docs: record PBS-DR self-heal drill live-leg result (auto-healed hands-free)

Reconciler observed waiting_secret across two reports (16:52+17:07 UTC), re-staged
the stored secret at 17:10:00 (no ep0 token, no gen bump); agent re-consumed
17:10:26 and converged (applied) 17:10:28 — no operator click. Demo host untouched
(scoped). Fleet widening remains a deliberate follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HEPuEwyyGDJdcsXLFsTWJn

REPORT.md

@@ -34,12 +34,14 @@ scope + no-re-heal, real store + fake action seam, audit events asserted); `inte
 (re-stage semantics + no-generation-bump guard + `PBSDRHealStates` parsing). All six §10 red-proofs
 (A, A-gen, B, C, D, E) failed exactly their guard test then reverted.
 
-**Deploy + live validation:** built `felhom-hub:0.56.0`, manifest bump + ArgoCD sync; first rollout
+**Deploy + live validation:** built `felhom-hub:0.56.0`, manifest bump + ArgoCD sync (Synced/Healthy);
-scoped to the drill guest via `PBSDRHEAL_ONLY_HOST=demo-vm-felhom-2f4b00` (STOP discipline — the
+first rollout scoped via `PBSDRHEAL_ONLY_HOST=demo-vm-felhom-2f4b00` (STOP discipline). Drill live-leg
-fleet-wide widening is a deliberate follow-up). Drill live-leg: the drill's PBS-DR secret was rolled
+(qm300 rolled to `post_day0_golden136` → stuck `waiting_secret`): the reconciler observed
-back to a stuck `waiting_secret` state; the reconciler re-staged it (audit event) → the agent
+`waiting_secret` across two reports and at **17:10:00 UTC re-staged** the stored secret (event
-consumed → PBS-DR GREEN with **no operator click**. (See CHANGELOG / chat report for the exact
+`pbsdr_selfheal_restaged`; no ep0 token, no gen bump) → agent **re-consumed 17:10:26** → **converged
-outcome.)
+`applied` 17:10:28**, hands-free. The demo host `demo-felhom-01` was never touched (out of scope).
+**Fleet-wide widening (remove `PBSDRHEAL_ONLY_HOST`) is a deliberate operator follow-up**, not done
+this session.
 
 **⚠️ ARCHITECTURE IMPACT:** before this, no automatic recovery existed for a box re-installed/restored
 onto its stable `host_id` — PBS-DR (hence escrow + offsite) stayed silently unconverged until a manual

hub/CHANGELOG.md

@@ -36,6 +36,15 @@ existing ep0 token, **zero churn**. This reconciler closes that gap.
   + fake action seam) and `internal/store/pbsdr_test.go` (re-stage semantics + the **no-generation-
   bump** guard + `PBSDRHealStates` parsing). All six §10 red-proofs verified (mutation → FAIL →
   revert). No agent changes (the agent already self-heals once a secret is consumable).
+- **Live-leg (drill guest qm300):** rolled back to `post_day0_golden136` (the re-install
+  reproduction) → stuck `waiting_secret` (marker gone, `felhom-pbs` absent, hub secret consumed).
+  Deployed scoped via `PBSDRHEAL_ONLY_HOST=demo-vm-felhom-2f4b00`. The reconciler observed
+  `waiting_secret` across two reports (16:52 + 17:07 UTC) and at **17:10:00 re-staged** the stored
+  secret (event `pbsdr_selfheal_restaged`; "no ep0 token minted, no generation bump"); the agent
+  **re-consumed at 17:10:26** and **converged (`state=applied`) at 17:10:28** — hands-free, no
+  operator click. The demo host `demo-felhom-01` was never touched (out of the scoped work set).
+  **Fleet-wide widening (remove `PBSDRHEAL_ONLY_HOST`) is a deliberate operator follow-up** — not
+  done in this supervised session.
 
 ## v0.55.0 — accept the offbox_enlarge_blocked event (Task 3a-fix delivery chain) (2026-07-15)