docs(pilot): GL-6 COMPLETE — Gate 6 GO, summary, findings ledger, deviations

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/pilot/DRILL-GL6-2026-07-08.md

@@ -334,3 +334,53 @@ Real `--uninstall --vmid 9201` (typed confirm), no busy prop this time.
 
 
 *(Phases 3–6 appended as they run.)*
+
+## Gate 6 — [Viktor]: **GO — DRILL COMPLETE.**
+
+Demo healthy on normal life. Two full destroy/rebuild cycles proven (byo #2, appliance #6), both
+uninstalls clean, drive data intact ALL THREE checks, armed-key chain proven, C7 live-validated.
+
+## Summary — what GL-6 validated
+
+**Key-pin chain (GL-1's whole point) — legs 1–4 all green:** box==repo==password-manager fingerprints
+(op `7YqN…`, rec `/ixg…`); signers ARMED from first boot on both byo + appliance installs; the pinned
+operational key AUTHORIZED a real signed `agent_update` op end-to-end (round-trip 0.76.0→0.76.1→0.76.0
+with the real key, verify vs pinned signer + nonce, A/B swap, crash-guard silent).
+
+**Go-live gates now LIVE-VALIDATED on real hardware:** G2 (byo profile — disclosure+ack, no root@pam,
+config asserts), G4 (preflight guards + verify pool/ACL asserts incl. **C7 firing on real drift**),
+G5 (mandatory byo caps applied to the guest), G6 (uninstall gap-closure — KEPT/WIPED statement,
+plain-umount busy-drive handling, self-update-artifact removal, **data intact ×3**), G7 (this drill).
+**G1 DONE** (published chain consumed end-to-end via anonymous fetch — the v1.11.2 Gate-0 ruling —
++ armed keys proven). **G12** re-exercised (restore-test `mount_parity: ok` on PBS 5m35s + local tiers).
+**G9** rehearsed (dashboard password is operator-set-via-hub; location confirmed) → **deferred to GL-7**;
+**G10** (open dashboard until the operator sets a password) → GL-7 prerequisite.
+
+## Findings ledger (post-drill installer pile unless noted)
+
+| ID | Sev | What | Status |
+|----|-----|------|--------|
+| **F4** | HIGH | `--resume` skipped producer steps → config missing hub.host_id/proxmox.token (daemon crash-loop) + provision `-rootfs-grow ""` | **FIXED v1.11.3, live-proven** (dry + the single-shot appliance install) |
+| F1 | MED | `/etc/felhom-agent/` + `agent.json.bak-*` (secret-bearing) survive uninstall when prior `.bak` configs exist | open — purge config dir/.bak in uninstall 4b |
+| F2 | MED | per-drive `mnt-*.mount` units + `/mnt/<name>` primary mounts survive uninstall ("physically removable" overclaims) | open — uninstall stop+remove the agent's `mnt-*` units |
+| F3 | MED | byo FRESH install on a host with the OWNER's guests trips the populated-host leaf guard (`pct list | grep -q .`), needs `--allow-new-leaf` | GL-7 command + candidate guard-narrow to `felhom_guests` |
+| F5 | — | initial "public dashboard DNS absent" — **MISDIAGNOSIS**: the `*.demo-felhom.eu` wildcard works (HTTP 200 via DoH); real cause was F6 | superseded by F6 |
+| F6 | MED | leftover **broken dnsmasq** (active on `:53`, queries time out) on a byo host (`lan_resolver` off) breaks LAN-client DNS | open — byo install/uninstall stop+mask leftover dnsmasq |
+| F7 | MED | R2 pool re-assertion is **bring-up-only** (`bringup.go:498`); no continuous membership reconcile → out-of-band drift doesn't auto-heal (repair via `--adopt-pool`) | open — candidate periodic membership reconcile |
+| — | LOW | re-provision changes the guest DHCP IP (.105→.139) → manual LAN DNS entries go stale | GL-7 note (reserve lease / use lan_resolver) |
+| — | LOW | legacy `felhom-agent.v*.bak` binaries survive the uninstall `.bak-*` glob | trivial (demo-box history only) |
+| — | LOW | snapshot-mode backup briefly flashes "Protected container not running" (monitor false-positive during freeze) | cosmetic |
+
+**Honest leftovers (unchanged, still open):** S5 customer-data DR drill; G12 parity-on-real-drift +
+PBS-tier runtime characterization; CGNAT true-sim retest; Impl-3 shared-box format gate; OOB spike.
+
+## Drill deviations (recorded)
+
+1. **v1.11.2 shipped mid-drill (Gate-0 ruling):** empty customer git creds → anonymous artifact fetch
+   (the artifacts are world-readable by ruling; sha256 stays the integrity root). All 12 fetch targets
+   200-anon-validated first.
+2. **F4 fixed mid-drill (v1.11.3, Viktor HOLD):** the resume-correctness bug, live-proven fixed.
+3. **Phase-3 delivery is operator-driven, not [CC]:** the hub pod has no direct-insert tool and the
+   admin-enqueue API is global-key-gated, so Viktor signs+enqueues in one `felhom-opsign -upload` command
+   (`-hub-key` = the hub `report_api_key`, not the web login — a GL-7 clarity note).
+4. **G9 password + full app redeploy deferred to GL-7** (operator/customer curation).