docs: v0.75.0 CHANGELOG + REPORT + CONTEXT (GL-5 shipped, live-validated)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -12,13 +12,18 @@ back-half adds them) — that asymmetry was the bug.
   whole point — no archive parse for the LAYOUT) via the shared `throwawayVolumeOverride` format
   helper (extracted from `bindMountOverrides`; the restore-test's is-a-bind FILTER reads live
   configs, which DR by definition has none of). ModeProvision passes nil — regression-contract test.
-- **LIVE-DISCOVERED PVE constraint (not in the spike — it never ran an override restore):** mpN
-  restore params without an explicit `rootfs` → HTTP 500 "mount points configured, but 'rootfs' not
-  set" (same rule restoretest.go:211 documents for the live-config path). Fixed with NEW
-  `Client.ExtractArchiveConfig` (GET `/nodes/{node}/vzdump/extractconfig` — **answers 200 under the
-  scoped agent token**, verified live; PBS keys stay server-side, the spike's candidate-1 rejection
-  holds): the archive's OWN embedded config supplies the rootfs SIZE only; unreadable/unparseable →
-  clean refusal before any restore.
+- **LIVE-DISCOVERED: PVE's explicit-params restore is ALL-OR-NOTHING** (neither half was in the
+  spike — it never ran an override restore). (a) mpN params without an explicit `rootfs` → HTTP 500
+  "mount points configured, but 'rootfs' not set" (same rule restoretest.go:211 documents).
+  (b) **Mountpoints NOT named in the params are silently DROPPED** — the first live run came up
+  boot+running WITHOUT its mp0/mp1 data volumes (2m56s; the customer's world did not ride along).
+  Fix: NEW `Client.ExtractArchiveConfig` (GET `/nodes/{node}/vzdump/extractconfig` — **answers 200
+  under the scoped agent token**, verified live; PBS keys stay server-side, the spike's candidate-1
+  rejection holds) + `drRestoreOverrides` derives the COMPLETE param set from the archive's own
+  embedded config: explicit rootfs, every storage-backed mpN passed through (size + path + backup
+  preserved → vzrestore extracts its content), structural binds → throwaways. Unknown bind mpN /
+  unparseable size / unreadable config → clean refusal before any restore. Snapshot sections never
+  shadow the current config.
 - **Step 4d — real-bind swap** (DR only, pre-start): mp9 bootstrap host dir created (idempotent —
   a same-host guest-loss still has bootstrap.json there, untouched), then mp8/mp9 set to the REAL
   binds via the host runner (`pct set` — bind mounts are root@pam-only, hence NOT the API; sudoers
@@ -35,8 +40,11 @@ back-half adds them) — that asymmetry was the bug.
   refusal; extract-failure refusal; 403-residue warn; archive rootfs parse (snapshot sections never
   shadow). Red-proofs: override synthesis reverted → A FAILS; unconditional overrides → B FAILS
   (both run→fail→revert).
-- Live validation (campaign-2-precedent scratch DR, §REPORT): see REPORT.md — the exact op that
-  failed on v0.74.0 now round-trips with correctly-wired binds and no residue.
+- Live validation (campaign-2-precedent scratch DR into vmid 9310 from a real 9201 local archive,
+  auto-teardown, guest 9201 untouched): pre-teardown `pct config` shows mp0 200G + mp1 50G restored
+  (7m23s — content genuinely extracted), mp8/mp9 = the REAL binds (exact back-half values), rootfs
+  32G explicit, ZERO unusedN; boot+running; teardown clean incl. the scratch mp9 host dir. On
+  v0.74.0 the same op failed at the restore POST. Full evidence: REPORT.md.
 
 ## v0.74.0 — pool membership re-asserted after restore-over-existing (campaign-2 R2) (2026-07-07)