Docs: v2 verification status; vmbox can emulate RTC wake now

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

DOCS-vmbox.md

@@ -39,8 +39,13 @@ it fails, the harness stops with exit 2 and dumps the log.
 - **The phone.** The entire dismiss sequence — two NFC tags, the step counter,
   the challenges, the 5-minute bypass — lives in `phone_app/` and is verified
   on the Pixel 6a, never here. This harness knows nothing about it.
-- **The bootloader.** The guest is BIOS/GRUB, this PC is UEFI. Any
-  firmware/ESP work goes straight to the host.
+- **The bootloader and the real firmware.** The harness guest is BIOS/GRUB
+  (`vm new --uefi` exists since 2026-10-01, OVMF, but is not this board's
+  firmware). `vm wake` emulates the RTC power-on from poweroff/hibernate, so
+  the arming and the boot/resume units are testable; whether *this* board
+  wakes is host-only (S4 verified 2026-10-01, `DOCS-wake-enforcement.md`).
+- **The ring's audio.** The guest gate plays to `snd-dummy`; the speakers,
+  and a card held busy by the user's PipeWire, are host-only.
 - **A green run is not host verification.** Report it as "passed in vmbox, not
   verified on the host", always.
 

DOCS-wake-enforcement.md

@@ -137,6 +137,23 @@ PC (`events.jsonl` `event`): `fallback_tick` (only on decision change),
 `rtc_skip`, `firebase_unreachable`, `escape_seen`, `penalty_written`,
 `penalty_cancelled`, `audit_written`.
 
+## Verification status (2026-10-01)
+
+- vmbox gate (`scripts/vmbox/harness.sh`, `guest_cases_v2.sh`): install,
+  timers, root ring unit on `snd-dummy`, sudoers merge, power-key drop-in,
+  a real `rtcwake` arm, uninstall — all pass. Passed in vmbox, then installed
+  on the host.
+- Host: S4 RTC wake verified twice; both ring backends start and stop. The
+  root ALSA ring got `Device or resource busy` while PipeWire still held the
+  card seconds after a PipeWire ring — at night the card is idle and opens
+  (a silent root `aplay` passed), but a stream left open overnight would
+  keep it busy. **Open:** what the root ring does about a held card is
+  kuhy's call (killing the holder was refused by the auto-mode classifier).
+- Emulator (`wake_alarm_api36`): exact A+15 check hidden from the system
+  next-alarm, headless `ring_started` on a heads-up ring, boot-path miss
+  (phone off before the alarm) → lockdown through tomorrow, escape hatch.
+  Not yet on the Pixel: the real focus-owner reaction and Firebase publish.
+
 ## Evidence for Claude
 
 `python -m wake_alarm._audit [YYYY-MM-DD]` and the 11:05 timer write