docs: REPORT live-validation evidence + F2 verdict; CONTEXT v0.101.0

Scenario A/B env excerpts (restarts=0, _ENABLE_SMTP off/on), sync smoke 2xx,
F2 real-finding verdict. CONTEXT dated to v0.101.0 with open follow-ups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -7,7 +7,18 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-03 (docs: CLAUDE.md refreshed — stable orientation; runbooks live in the felhom skills)
+Last updated: 2026-07-06 (v0.101.0 — no-mercy campaign findings F3 + F2-surfacing)
+
+> **2026-07-06 — v0.101.0: no-mercy campaign findings.** F3: git subprocess deadline in
+> `internal/sync/sync.go` (`gitCmdTimeout=120s`, `exec.CommandContext`) — a hung remote no longer
+> wedges `syncing=true` until restart. F2 evidence gap: `agentapi.EjectDisk`/`Decommission` now use
+> `postWithStatus` + `refusalError` so the agent's `"…refused (role: X)"` reaches the operator
+> instead of a bare `HTTP 403`. Companion: catalog `d86e256` (F1 vaultwarden `_ENABLE_SMTP` boot-gate
+> — fresh email-off deploys crash-looped; live-validated Scenarios A/B on 9201). F2 diagnosed to a
+> verdict (REAL finding — `roleForMountPath` over-refuses an enrolled user-data drive that isn't a
+> PVE storage; fail-safe direction; agent fix DEFERRED). Full triage:
+> `felhom.eu/documentation/audits/CAMPAIGN-nomercy-2026-07-06.md` addendum. OPEN follow-ups: agent
+> `roleForMountPath` fallback; the targeted P1–P3 campaign re-run for clean backup/restore coverage.
 
 > **2026-07-05 — v0.100.0 (TASK C2): drill finding F2 CLOSED — one-click class-C file restore.**
 > `POST /backup/tier2/restore` + "Fájlok visszaállítása" on the Tier-2 row: in-place, ADDITIVE-ONLY

REPORT.md

@@ -43,14 +43,33 @@ Both red-proofs demonstrated live (revert → FAIL with the wrong value shown
 `git diff` clean). Green gate `go build ./... && go vet ./... && go test ./...` = **PASS** (exit 0);
 30 passing tests across `internal/sync` + `internal/agentapi` (+2 new test files, +6 new tests).
 
-## Deploy + live validation
-(Filled in during Phase 4/5 of this session — see below; secrets-safe.)
+## Deploy + live validation (executed, real UI pipeline)
 
-- Built + pushed `gitea.dooplex.hu/admin/felhom-controller:0.101.0`; deployed to guest 9201.
-- Scenario A (F1 acceptance): fresh email-off vaultwarden deploy healthy, `_ENABLE_SMTP=false`.
-- Scenario B (regression): app-email ON→healthy (`_ENABLE_SMTP=true`, host+from set) → OFF→healthy.
-- Sync smoke: `POST /api/sync` 2xx.
-- F2 diagnosis verdict: see the felhom.eu audit addendum.
+- Built + pushed `gitea.dooplex.hu/admin/felhom-controller:0.101.0` on 180; deployed to guest 9201
+  via golden/bootstrap → `docker ps` `:0.101.0 Up (healthy)`.
+- Catalog synced (startup sync pulled the F1 template; `grep _ENABLE_SMTP` present in the guest
+  `docker-compose.yml` + `.felhom.yml`).
+- **Scenario A (F1 acceptance):** stopped + removed the crash-looping vaultwarden via the UI
+  `/stop` + `/remove` endpoints (remove correctly 409'd until stopped — "still running"); fresh
+  `POST /api/stacks/vaultwarden/deploy` (app-email default off) → 202 → `running` in ~70s,
+  `docker inspect` **restarts=0**; env: `_ENABLE_SMTP=false`, `SMTP_HOST=`, `SMTP_FROM=` (empty).
+  No crash-loop — the pre-fix instance that was `Restarting` is gone.
+- **Scenario B (regression):** `POST /stacks/vaultwarden/app-email app_email_enabled=on` → recreate
+  → healthy, restarts=0, `_ENABLE_SMTP=true`, `SMTP_HOST=felhom-controller`,
+  `SMTP_FROM=vaultwarden@felhom.eu`; then `app_email_enabled=false` → healthy, `_ENABLE_SMTP=false`.
+  Left OFF. The send-tested ON path is unchanged.
+- **Sync smoke (F3):** `POST /api/sync` → HTTP 200 ("Sablonok naprakészek") — the deadline change
+  is transparent on the healthy path.
+
+## F2 verdict (real finding — agent fix deferred)
+
+Campaign-time agent journal (persistent, survived the P6 reboots):
+`"local-api: protected — decommission refused by role" where=/mnt/teszt_enroll role=system`.
+`roleForMountPath` (agent `disks.go:1031`) fail-safe-returns `system` when no PVE **storage target**
+matches the mount — but `/disks` already classifies teszt_enroll as `user-data`. Two role paths
+disagree; a bind-mounted user-data drive that isn't a standalone PVE storage can't be decommissioned.
+Over-refusal (fail-safe), not a hole → **MEDIUM**. Full write-up: felhom.eu audit addendum. Agent
+untouched (read-only per scope); fix is a separate follow-up task.
 
 ## NOT yet live-validated
 Clean backup/restore (F3-volume-tar / C2 Tier-2) coverage on the now-healthy vaultwarden — awaits