docs(R-116): record the live proof — four events, two matched pairs, discriminated

v0.116.0 validated on a fresh box: real day-0 from the v1.25.0 ISO on a nested PVE
on demo-hp (per runbooks/target-selection.md), agent installed unaided from the
vouched Day-0 manifest, drives enrolled through the real endpoints, device loss a
real hot-detach.

  07:20:04  backup_target_absent   (error)  Cel meghajto   <- TARGET, specific
  07:22:34  backup_target_restored (info)   Cel meghajto   <- its matching pair
  07:24:04  storage_disconnected   (error)  Adat meghajto  <- NON-target, generic
  07:25:34  storage_reconnected    (info)   Adat meghajto

All four reached the hub; gate fired in 3 s. Discrimination is proven NON-trivially
for the first time -- both prior runs had the target itself emit the generic event,
so their mirror proved nothing. Over-correction passes on a POSITIVE observable: 0
ABSENT lines and 0 drive events over 2m14s with both drives present, while two
RETURNED lines prove the gate was ticking rather than dead.

Caveat recorded, not a regression: the drill's controller was 0.185.1 from the
golden, which predates R-114, so its absent-state banner showed the old false
"backup is on the system disk" copy. The R-114 guard is pinned by unit test and by
the payload, but could not be confirmed on that box. Filed as R-120 -- the golden
is a release behind the deployed controller, which is R-115's class one layer up.

Teardown all three layers, including the hub: VM purged, storage removed with the
space measured back, hub records gate-blocked on ONLINE with the command recorded.

Suite rc=0 read separately from this commit.

CHANGELOG.md

@@ -60,6 +60,23 @@ the **root** filesystem (**R-118's symptom, incidentally gone; R-118 itself is N
 open**). No consumer of those was found: wipe/decommission need the drive present, `firstOfferableDrive`
 already excludes it, and the disk-health baseline excludes UNKNOWN verdicts.
 
+**PROVEN LIVE 2026-07-30 — the full four-event sequence, on a fresh box.** Real day-0 on a nested PVE on
+demo-hp, the agent **installed unaided from the vouched Day-0 manifest**, drives enrolled through the real
+endpoints, device loss a real hot-detach:
+
+```
+07:20:04  backup_target_absent   (error)  Cel meghajto   ← the TARGET, specific, was generic before
+07:22:34  backup_target_restored (info)   Cel meghajto   ← its matching pair
+07:24:04  storage_disconnected   (error)  Adat meghajto  ← a NON-target, generic, same box
+07:25:34  storage_reconnected    (info)   Adat meghajto
+```
+
+All four reached the hub. Gate fired in **3 s**. **Discrimination is proven non-trivially for the first
+time** — both prior runs had the target itself emit the generic event, so their mirror proved nothing.
+Over-correction guard passes on a *positive* observable: 0 ABSENT lines and 0 drive events over 2m14s with
+both drives present, while two `RETURNED` lines prove the gate was ticking. Audit: `felhom.eu`
+`audits/R116-v0116-2026-07-30.md`.
+
 **Tests 845 → 849.** Four red-proofs, each mutation verified to have landed before the run:
 (1) v0.115.0's MountPath-only fallback → `isTarget[guestPath] = FALSE, rows=2`; (2) drop the guest-path
 dedup → `carried by 2 rows`; (3) give the absent row a MountPath → the R-114 guard fires; (4) over-broad

REPORT.md

@@ -112,7 +112,32 @@ One red-proof was restored with `git checkout <file>`, which discarded the whole
 than the one-line mutation. Re-applied and re-verified; later red-proofs restored from pristine copies
 kept outside the repo. `git checkout` is not an undo for a mutation on a work-in-progress file.
 
-## NOT yet live-validated at the time of this commit
+## LIVE VALIDATION — all claims PASS (`felhom.eu` `audits/R116-v0116-2026-07-30.md`)
 
-Publish + vouch, C5 pairing, discrimination, and the over-correction guard — the session's live half.
-Outcome recorded in the audit under `felhom.eu/documentation/audits/`.
+Fresh box, real day-0 from the v1.25.0 ISO on a nested PVE on **demo-hp** (per `runbooks/target-selection.md`),
+agent **installed unaided from the vouched Day-0 manifest**, both drives enrolled through the real endpoints,
+device loss a real hot-detach.
+
+```
+07:20:04  backup_target_absent   (error)  Cel meghajto   ← TARGET, specific (was generic through v0.115.0)
+07:22:34  backup_target_restored (info)   Cel meghajto   ← its matching pair
+07:24:04  storage_disconnected   (error)  Adat meghajto  ← NON-target, generic, same box 4 min later
+07:25:34  storage_reconnected    (info)   Adat meghajto
+```
+
+All four at the hub; gate fired in 3 s. **Discrimination proven non-trivially for the first time.**
+Over-correction passes on a positive observable (0 ABSENT lines / 0 drive events over 2m14s with both drives
+present, target `degraded:false`, while two `RETURNED` lines prove the gate ticked). Publish observables:
+registry GET of the published bytes matched `b47c5c4d…`, the manifest was read back showing 0.116.0, and the
+box reported it running.
+
+**One caveat, not a regression:** the drill's controller was **0.185.1** from the golden, which predates
+R-114, so its absent-state banner showed the old false "the backup is on the system disk" copy. The R-114
+guard is pinned by unit test and by the payload (no row combines the flag with a mount path) but could not be
+confirmed on that box. Filed as **R-120** — the golden is a release behind, which is R-115's class one layer up.
+
+## Teardown — all three §13 layers
+
+VM 9401 destroyed `--purge`; `r116-images` removed and the space measured back (`felhom-backup` 928787076 KiB
+available vs 928787080 before); hub records **gate-blocked** — the cascade was attempted and correctly refused
+`HTTP 409 host … is ONLINE`, with the command recorded for once it ages to DOWN. Secrets shredded.