# REPORT — Session C: R-113, R-114, R-112 proven on a real box; C5 fails on a new defect (2026-07-29)

`RUNBOOK-session-c-2026-07-29.md`. Full evidence: `documentation/audits/SESSION-C-2026-07-29.md`.
Root `REPORT.md` untouched.

## Verdicts

| Claim | Fix | Verdict |
|---|---|---|
| **C4** — offer appears and moves the target | R-112 | ✅ **PASS** |
| **C3** — absent target tells the truth, offers nothing | R-114 | ✅ **PASS** |
| **C5** — `backup_target_absent` + `backup_target_restored` | R-113 | ❌ **FAIL** — generic alarm, specific recovery → **R-116** |

**All three shipped fixes work.** R-113's gate fires in **4 seconds** (E-2d measured zero over 4½
minutes). R-114's message is correct. R-112's banner reaches the customer. C5 fails on a **fourth,
separate defect that was unreachable until R-113 made the gate fire at all.**

## What the drill box ran

Agent **0.114.0 from the Day-0 manifest** — the shipped binary, so C5 tested the real artifact and
closed R-115's observation 1 for R-113. Controller **0.186.0 hand-deployed** after install (§3.1
ruling (a)); the vouched golden bakes 0.185.1, so **C3/C4 prove the code, not the shipped golden** —
that lag is filed against R-115, not a new ID.

## The three headline observables

**R-113** — detach at 18:43:50, gate at **18:43:54**, on exactly the shape that defeated it before:
```
raw   /mnt/mentes               : NOT mounted
bind  /mnt/felhom-drives/mentes : /dev/sdb[/felhom-data]   <- the stale bind SURVIVED
```

**R-114** — with the target absent: absent copy 1, **system-disk copy 0**, **offer block 0**. Both of
E-2d's falsehoods gone.

**R-112** — banner element 1 and the never-configured copy in the HTML; after the wizard, the offer
with `data-path="/mnt/felhom-drives/mentes"`. Healthy renders nothing, **proven positively**: idle
delta 0 `/backup/tiers` calls, page-load delta **+1**, single caller ⇒ the seam ran and chose silence.

**Decline path proven** (registration confers no role), `restart_required:true`, agent did **not**
self-restart, in-flight check recorded before I restarted it, wrapper created the storage at the
drive's own mountpoint.

## C5's failure

```
absent : Event pushed: storage_disconnected (error)      <- GENERIC
return : Event pushed: backup_target_restored (info)     <- SPECIFIC
```

`backup_target_absent` count **0** across the whole run. The alarm and its recovery cannot be matched
— precisely what `notifyDriveReturned`'s own comment forbids.

**Root cause (R-116):** `driveTargetByPath` builds `out[GuestPath] = d.BackupTarget`, but the drive is
**two `/disks` rows** and the flag and the guest path sit on different ones — the `felhom-backup`
storage row carries `BackupTarget: true` and gets a guest path only while classified user-data; the
registry union row carries the guest path and **never assigns `BackupTarget`**. Absent ⇒ they separate
⇒ generic. Return ⇒ they rejoin ⇒ specific. v0.184.1 fixed the *keying*, not this.

## Mirror + over-correction guard — PASS, with a caveat

Non-target drive detached ⇒ `storage_disconnected`, `backup_target_absent` count 0. **Over-correction
guard passes**: both drives present ⇒ 0 ABSENT lines, target stayed healthy — R-113's stricter presence
did not make a healthy drive read absent. **Caveat: the mirror passes trivially**, because the target
also produced the generic event; it confirms no over-correction but cannot confirm discrimination.

## Record

- `OPEN-ITEMS.md` — **R-113, R-114, R-112 → SHIPPED + PROVEN-LIVE**; **R-116 opened** (READY (S), P1);
  **E-2 and E-2d CLOSED as partially proven** with R-116 as the one named open leg, per the runbook's
  §9 decided-in-advance rule.
- `ROADMAP.md` — R-116 under P1.
- **Capability map NOT touched** — it still has **no E-2 / backup-target rows at all**, so no row could
  be moved to PROVEN-LIVE. Creating them is a design act, not a validation act. Third session running
  that this has been noted.

## Teardown

VM destroyed, storage removed, **`pvesm status` after == before** (`local-lvm` 38.78 %), guest 9201 and
`drill-r50` untouched. **Customer ruling: DELETE**; attempted and correctly refused (`host … is
ONLINE`) — deletable once the destroyed host ages to DOWN (>1 h), command recorded in `OPEN-ITEMS.md`.

## What did not happen

`backup_target_absent` never fired, so its severity, Hungarian copy and hub routing remain unexercised
— R-116 blocks them. The offer was accepted via the endpoint the button POSTs, not a browser click (no
browser automation on DooPlex); the rendered control and its non-auto-submission were verified in HTML.
The stale bind still naming a dead device node after return was observed, not investigated.

## The arc

E-2 ends here. Its stated definition of done is **R-106 + R-109, R-108 and D5** — none of which this
detour touched. The detour was worth taking: it found six real defects (R-111 through R-116), four of
them customer-affecting, none of which any unit suite had caught.