Record work, banked first: shrink the E-2d row, create the missing capability-map rows

Unconditional and three sessions overdue, so it commits before any code is
touched — E-2d itself stopped at Phase 0 and banked nothing.

E-2d row: 822 words -> 121, and the contradiction resolved. Its State read
CLOSED — PARTIALLY PROVEN while the cell's final sentence read "This row stays
OPEN only for the residue"; a reader could not tell which. It is CLOSED, with
R-116 the single named open leg.

Nothing unique was binned. Three facts existed ONLY in that cell and are moved
into audits/E2D-fresh-vm-2026-07-29.md as a new §1a: the local-lvm fence figures
with the 888 GB nvme alternative, the exactMount subdirectory caveat and why the
subdirectory is nonetheless the safe placement (no durable_id collision), and
the ISO/PAIRING -> DIRECT fall-through derived at source with its line
citations. drill-r50's blocked status was already in both audits.

Capability map: it had ZERO rows for the backup-target work — grep gives 0 hits
for backup_target and one for "E-2" that is a campaign date string. Three
scenario rows added, at today's honest status, not the value hoped for later:

  C. Protection & recovery — installer Case A/B, DEGRADED recorded not hidden
     PROVEN-LIVE, cites E2D-fresh-vm C1+C2
  D. Storage & devices — the offer, and that registration confers no role
     PROVEN-LIVE, cites SESSION-C C4 + the decline path
  F. Notifications & monitoring — the absent-target alarm and its pairing
     PARTIAL, cites SESSION-C C5, leg named, -> R-116

Row F is PARTIAL today per the doc's own strict enum (a leg not exercised live
is PARTIAL with the leg named, never PROVEN-LIVE). A later session may flip it;
this commit must not.

documentation/audits/E2D-fresh-vm-2026-07-29.md

@@ -37,6 +37,36 @@ manual-installer fallback was used.
 **Operator STOP: not required and now retired.** `HUB_PW` is in `~/.config/credentials`; CC created
 the customer and performed the bind itself. The one human step that *was* needed is new — see §6.
 
+## 1a. Phase 0 answers, preserved from the OPEN-ITEMS row
+
+Moved here when the E-2d register row was rewritten (2026-07-29) — the row had grown to ~820 words and
+these were the facts that existed nowhere else. They are inputs to any future drill on this host, not
+narrative.
+
+- **Storage fence.** `local-lvm` on demo-hp is a thin pool, ~144 GB allocated against ~54 GB real,
+  38.8 % used, on a box running a live customer guest — a full thin pool corrupts every guest on it.
+  `local` has only 23.7 GB and sits on `pve-root`. **Use `/mnt/nvme-1tb` (888 GB free).**
+- **The `exactMount` caveat, and the placement decision it forces.** A dir storage created at a
+  SUBDIRECTORY of `/mnt/nvme-1tb` fails the agent's `exactMount` check and reports `disconnected` in the
+  host report. Both E-2d and Session C accepted that: hub-side it is a WARN log line only — no event,
+  no email — and the alternative (a second storage at the live backup target's own mountpoint) risks
+  perturbing the drive-role resolution on a production box. The agent deliberately falls back to a
+  stable store id rather than borrowing the nvme's fs-UUID in this case, so there is **no durable_id
+  collision** with `felhom-backup`; that is what makes the subdirectory the safe choice.
+- **The ISO/PAIRING → DIRECT fall-through, derived at source.** A fresh VM with no baked customer-id
+  lands in PAIRING mode (`scripts/iso/felhom-bootstrap.sh:537-541`), not DIRECT (`:312`), and only
+  DIRECT passes `--customer-id / --mode / --passphrase-file`. On a 200 from `/api/v1/appliance/poll`
+  the pairing loop writes the hub-delivered credentials into the 0600 env, re-sources it and calls
+  `run_direct` **in the same invocation** (`:495-499`), which is the single site that fetches
+  `$INSTALL_URL` (`:322-330`), builds the args (`:334`) and invokes
+  `bash "$SCRIPT_TMP" "${args[@]}"` (`:343`). So the ISO route reaches the identical installer
+  invocation and yields a claimable customer — which is why it is the spine and no manual 1.22.0 run
+  is needed as a separate scenario.
+- **`drill-r50` stays blocked.** Unblocking it means the fixture stops representing anything real
+  (R-93).
+
+---
+
 ## 2. Timeline (VM 9300 `e2d-fresh` on demo-hp, nested PVE)
 
 | UTC | Event |