docs(R-117 Part 1): a health check issues no block I/O — and narrow one R-116 claim

Two record items, banked before any Go file is opened.

1. CLAUDE.md gains a standing rule beside the seam-wiring rule: a health check
   issues no block I/O. A probe that touches a wedged device enters
   uninterruptible sleep, survives SIGKILL, and cannot be recovered until the
   device returns or the host reboots — so `systemctl restart` hangs too. A
   timeout protects the caller's control flow and nothing else. Liveness is
   decided from /proc and kernel state.

   Measured in the R-117 spike §6.3: D state 3m50s after kill -9; a buffered
   write with no fsync blocked too (O_CREAT needs journal access); statfs and
   getdents returned HEALTHY on a namespace that EIOs every byte.

   Repeated as a one-line pointer in felhom-agent/CLAUDE.md, because health
   checks are written in that repo and felhom.eu/CLAUDE.md does not load in an
   agent-only session — a standing rule that does not load where it binds is the
   inert-seam shape applied to a rule.

2. The R-116 row gains the clause the spike recommended but did not apply. Its
   verdict stands and every input to the pairing fix is configuration-derived.
   But the over-correction window's degraded:false was read off a drive whose
   bind was dead, so it evidences "the gate did not over-fire", not "the drive
   was healthy". The two RETURNED lines remain a genuine positive observable, so
   rule 3 is still satisfied. Nothing else about the row changed.

CLAUDE.md

@@ -56,6 +56,14 @@ UI. Package map, helpers, seams, extension points: **`REUSE.md`** (e.g. new even
   (`{{if .Flag}}` around a button/form/script) ships with a render test per branch of the gate —
   handler tests that POST directly prove nothing about reachability. The v0.70.0 ghost-delete was
   fully implemented server-side and fully dead UI because the button sat inside the wrong gate.
+- **A health check issues no block I/O.** A probe that touches a wedged device enters uninterruptible
+  sleep, survives `SIGKILL`, and cannot be recovered until the device returns or the host reboots — so
+  `systemctl restart` hangs too. A timeout protects the caller's control flow and nothing else: the
+  blocked thread remains. Liveness is decided from `/proc` and the kernel's own state, never by reading
+  or writing the filesystem. Measured, R-117 spike §6.3
+  (`documentation/audits/SPIKE-r117-bind-liveness-2026-07-30.md`): a probe stayed in `D` state 3m50s
+  after `kill -9`; a buffered write with no `fsync` blocked too (`O_CREAT` needs journal access); and
+  `statfs`/`getdents` returned **healthy** on a namespace that `EIO`s every byte — fast, and wrong.
 - UI/design work (tokens, gates, copy rules): use the `felhom-ui-design` skill.
 - **Logging**: levels/English/no-secrets rules per `documentation/runbooks/logging-conventions.md`
   (DEBUG = flow detail, INFO = state change + duration; logs are operator-tier English; keys never