REPORT + CONTEXT: the third name, the second door, and a number that answered a different question

Three rules carried forward. A name must separate on the STEM, not the noun — naming
this secret after the act it is used in would have recreated the trap, because the
other factor on the same page is the „Párosító kód". A guard is worth what its positive
control is worth: this one's selftest convicted its own step-3 case and found a defect
in the guard itself. And a suppression must rest on the machine's own declaration, then
be checked for the SECOND door — recording the disabled state rather than deleting it
is what let the deadline check skip it too.

Yesterday's report is preserved to audits/ because it carries the only record of the
self-heal verdict (Part C was dropped, so that reasoning is in no register row) — the
rule written last night, applied to itself the first time it mattered.

CONTEXT.md

@@ -15,6 +15,96 @@
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
+## A name must differ from its neighbours on a stem, not on a noun (2026-08-13, R-323)
+
+The third near-homograph is renamed: the five-word phrase that proves an account owns the box being
+bound is „**Tulajdonosi jelmondat**". It was „Visszaállító jelszó" — one word from the „Visszaállító
+kód" retired days earlier, and false besides: **the phrase restores nothing.**
+
+**The rule this instance yields, and it generalises past this secret.** Both obvious replacements were
+rejected, and the reasons are the transferable part:
+
+- **Do not name a secret after the ACT it is used in, when another secret on the same screen is named
+  after the same act.** The other factor on that page is the „**Párosító kód**". „Összekötési jelszó"
+  would have left the two things a customer types in one sitting separated only by *kód*-versus-
+  *jelszó* — **structurally the very trap being removed**. A name that matches the page's verb feels
+  right and is the wrong axis.
+- **Do not name a secret after a THING that already has a password.** „Fiókjelszó" collides with the
+  dashboard login, i.e. trades one homograph for a worse one.
+- **Separate on the STEM first, the noun second.** Beállító / Helyreállítási / Párosító / **Tulajdonosi**
+  — four distinct stems; *kód* / *jelmondat* is the second axis, not the first. A pair distinguished
+  only by its noun is what failed twice.
+
+**Naming is not function, and the pin says so** (`TestSelfBindPassphrase_StillAcceptedAfterTheRename`
+drives the real handler with human-messy spacing). **Nothing printed was stranded** — no customer
+document names the phrase; it is delivered out-of-band, so the description in the hint sentence is
+what identifies it, which is why that sentence was kept and extended rather than trimmed.
+
+## A guard is worth what its positive control is worth (2026-08-13, R-324)
+
+The hub's customer copy came under a guard for the first time — every customer e-mail and both binding
+pages, the sentences a customer reads *before* they have seen any box screen. Nothing had ever looked
+at them, in either repo.
+
+**The part worth carrying: the selftest found a defect in the guard itself on its first run.** The
+plant→convict→remove→pass control convicted its own step-3 case (a phrase inside a comment) because
+the synthetic source was named `<selftest>` and comment-stripping keys off the `.go` extension. **A
+guard that had shipped without a control would have been quietly over-broad**, and the first person to
+write an honest explanatory comment would have been convicted by it.
+
+**And on sharing a word list across two repos:** the vocabulary lives once, in `scripts/`, the same
+home both repos already consume gates from. The consumer that could not be edited that evening is
+**drift-checked rather than duplicated** — the gate reads the other gate's literal and fails on
+divergence. That is a scaffold with a register row (R-325) to remove it, not a design; **two copies of
+a word list is the R-299 defect waiting to happen**, and a drift check is the cheapest way to refuse
+the copy without making a cross-repo edit at the wrong moment.
+
+## Suppress an alarm on the machine's own declaration, never on an inference — and check for the second door (2026-08-13, R-321)
+
+A box whose reporting is deliberately switched off announces it (`health.status = "disabled"`) and
+then goes quiet by design. The hub stored that, rendered it, and **alarmed on it anyway**, because the
+staleness verdict was computed from report AGE alone.
+
+**Three things worth carrying:**
+
+1. **The discriminator must be the box's own last word.** That is what made this a suppression rather
+   than a guess — and the standing rule is right that suppressing on a guess is worse than the false
+   alarm it removes.
+2. **RECORD the state; do not delete it.** The `blocked` precedent deletes, and `GetState` then
+   returns `""` — which is not `"down"`, so **`CheckBackupDeadlines` would have gone on alarming from
+   a second function.** One fix, two doors; R-195's shape returning through the one nobody looked at.
+   *Ask of any suppression: which OTHER checker reads this state, and what does it see now?*
+3. **A clock must restart at the event that ends the suppression**, not at the last observation before
+   it began. Timing from the pre-disable report would fire an instant stale/down for a quiet period we
+   requested. Re-entering the new-customer branch gives a first observation instead of a recovery
+   event.
+
+**The limit is stated in the code, not hidden:** a box re-enabled that then fails to report keeps
+being suppressed, because the hub's view changes only when a report arrives. **That is why the state
+is made visible** — an operator who re-enabled a box and still sees `disabled` is being told it has
+not come back.
+
+**And a test lesson:** red-proof 2 revealed that scenario A passed on its state assertion alone even
+with the suppression deleted, because it seeded the customer *already* disabled and the new-customer
+branch swallows the first observation. **A test that cannot see the alarm it exists to prevent is not
+a test** — it now observes the machine healthy first.
+
+## A number everyone repeats is a claim, and claims get checked (2026-08-13, R-326)
+
+"The nine grey claims" was repeated across sessions and **exists nowhere**. A session asked to report
+on them could not determine which nine and declined to guess; that refusal was correct and is the
+finding.
+
+**Nine is real and answers a different question: it is the count of claims carrying
+`verdict: downgraded`** — the ones the 2026-08-09 pass *lowered*. The count of unproven claims is
+**32 of 55** (`walked` 23, `partial` 14, `built` 14, `missing` 4), and of those 32 only **6** cite an
+evidence document.
+
+`scripts/unproven.py` makes it a command, wired into the end-of-session checklist. **The generalisable
+part: a picture built for a person to read is not a picture anyone can check.** The dataset carried the
+statuses all along; what was missing was one command that answers the question the operator actually
+asked. Its first run found a stale claim (R-327) — which is the argument for having built it.
+
 ## A fact the boxes send and the hub cannot read is a future false green — and one now has a reader (2026-08-13, R-319)
 
 **The first of R-264's twenty-one unconsumed facts is read.** The agent emitted `guest_net` on every