docs: REPORT live-validation evidence + F2 verdict; CONTEXT v0.101.0

Scenario A/B env excerpts (restarts=0, _ENABLE_SMTP off/on), sync smoke 2xx,
F2 real-finding verdict. CONTEXT dated to v0.101.0 with open follow-ups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -43,14 +43,33 @@ Both red-proofs demonstrated live (revert → FAIL with the wrong value shown
 `git diff` clean). Green gate `go build ./... && go vet ./... && go test ./...` = **PASS** (exit 0);
 30 passing tests across `internal/sync` + `internal/agentapi` (+2 new test files, +6 new tests).
 
-## Deploy + live validation
-(Filled in during Phase 4/5 of this session — see below; secrets-safe.)
+## Deploy + live validation (executed, real UI pipeline)
 
-- Built + pushed `gitea.dooplex.hu/admin/felhom-controller:0.101.0`; deployed to guest 9201.
-- Scenario A (F1 acceptance): fresh email-off vaultwarden deploy healthy, `_ENABLE_SMTP=false`.
-- Scenario B (regression): app-email ON→healthy (`_ENABLE_SMTP=true`, host+from set) → OFF→healthy.
-- Sync smoke: `POST /api/sync` 2xx.
-- F2 diagnosis verdict: see the felhom.eu audit addendum.
+- Built + pushed `gitea.dooplex.hu/admin/felhom-controller:0.101.0` on 180; deployed to guest 9201
+  via golden/bootstrap → `docker ps` `:0.101.0 Up (healthy)`.
+- Catalog synced (startup sync pulled the F1 template; `grep _ENABLE_SMTP` present in the guest
+  `docker-compose.yml` + `.felhom.yml`).
+- **Scenario A (F1 acceptance):** stopped + removed the crash-looping vaultwarden via the UI
+  `/stop` + `/remove` endpoints (remove correctly 409'd until stopped — "still running"); fresh
+  `POST /api/stacks/vaultwarden/deploy` (app-email default off) → 202 → `running` in ~70s,
+  `docker inspect` **restarts=0**; env: `_ENABLE_SMTP=false`, `SMTP_HOST=`, `SMTP_FROM=` (empty).
+  No crash-loop — the pre-fix instance that was `Restarting` is gone.
+- **Scenario B (regression):** `POST /stacks/vaultwarden/app-email app_email_enabled=on` → recreate
+  → healthy, restarts=0, `_ENABLE_SMTP=true`, `SMTP_HOST=felhom-controller`,
+  `SMTP_FROM=vaultwarden@felhom.eu`; then `app_email_enabled=false` → healthy, `_ENABLE_SMTP=false`.
+  Left OFF. The send-tested ON path is unchanged.
+- **Sync smoke (F3):** `POST /api/sync` → HTTP 200 ("Sablonok naprakészek") — the deadline change
+  is transparent on the healthy path.
+
+## F2 verdict (real finding — agent fix deferred)
+
+Campaign-time agent journal (persistent, survived the P6 reboots):
+`"local-api: protected — decommission refused by role" where=/mnt/teszt_enroll role=system`.
+`roleForMountPath` (agent `disks.go:1031`) fail-safe-returns `system` when no PVE **storage target**
+matches the mount — but `/disks` already classifies teszt_enroll as `user-data`. Two role paths
+disagree; a bind-mounted user-data drive that isn't a standalone PVE storage can't be decommissioned.
+Over-refusal (fail-safe), not a hole → **MEDIUM**. Full write-up: felhom.eu audit addendum. Agent
+untouched (read-only per scope); fix is a separate follow-up task.
 
 ## NOT yet live-validated
 Clean backup/restore (F3-volume-tar / C2 Tier-2) coverage on the now-healthy vaultwarden — awaits