docs(samba): Explorer human leg PASSED — R-7 slice 1 fully PROVEN-LIVE

Viktor confirmed on the demo box: Network -> FELHOM -> both shares open; an
INTERACTIVE Explorer save into dokumentumok succeeded and landed owned 1000:1000
(force user holds for a real Explorer write, not just a scripted one); a write
into the read-only filmek was refused by Windows with the folder left empty on
disk. Capability-map row flipped to PROVEN-LIVE in felhom.eu.

CHANGELOG.md

@@ -59,7 +59,9 @@ verdict), its config is a generated share list, and its roots ride the backup cl
   + `:ro` bind verified on the box → Windows 11 workstation: `Test-NetConnection 445` True, nbtstat
   `FELHOM <00>/<03>/<20> Registered`, `ping FELHOM` resolves, SMB write/read byte-compare PASS, and a
   **write to the read-only share refused with no effect**. SMB-written files land as `1000:1000`.
-  Explorer render is Viktor's remaining human leg.
+  **Explorer leg PASSED (Viktor, 2026-07-18):** both shares open from the Network view; an
+  interactive Explorer save landed owned 1000:1000 and a write into the read-only share was refused,
+  folder left empty. Slice 1 is fully PROVEN-LIVE.
 
 ### Build infra — build root relocated (2026-07-18)
 

CONTEXT.md

@@ -30,8 +30,9 @@ Last updated: 2026-07-18 (v0.144.0 — „Megosztás": LAN SMB file sharing, R-7
 > shaped; teaching them about a share-only stack is a structural change, so it was reported as a design
 > fork rather than improvised (task STOP clause). Live-validated end-to-end through the real endpoints
 > + a Windows 11 workstation (445, NetBIOS `FELHOM` resolves, write/read byte-compare PASS, write to a
-> read-only share REFUSED with no effect, SMB writes land as uid 1000). **Explorer render = Viktor's
+> read-only share REFUSED with no effect, SMB writes land as uid 1000). **Explorer leg PASSED (Viktor): both
-> remaining human leg.** Also: samba is protected in CODE (`config.alwaysProtectedStacks`) because
+> shares open, an interactive Explorer save landed as uid 1000, a write into the read-only share was
+> refused. Slice 1 fully PROVEN-LIVE.** Also: samba is protected in CODE (`config.alwaysProtectedStacks`) because
 > controller.yaml is golden-generated — a side effect is that `monitor.EffectiveProtected` does NOT
 > monitor samba liveness (deliberate: no false alarms while off; see REPORT §9).
 

REPORT.md

@@ -141,6 +141,7 @@ page) from inside guest 9201. No server logic skipped — only client rendering.
 | **Write-refused (read-only)** | write to `\\192.168.0.127\filmek` **rejected**; folder still empty on the box (non-effect proven) |
 | `force user` promise | SMB-written `r7.txt` owned **1000:1000** on the box |
 | WS-Discovery | ProbeMatch from `192.168.0.127` **PASS** |
+| **Explorer (human, Viktor)** | both shares open from the Network view; interactive Explorer **save** landed owned `1000:1000`; write into the read-only share **refused**, folder still empty |
 
 #### Two real bugs caught by live validation (fixed + regression-tested)
 
@@ -155,9 +156,12 @@ page) from inside guest 9201. No server logic skipped — only client rendering.
 
 ### 8. NOT yet live-validated
 
-- **Explorer render — Viktor's human leg.** Network view shows `FELHOM`, double-click opens both
+- ~~Explorer render~~ — **PASSED 2026-07-18 (Viktor).** Network → FELHOM → both shares open. He went
-  shares. Everything objective around it passed (ProbeMatch, 445, NetBIOS name resolution, by-name
+  further than the scripted leg: a real Explorer **save** into `dokumentumok` succeeded and landed on
-  mount), so this is UX confirmation, not a mechanism gate. Stack + both shares are live on the demo box.
+  the box owned **1000:1000** (so `force user` holds for an interactive Explorer write, not just a
+  scripted one), and a write into the read-only `filmek` was refused by Windows
+  ("Destination Folder Access Denied") with the folder left **empty** on disk. Slice 1 is fully
+  PROVEN-LIVE; the capability-map row is flipped.
 - **Share data in a real backup run** — blocked by the §4 design fork (classified, not executed).
 - **Symlink-escape guard on Linux** — unit test SKIPs on Windows (no privilege).
 - Drive-disconnect behaviour live (unit-tested only); multi-root share sets; SMB throughput/signing.