docs: seventh row in the shipped-guarantees table (R-181), versioned workspace CLAUDE.md

Syncs documentation/runbooks/workspace-CLAUDE.md with the workspace root file.
Row 7: the B2 refusal claimed the previous unit was untouched; nothing-deleted
held, untouched was measured false.

Also records WHY it survived review: it passed a full green suite AND three of
its own red-proofs, because every one of them asserted the mechanism inside
captureAllRecoveryUnits and none asserted the consequence across the whole
backup run. The test that would have caught it is the one the fix ships —
fingerprint the tree before and after, and compare.

documentation/runbooks/workspace-CLAUDE.md

@@ -178,7 +178,7 @@ turns a true alarm into one the operator dismisses.
 
 ### A comment asserting an invariant needs a test pinning it, or it is a wish
 
-**Six instances in this project have shipped guarantees the code did not provide** — each survived
+**Seven instances in this project have shipped guarantees the code did not provide** — each survived
 review because the comment read as settled:
 
 | # | Comment | What it claimed | What the code did |
@@ -189,10 +189,14 @@ review because the comment read as settled:
 | 4 | `classifyRunStates` I1 | *"StateStopped means deliberately stopped by the user"* | quiesce stops stacks the same way — a failed restart was silent (F-CRIT-1) |
 | 5 | `inflight.go` | *"a caller that cannot acquire DEFERS"* | the backup caller recorded a failure and paged the operator (F-A1) |
 | 6 | `quiesce.go` | the agent's 409 *prevents* "a spurious failure" | on the start path it produced one (F-A1) |
+| 7 | `recovery_unit.go` B2 refusal (R-181) | *"the previous unit is untouched and NOTHING was deleted"* | *nothing deleted* held; **untouched was measured false** — the floor was checked ONLY in `captureAllRecoveryUnits`, while the two dump legs wrote the bulk into the same tree first and unguarded, so a 182,272 B tar became 2,147,666,432 B under a manifest that had not moved |
 
-Two of these (4 and 5/6) were found by Campaign 8 **on live hardware**, not by review or unit tests
-— #4 had a green, red-proofed test suite over a production path that was broken two independent
-ways. So:
+Three of these (4, 5/6 and 7) were found **on live hardware**, not by review or unit tests — #4 had a
+green, red-proofed test suite over a production path that was broken two independent ways, and #7
+survived a full green suite plus three of its own red-proofs, because every one of them asserted the
+mechanism inside `captureAllRecoveryUnits` and none asserted the **consequence** across the whole
+backup run. The test that would have caught it is the one #7's fix ships: fingerprint the tree before
+and after, and compare. So:
 
 - If a comment states an invariant, **name the test that pins it**, or write one.
 - If an invariant has a stated dependency (*"if either invariant changes, revisit this"*), that is