docs(report): correct two overstated claims; 30-min check passed clean; doc rows flipped

REPORT.md

@@ -9,7 +9,7 @@ Session date: **2026-07-21**. Executed on DooPlex as `kisfenyo`.
 | **Part 1 — R-48 restore wizard (v0.154.0)** | **SHIPPED** `3a9d744`, image published, deployed via the floor save. |
 | **v0.155.0 — follow-up fix** | **SHIPPED + DEPLOYED** `9d1b498`. Fixes a real defect in v0.154.0 found by the operator on the first live click-through. |
 | **Part 2 — capability-map cell** | **DONE** `ce8c539`. |
-| **STOP-1 — floor save + single-fire** | **BANKED.** Exactly one swap, no rollback, healthy. §6. |
+| **STOP-1 — floor save + single-fire** | **BANKED.** Exactly one swap over a 39-min window, no rollback, healthy. §6. Doc rows flipped `11ead4b`. |
 | **Live click-through + Ellenőrzés** | **DONE by the operator**, and re-run endpoint-level after the v0.155.0 fix. §7. |
 | **Part 3 — agent 0.90.1** | **STOPPED, ruled.** Not published, not deployed. §8. |
 
@@ -144,7 +144,12 @@ Operator saved global floor → v0.154.0. Timeline (host CEST / guest UTC, 2 h o
 | `new controller healthy` | **1** |
 | rollback / swap-failed / unhealthy | **0** |
 | container `RestartCount` | **0** |
-| bootstrap unit `NRestarts` / `Result` | **0** / `success` |
+| bootstrap unit `Result` | `success` |
+
+> **Correction — I over-claimed one line.** I originally cited the bootstrap unit's `NRestarts=0` as
+> no-storm evidence. It isn't: the unit is `Restart=no`, so `NRestarts` is 0 by construction and would
+> read 0 during a storm too. Dropped. The real no-storm evidence is the agent-side swap count and the
+> container's own `RestartCount=0`.
 
 `UpdateState` persisted `status: success`, `0.153.0 → 0.154.0`, `initiated_by: auto-floor`.
 `VerifyStartup` banked it on the next boot (`Post-update startup: update successful`), and the 06:57:52
@@ -152,12 +157,20 @@ periodic check reported `Current version 0.154.0 is up to date` — the anti-fla
 now that current ≥ floor. **Exactly one swap, no storm, no rollback.** This closes the leg R-23(a) was
 missing: the earlier floor save proved nothing because it targeted an already-running version.
 
-> **Methodological caveat, disclosed:** the 30-minute no-re-attempt window was **contaminated by my own
-> action** — I hand-deployed v0.155.0 at ~07:16Z, mid-window, which restarted the container and the
-> bootstrap unit. The *agent-side* counters are unaffected and remain the load-bearing evidence (a
-> hand-deploy writes `/etc/felhom-controller-image` and restarts the unit directly via `pct exec`, never
-> through `SwapController`), but the *container-side* counters after 07:16Z reflect my deploy, not the
-> self-update. Between 06:57 and 07:16 — 19 uninterrupted minutes — there was no second attempt.
+**30-minute no-re-attempt check — PASSED, and my earlier caveat was broader than the facts.** Recounted
+over 06:50 → 07:29 (39 min): `controller swap requested` = **1**, agent-driven bootstrap restarts = **1**.
+
+I hand-deployed v0.155.0 at `07:17:10Z`, inside the observation window, and flagged that as
+contaminating the result. Having checked the scope: it contaminates **`StartedAt` only**. A hand-deploy
+writes `/etc/felhom-controller-image` and restarts the unit directly via `pct exec` — it never goes
+through `SwapController` — so the swap-count assertions, which are the actual evidence, hold
+uncontaminated across the whole window. I was right to flag it and wrong about how much it cost; the
+window is clean, not merely the 19 minutes I claimed.
+
+**An unplanned bonus confirmation came with it.** After the hand-deploy the box ran **0.155.0 against a
+0.154.0 floor** — i.e. above the floor — and the updater logged `Current version 0.155.0 is up to date`
+and did nothing. That is Scenario B ("at/above floor does NOTHING — must not chase latest") confirmed
+live, which no test in this session set out to produce.
 
 ## 7. Live validation
 
@@ -210,9 +223,10 @@ this host?" is unanswerable from any manifest.
 - Capability map row 61 → **PROVEN-LIVE** (`ce8c539`).
 - ROADMAP: **R-48 → SHIPPED**; R-39 cheap half recorded as closed-in-field with the publish cancelled;
   **R-50b** filed (`c35da9d`).
-- **Not flipped:** the R-23(a) map row and the "config/state round-trips in seconds" row — the
-  evidence now exists (§6), so these are ready to flip; held only because the 30-min window carries the
-  disclosed caveat above. Recommend flipping with the 19-minute clean interval cited explicitly.
+- **FLIPPED** (`11ead4b`): R-23(a) → **BANKED in full** (only the cosmetic (b) leg remains), and the
+  capability-map row "Config/state change round-trips in **seconds**" → **PROVEN-LIVE (2026-07-21)**.
+  That row's residual PARTIAL was explicitly "the R-23 operator-UI save→apply leg alone", which §6
+  closes. Both rows carry the hand-deploy disclosure and the bonus at/above-floor confirmation.
 
 ## 10. Remaining — human