docs: SPIKE — A1 pool-membership read for the stale-lock reaper

Live-probed on felhom-pve under the PRODUCTION scoped token vs root:
enumeration IS pool-filtered (T1: token sees [9201] of 4 guests); pool read
403s naming Pool.Audit (T2); Pool.Audit@/pool/felhom alone suffices (T3,
throwaway identity, torn down); /cluster/resources withholds the pool field
without Pool.Audit (T7); local ownership records all partial (T5).

Recommendation for the A1 impl spec (now unblocked): Pool.Audit added to
FelhomAgentGuest + GET /pools/felhom cross-check in staleLockController,
fail-safe skip on read failure. Appendix: committed-secrets rotation
micro-runbook (operator follow-up).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Felhom scripts — Changelog
 
+## docs — SPIKE: A1 pool-membership read for the stale-lock reaper (2026-07-03)
+
+Findings doc `documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. Live-probed on
+felhom-pve under the PRODUCTION scoped token vs root: LXC enumeration IS already pool-filtered
+(token sees only 9201 of 4 guests); `GET /pools/felhom` 403s naming `Pool.Audit`; a throwaway
+token with ONLY `Pool.Audit`@`/pool/felhom` reads members (minimal delta proven, fully torn down);
+`/cluster/resources` withholds the `pool` field without `Pool.Audit`; local ownership records are
+all partial. Recommendation for the A1 impl spec: add `Pool.Audit` to `PVE_PRIVS_GUEST` in
+`felhom-host-install.sh` (L183) + a `GET /pools/felhom` cross-check in the agent's
+`staleLockController.Guests()`, fail-safe skip on read failure. No script/agent change in this
+commit — docs only. Appendix: committed-secrets (felhom.secret.yaml) rotation micro-runbook,
+operator follow-up.
+
 ## install_skills.py — new: Claude Code skills installer (2026-07-03)
 
 Installs `skills/*/SKILL.md` (felhom-build-deploy, felhom-ui-design, felhom-testing) into