docs: F-CRIT-1 + F-A1 shipped (controller v0.179.0); invariant rule

Both marked SHIPPED + PROVEN-LIVE in OPEN-ITEMS and the campaign doc. All three
of Campaign 8's alarm findings are now closed (F-CRIT-1, F-CRIT-2, F-A1).

Adds the standing rule earned by this arc to the versioned workspace CLAUDE.md:
a comment asserting an invariant needs a test pinning it, or it is a wish — with
all six shipped-false-guarantee instances catalogued, and the corollary that a
test should assert the CONSEQUENCE (does the alarm fire?) not the MECHANISM
(does suppression expire?).

documentation/audits/CAMPAIGN-8-backup-restore-2026-07-27.md

@@ -265,9 +265,9 @@ Neither restored guest was booted — deliberately, see F-OPS below.
 
 | # | Finding | Severity | DEFECT / ARTIFACT |
 |---|---|---|---|
-| **F-CRIT-1** | An app that fails to restart after a quiesce **never alarms** | **HIGH** | **DEFECT** (compression-independent) |
+| ~~**F-CRIT-1**~~ | ~~An app that fails to restart after a quiesce **never alarms**~~ — **FIXED, controller v0.179.0 (2026-07-28), both causes, replayed live** | ~~HIGH~~ | DEFECT — closed |
 | ~~**F-CRIT-2**~~ | ~~A failed offsite backup leaves a phantom snapshot that **resets tier freshness**~~ — **FIXED, agent v0.106.0 (2026-07-28), re-tested live by replaying fault 2** | ~~HIGH~~ | DEFECT — closed |
-| **F-A1** | A restore-test in progress makes a healthy backup report as FAILED, arms the breaker and pages the operator | MEDIUM | **DEFECT** in behaviour / ARTIFACT in frequency |
+| ~~**F-A1**~~ | ~~A restore-test in progress makes a healthy backup report as FAILED~~ — **FIXED, controller v0.179.0 (2026-07-28); hub DB shows 0 spurious emails, real failures still alarm** | ~~MEDIUM~~ | DEFECT — closed |
 | **F-HUB** | The hub **dropped an event** under concurrent load (`SQLITE_BUSY`), no retry, cause unnamed | MEDIUM | DEFECT (frequency compression-influenced) |
 | **F-LEAK** | A **failed** restore-test cannot destroy its own scratch guest (403 `VM.Allocate`); leaks are never reclaimed and the 10-slot VMID band shrinks silently | MEDIUM | DEFECT (root-caused by fault 18) |
 | **F-REBOOT** | A guest rebooted during its backup **does not come back** — shutdown completes, start never happens, no self-heal | MEDIUM | DEFECT |
@@ -336,6 +336,24 @@ Frequency is an ARTIFACT; the behaviour is a DEFECT — at real cadences a ~12-m
 against a daily backup collides roughly once per 420 guest-days, i.e. **every ~4 days on a
 100-guest fleet**, forever training R-97a's alarm into noise.
 
+### F-CRIT-1 and F-A1 — FIXED (controller v0.179.0, 2026-07-28)
+**F-CRIT-1**, both causes: `restartAll` now returns the stacks that failed, and `classifyRunStates`
+lifts the `StateStopped` whitelist for exactly those (`Loop.FailedRestarts()`). I1 is restated
+truthfully — `StateStopped` means "deployed with zero containers", which is EITHER a user stop OR a
+failed quiesce restart, and only the loop's own knowledge separates them.
+
+**F-A1**: HTTP 409 is contention, not failure — typed `*StatusError` on POST, mapped to
+`quiesce.ErrTierBusy` at the adapter. The tier stays DUE and is dropped before anything stops
+(`contentionRetryAfter` 15m), and contention outliving the agent's own 120m PBS restore-test ceiling
+raises a **BLOCKED** signal at 3h so a wedged gate is never silent.
+
+Replayed live on demo-hp with the hub DB as arbiter: the failed restart alarmed 9 s after grace
+expiry with the banner naming `(stopped)`; a deliberate user stop stayed silent through 9 dead-app
+scans; a 409 produced **0** operator emails (8 → 8) while a real transport failure produced **1**
+(8 → 9). Six red-proofs. Detail: `felhom-controller/REPORT.md`.
+
+**All three of Campaign 8's HIGH/MEDIUM alarm findings are now closed** (F-CRIT-1, F-CRIT-2, F-A1).
+
 ### F-CRIT-2 — FIXED (agent v0.106.0, 2026-07-28)
 `NewestArchiveTime` now counts only *plausibly complete* entries, via a measured size floor
 (`minPlausibleArchiveBytes` = 1 MiB; smallest real backup on the fleet is 612,397,450 B, so 584x