docs(report): STOP-2 DONE + PROVEN — the R-39 chain closed in 13 seconds

REPORT.md

@@ -11,7 +11,7 @@ Companion: hub **v0.68.0** (`felhom.eu`).
 | Part 2 — agent v0.91.2 | **SHIPPED + PUBLISHED + DEPLOYED** to felhom-pve |
 | **STOP-1** — felhom-pve update | **DONE + VERIFIED** (§5) |
 | **STOP-3** — manifest save | **DONE by the operator 2026-07-21 08:31:12Z** — agent 0.91.2 + sha + **wrapper sha `104db0a4…`** + MinAgent 0.91.2, all six fields persisted. The agent reports the same wrapper hash, so the R-50b drift gauge reads **ok**. |
-| **STOP-2** — live re-issue | **NOT DONE — the OFFSITE re-issue was pressed, not the PBS-DR one.** `host_pbs_secrets` untouched (generation 0, consumed 2026-07-18); the descriptor still has no `secret_generation`. Side effect: the offsite restic password rotated, so the escrow blob is now STALE and the recovery-code ceremony must be re-run. PBS-DR itself is unaffected (probe still 200, secret mtime unchanged). |
+| **STOP-2** — live re-issue | **DONE + PROVEN 2026-07-21 — the chain closed in 13 s.** `08:39:31Z` hub mint gen 0→1 + `secret_generation: 1` (token_id/fingerprint byte-identical) → `10:39:34` wrapper read → `10:39:38` `REJECTED … applied and DEAD` `previous_state=applied` → `10:39:45` **secret consumed (no short-circuit)** → `10:39:45` set-only reconcile → `10:39:47` `converged state=applied`. Marker hash moved to `afbb3b41…`; secret mtime `2026-07-18`→`2026-07-21 10:39:45`; new credential probes 200; reports trace `applied → auth_failed → applied`; **zero** self-heal escalations, one mint, one consume. First attempt hit the **offsite** re-issue by mistake (two distinct actions) — harmless to PBS-DR but it made the escrow stale, ceremony re-run. |
 
 ## 1. Probes