docs: record OS operational-snapshot binding (real OS data on cube, survives power cycle)

STARTUP-README.md

@@ -56,8 +56,14 @@ is real. Each must be reproduced live, not asserted.
    boot history to `/cubefs/c200/z001|z002|z003`) and `cube-os-klog.service`
    (streams kernel ring buffer to `/cubefs/c200/z004`) run at boot; both enabled
    + active; state survives a FULL power cycle (verified 2026-08-13: rebooted the
-   VM, boot history showed pre- + post-reboot lines, manifest unchanged).
-   **STATUS: DONE (auxiliary layer; not yet the root fs).**
+   VM, boot history showed multiple boots, manifest unchanged).
+   **ALSO (2026-08-13): real OS operational data** — `cube-os-snapshot.service` +
+   `cube-os-snapshot.timer` (every 5 min + 30s after boot) write genuine OS state
+   (running units, network, resources, journal) into `/cubefs/c200/z010/y001/xNNN`
+   (rolling 3-digit counter, x-axis is u16→3-digit per cubefs path model).
+   Verified: snapshot survives daemon restart; the OS wrote a NEW snapshot on a
+   fresh boot after a full power cycle; inode == packed CZYX. **STATUS: DONE
+   (auxiliary layer; not yet the root fs).**
 
 ---
 
@@ -117,12 +123,18 @@ missing.
 - Phase 3 (optional hardening): the `cube open` primitive currently needs a key
   cell present; wire a real key-management flow (Null-space key cells issued at
   boot) so OS services can open records by CZYX + flags unattended.
-- Boot substrate (next deepening): bind a real OS tree (e.g. `/var/log`,
-  `/etc` config, the boot manifest) so the OS reads/writes through the cube by
-  default — currently the cube holds OS *state* (manifest/identity/klog) but the
-  root fs is still ext4. The magic-prefix "open by CZYX" FUSE passthrough is the
-  natural next step (a path like `/cubefs/.czyx/200.1.1.1` resolves directly to
-  the coordinate).
+- Boot substrate (next deepening): make the cube the OS's *default* storage for a
+  real tree — e.g. have a service write `/etc` or `/var/log` operational files
+  through the cube by default. Currently the cube holds OS *state* (manifest/
+  identity/klog/snapshots) but the root fs is still ext4. The magic-prefix
+  "open by CZYX" FUSE passthrough is the natural next step (a path like
+  `/cubefs/.czyx/200.1.1.1` resolves directly to the coordinate), and a
+  loop/overlay over a cube-backed file would let the OS treat the cube as a real
+  block device.
+- IMAGE PROVISIONING CAVEAT: the systemd units + scripts live in the VM guest
+  filesystem, NOT in the CUBELinux-2 git repo. If `build_vm.sh` bakes a fresh
+  image, re-add these units (cube-os-state, cube-os-klog, cube-os-snapshot +
+  timer) to the image provisioning, or they won't survive a from-scratch rebuild.
 - OPTIONAL (cosmetic): launch the "CUBE Shell" desktop launcher in the VM to
   confirm end-to-end at the file level (wiring already verified:
   cube-term → cubec → /run/cube/cube.sock).