docs(R-71a): live evidence — 0.162.0 deployed both boxes, settle-gate GO captured

demo-felhom 9201 + demo-hp 9201 (G1 break-glass, secret shredded) both clean +
healthy on 0.162.0 with the settle-gate GO line. Honest B' accounting recorded:
the floor is in-memory (not persisted) so both above-floor boxes logged
"awaiting floor knowledge" then GOed ~10s later once the report ACK landed —
the report-ACK latency the 90s sub-bound is sized to, not a regression. The
zero-wait-when-floor-known invariant stays unit-proven (test E).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N7Drmtm2RzoqbkJZCNSFNQ

CONTEXT.md

@@ -9,7 +9,13 @@
 
 Last updated: 2026-07-24 (v0.162.0 — R-71a: the apply-bridge settle-gate)
 
-> **2026-07-24 — v0.162.0 (R-71a), CODE COMPLETE + green; deploy/live-verify on the publish train.**
+> **2026-07-24 — v0.162.0 (R-71a), SHIPPED + deployed BOTH boxes (demo-felhom 9201 + demo-hp 9201
+> via G1 break-glass), clean+healthy, settle-gate GO line captured on both.** B′ live note: both
+> above-floor boxes GOed correctly but NOT literally first-poll — the floor is in-memory (not
+> persisted), unknown at t=0, so the gate logged `awaiting floor knowledge` then GOed ~10 s later the
+> instant the report ACK landed (report-ACK latency = exactly what the 90 s sub-bound is sized to;
+> zero-wait-when-floor-known is unit-proven, test E). The gate correctly did NOT burn the one-time
+> password before the update picture was clear.
 > The structural fix for the F10 day-0 race (DIAG-f10): the apply-bridge no longer consumes the
 > single-use offsite password while a managed floor-update is in flight or imminent (below floor).
 > New seam `offsiteapply.SettleProvider.SettleState()` + `SettleFunc` adapter over the updater's own