watches is not a warning. Proven with a real broken
+change, not assumed. The one thing it still cannot do is *stop* the change: every change here goes
+straight to the main copy with no review step, so there is no point in the road for it to stand at.
+It notices, quickly, and tells you. *(R-29, R-161, R-168, R-169)*
 
 ## What we're working on
 
@@ -62,12 +65,13 @@ neither is a build server, which we do not have yet. *(R-29, R-161, R-168)*
 
 ## Changed since last update
 
-- **2026-08-02** — Fixed: thirteen mechanical checks had built up across the four repositories and
-  nothing ran most of them. Two were failing quietly, one since 14 July; neither did harm, but nothing
-  would have said so. Both fixed; every repository now has one command that runs all its checks, and
-  it runs automatically before every push. One of the two was the setup page claiming the installer
-  was version 1.19.0 while machines got 1.22.0 — the number is now **gone** rather than corrected,
-  because the page cannot know it: the installer is fetched fresh each run, so any number there is a
+- **2026-08-02** — Fixed and then doubled: thirteen mechanical checks had built up across the four
+  repositories and nothing ran most of them; two were failing quietly, one since 14 July. Both fixed.
+  Every repository now has one command that runs all its checks, it runs automatically before every
+  push, and the build server re-runs it after every push and **emails you when it fails** — proven
+  with a real broken change. One of the two failures was the setup page claiming the installer was
+  version 1.19.0 while machines got 1.22.0; that number is now **gone** rather than corrected,
+  because the page cannot know it — the installer is fetched fresh each run, so any number there is a
   guess. A check refuses to let one be added back.
 - **2026-08-02** — Decided: the 20 GB backup partition goes away and shares space with app data. That
   changes the disk layout, so it happens before any machine is installed outside the house.