docs(report): STOP-2 DONE + PROVEN — the R-39 chain closed in 13 seconds

REPORT.md

@@ -17,24 +17,40 @@ STOP-1 evidence and the four red-proofs).
 | Hub v0.68.1 | **SHIPPED + DEPLOYED** — fixes the Configuration layout the v0.68.0 field broke |
 | STOP-1 | done + verified |
 | **STOP-3 — manifest save** | **DONE by the operator 2026-07-21 08:31:12Z.** All six fields persisted, including `artifact_wrapper_sha256 = 104db0a4…` (matches the agent's reported hash → drift gauge reads **ok**) and `artifact_min_agent = 0.91.2`. |
-| **STOP-2 — live re-issue** | **NOT DONE — the wrong Re-issue was pressed.** The hub recorded `offsite_reissued` (the restic/Hetzner offsite credential), not the PBS-DR one. Evidence: `host_pbs_secrets` is untouched (created + consumed 2026-07-18, `generation = 0`) and the `pbs_dr` descriptor still carries **no** `secret_generation` key. See §STOP-2 below. |
+| **STOP-2 — live re-issue** | **DONE + PROVEN 2026-07-21.** Chain closed in **13 seconds**; see below. |
 
-## STOP-2 — what actually happened, and the side effect
+## STOP-2 — the proof (the whole task's reason to exist)
 
-The button pressed was the **offsite** re-issue, not **PBS DR**. Hub events at 08:29:29Z:
-`offsite_reissued` followed immediately by `escrow_stale`
-("A helyreállítási kulcs-letét elavult az offsite jelszó cseréje miatt").
+The operator pressed **Re-issue PBS credentials**. The identical click on 2026-07-18 did nothing.
 
-**Consequence that needs an action:** rotating the offsite restic password makes the escrow blob seal
-a password that no longer opens the repo, so the hub correctly stops advertising "ceremony done"
-(the designed v0.57.0 `stale_at` behaviour — not a bug, but a real follow-up). **The recovery-code
-ceremony has to be re-run** before the offsite leg is trustworthy again.
+```
+hub   08:39:31Z  fresh mint, generation 0 -> 1
+                 descriptor gains "secret_generation": 1
+                 (token_id + fingerprint BYTE-IDENTICAL — the re-key shape that was invisible)
+agent 10:39:34   felhom-pbs-apply read felhom-pbs      <- leg (b): the read that was impossible
+agent 10:39:38   ERROR "REJECTED ... applied and DEAD"  previous_state=applied
+                                                        <- leg (c): the R-39 state, loud at last
+hub   08:39:45Z  consumed_at stamped
+agent 10:39:45   "one-time token secret consumed" secret_len=36
+                                                        <- leg (a): NO short-circuit
+agent 10:39:45   felhom-pbs-apply reconcile (set-only, no --server)
+agent 10:39:47   "pbsdr: converged" state=applied
+```
 
-**PBS-DR is untouched and healthy** — a live probe with the stored credential still returns 200 and
-the secret file's mtime is unchanged (2026-07-18 20:28:52), which is exactly consistent with "no PBS
-re-key happened".
+(host CEST = UTC+2; hub timestamps UTC.)
 
-The R-39 proof therefore still needs the **PBS DR** re-issue specifically.
+**Corroboration:** the agent marker hash moved to `afbb3b41…` — in the failure it was *byte-identical*
+to the pre-reissue marker, which was the single-line proof of the defect. `consumed_at` stamped. The
+on-disk secret's mtime moved `2026-07-18 20:28:52` → `2026-07-21 10:39:45`. A live probe with the NEW
+credential returns **200**. Three consecutive hub reports trace the entire state machine
+`applied → auth_failed → applied`. **Zero** `pbsdr_selfheal` escalations fired, with exactly ONE mint,
+ONE consume and no `consumed-failed.json` — the box healed through the descriptor path before the
+damper was ever needed.
+
+**First attempt, worth recording:** the operator initially pressed the **offsite** re-issue — there are
+two distinct Re-issue actions and my instruction said only "press Re-issue". Harmless to PBS-DR, but it
+rotated the restic password and correctly marked the escrow **stale**, so the recovery-code ceremony
+had to be re-run (done). Name the surface explicitly in future runbook steps.
 
 ## What shipped hub-side