C9-F1 (honesty half) + C9-F2 shipped in controller v0.183.0; C9-F1b and C9-F4 filed

Phase 0 sized C9-F1 properly before anything was designed: 43 of the 53 catalog apps have NO
subtree the Tier-2 restore can read (not 2), 9 are covered only for their file legs and never
their database or volumes, 1 is stateless. The asymmetry is Tier-2's alone — Tier-1 and offsite
both restore the unit and replay volume dumps, so BookStack always had a working restore and
only this button lied.

Shipped: the restore refuses BEFORE stopping the app and names the action that does work; a run
that proceeds claims only what it EXAMINED and discloses that the database and volumes are not
covered. C9-F2 alarms after a 5-minute sustained-restarting threshold, set above the 120s deploy
timeout, Mealie's 60s start_period and R-97b's 180s grace; StateRestarting is deliberately NOT
added to IsDownState.

Live: silent through ten 30s samples then app_start_failed at 5m25s, heartbeat now reads
"1 currently down" where Campaign 9 recorded 0; a real deploy stayed silent; bookstack refused
with its uptime unbroken; paperless re-restored 43/43 byte-identical, 16/16 docs clean.

Filed, not fixed: C9-F1b (route to the Tier-1 restore — its own task because it puts a
destructive operation behind a non-destructive button) and C9-F4 (nothing reads the Tier-2
copy's recovery-unit/ mirror, so the second local copy that exists for drive loss is unreachable
by any customer action — potentially larger than C9-F1).

documentation/audits/CAMPAIGN-9-restore-proof-2026-07-28.md

@@ -214,6 +214,17 @@ defect — each is the correct consequence of not being in the last successful c
 
 ## 3. Findings
 
+> **SHIPPED 2026-07-28 — controller v0.183.0.** F-1's honesty half and F-2 in full. Phase 0 of the fix
+> sized F-1 properly: **43 of the 53 catalog apps** have no restorable subtree (not 2), 9 are covered
+> only for their file legs, 1 is stateless. The restore now refuses **before** stopping the app and
+> names the action that works; a run that proceeds claims only what it **examined** and discloses that
+> the database and volumes are not covered. F-2 alarms after a 5-minute sustained-restarting threshold
+> — proven live: silent through ten 30 s samples, then `app_start_failed` at 5m25s, and the F-OBS
+> heartbeat now reads `1 currently down` where Campaign 9 recorded `0`. Completeness is filed as
+> **C9-F1b**, and **C9-F4** was filed during the fix: nothing reads the Tier-2 copy's `recovery-unit/`
+> mirror at all. See `REPORT.md` and CHANGELOG v0.183.0.
+
+
 ### F-1 — the restore button reports success for apps it can never restore — **DEFECT, HIGH**
 
 **Applies to:** every app whose data lives entirely in Docker named volumes and which therefore has