hub v0.77.0 — R-85 Part 2: a restore-test result becomes a SIGNAL

A failed restore-test was a [WARN] line in the ingest handler and nothing else —
no event, no notification, no gauge. True for the LOCAL tier that was already
being tested, so the loudest DR signal this system produces was inaudible.
Rotating tiers without this would only mean two tiers can fail silently
instead of one.

Two signals, deliberately NOT merged:
  restore_test_failed (error)   — a run completed and did NOT pass
  restore_test_stale (warning)  — a tier not PROVEN within its interval
Merging them collapses 'your DR is broken' into 'your DR is unverified', and
the second is the one that quietly becomes the first. The staleness wording
says 'unverified, not known-broken' and a test asserts that phrasing.

Anchored per R-81, not re-derived: a never-proven tier on a newborn box is
UNKNOWN, not FAILED, until the window elapses. This family has made the
opposite mistake three times; this monitor was written straight after the third,
so it copies R-81's structure rather than inventing a fourth shape.

restoreProvenStaleAfter = 7d is derived: oldest-first over two tiers at a 24h
cadence proves each ~every 2 days, so 7d tolerates ~3 missed opportunities and
sits inside the 2-week offsite retention.

Per-tier proof comes from the hub's retained host-report window — the agent
reports only its latest run, so the latest report alone cannot answer 'when was
the OTHER tier last proven?'. Reused R-81's mechanism instead of a wire change.

Both types registered in allowedEventTypes (R-77's inert-seam lesson) and
operator-tier only — no customerMessages entry.

FIXED a time bomb I introduced in Slice C: the restart-blind-window test
hard-coded 2026-07-18T18:31:06Z while comparing against the real clock. Harmless
under one 26h threshold; once the offsite tier got an 8-day limit it passed all
day and began failing at 18:31 UTC, exactly 8 days later. Now relative.

Red-proofs B and D observed. Full suite green (17 packages, rc=0).

hub/cmd/hub/main.go

@@ -550,6 +550,9 @@ func main() {
 	// (90/95% of quota_gb) + staleness (enabled+escrowed but no run >48h — the silently-stuck detector;
 	// run FAILURES already alert via backup_failed). Nil-safe on pre-v0.109 reports. Same sweep.
 	offsiteChecker := monitor.NewOffsiteChecker(dataStore, 0, dispatcher.ProcessEvent, logger)
+	// R-85: the restore-test result becomes a signal instead of a log line. Two distinct events
+	// (failure vs staleness), operator-tier only — neither has a customerMessages entry.
+	restoreTestChecker := monitor.NewRestoreTestChecker(dataStore, dispatcher.ProcessEvent, logger)
 	// R-70 + R-71c: the delivery-state checker — surfaces the burned-credential shape as
 	// offsite_delivery_stuck (warning, 24h/customer) and self-heals it via the Re-issue path
 	// (offsite_credential_restaged, one restage/customer/24h, R-39(a)-guarded). Cooldowns are
@@ -572,6 +575,7 @@ func main() {
 				hostMgmtPlaneChecker.Check()
 				hostOOBChecker.Check()
 				offsiteChecker.Check()
+				restoreTestChecker.Check() // R-85: restore-test failure + per-tier staleness
 				offsiteDeliveryChecker.Check()
 				if offsiteBoxChecker != nil {
 					offsiteBoxChecker.Check() // R-5: restic pool-box aggregate (fetch-throttled internally)