STATUS.md: a plain-language operator page, and today's four decisions recorded

Documentation only — no code, no box, no build.

STATUS.md (repo root, 652 words / 67 lines): what works · what's broken ·
what we're working on · waiting on you · changed since. A VIEW of
OPEN-ITEMS.md, holding nothing of its own; not CONTEXT.md, and both files
now say why they stay separate. No R-n is the subject of a sentence —
identifiers are bracketed pointers only.

CONTEXT.md S-5 records the four operator decisions taken 2026-08-02
(D-a … D-d), none of them implemented:
  D-a merge mp1 into mp0 rather than resize it — before any external
      install, and D-c ships in the same step        → R-165
  D-b desired/observed app state in its own store, with the state-store
      safety rule verbatim                           → R-166 (BLOCKED)
  D-c customer fill warning + operator backup-failure alert → R-167
  D-d only DooPlex and Peti's box are protected      → target-selection.md

R-163 RE-FRAMED, not closed: the sizing question is withdrawn rather than
answered; the row survives as the record of the constraint until R-165
lands. R-156's papra referral RESOLVED — deployed nowhere, so the template
fix strands nothing; the docker ps evidence is recorded with its
provenance and its scope limit.

target-selection.md: two protected machines, everything else disposable.
ep0 is no longer Tier 2 but is not scratch (it holds the only off-premises
copy of real customer data) — flagged for explicit operator confirmation.
The demo-box backup-target fence drops from prohibition to stated cost,
because D-d spends that reference anyway.

CLAUDE.md gains an End-of-session checklist carrying the STATUS.md
maintenance rule and "a finding goes in OPEN-ITEMS.md first".

CLAUDE.md

@@ -102,6 +102,20 @@ pushes; **you (Claude Code) implement**. A file being open in the editor is NOT
   explicit paths only, `git pull --rebase` before every push, and do not run two writing
   sessions on one clone (use `git worktree` if truly needed).
 
+## End-of-session checklist
+
+- **`CHANGELOG.md` + `REPORT.md`** per the rule above, in every repo touched.
+- **`REUSE.md`**, if a shared helper or pattern moved (same commit).
+- **The capability map** (`documentation/architecture/00-capability-map.md`), if a capability's status
+  changed — with its new evidence citation.
+- **The architecture doc** that owns any changed contract (S-1, `CONTEXT.md`).
+- **Root `STATUS.md`** — *update it at the end of every session in which something shipped, broke, or
+  was decided. It is a view of `documentation/backlog/OPEN-ITEMS.md` — **nothing may exist only
+  there**. One screen; cut items rather than extending it.* It is written for the **operator** in
+  plain language, and is deliberately **not** `CONTEXT.md` — do not consolidate the two.
+- **A finding goes in `OPEN-ITEMS.md` first**, never only in a report, an audit or `STATUS.md`. Four
+  items in this project were minted in a spike doc and lost (R-153/154/155, R-156/157).
+
 ## Tech stack (Hub)
 
 - **Language:** Go (stdlib `net/http` + `html/template`, no frameworks). **DB:** SQLite via