diff --git a/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md b/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
index 4ec94d3..9e81ca5 100644
--- a/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
+++ b/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
@@ -1,12 +1,18 @@
 # SPIKE — safe visibility + enrollment of non-OS (customer data) drives (2026-07-01)
 
-> **STATUS:** SQ3 (format-safety) IMPLEMENTED as **Impl-1** — felhom-agent **v0.54.0** (unclaimed-disk
-> `Format` guard `internal/storage/claim.go` + guarded-mkfs wrapper `configs/felhom-mkfs-guarded.sh` +
-> sudoers swap) + host-install **v1.8.0** (installs the wrapper). Live-validated on felhom-pve
-> (refuses OS disk / LVM PV, raw mkfs denied, throwaway sdd formats). SQ1/SQ4/SQ5 (PVE-storage-free
-> registry enrollment + raw-scan candidate endpoint + wizard rewiring) = **Impl-2** (pending). SQ3's
-> shared-box operator gate for self-serve format = **Impl-3** (pending). See the felhom-agent + felhom.eu
-> REPORTs + `RUNBOOK-usb-enrollment-3bfix-2026-07-01.md`.
+> **STATUS:**
+> - **SQ3 format-safety → Impl-1** (felhom-agent v0.54.0 unclaimed-disk `Format` guard + guarded-mkfs
+>   wrapper + sudoers swap; host-install v1.8.0 installs the wrapper). Live-validated.
+> - **SQ4 (candidate discovery) + SQ5 (registry-sourced tracking, decouple from Observe) → Impl-2a**
+>   (felhom-agent **v0.55.0**): `GET /disks/candidates` (raw-device discovery via the Impl-1 filter) +
+>   `RegistryKnownTargets` (watchdog Known from intent registry + `.mount` units, not PVE storages) +
+>   idempotent existing-drive migration. Live-validated on felhom-pve (candidates returns only /dev/sdd;
+>   the registry-sourced watchdog detects + self-heals a drive; no false detach).
+> - **PENDING: Impl-2b** — the controller wizard rewiring (consume `/disks/candidates`) + enroll
+>   orchestration + a live end-to-end raw enrollment (format via the Impl-1 guarded path). **Impl-3** —
+>   the shared-box operator gate for self-serve format.
+>
+> See the felhom-agent + felhom.eu REPORTs + `RUNBOOK-usb-enrollment-3bfix-2026-07-01.md`.
 
 **Class:** SPIKE (read-only investigation + design; no product code, no version bump). **Repos read:**
 felhom-agent v0.53.0 @ `7639ab5` (read-only). **Test bed:** felhom-pve — 1 OS SSD (`sda`), 2 enrolled