docs(audit): closure appendix — F2 closed, F4-UX fixed, healthcheck class fixed

Pilot-blockers bundle shipped + live-validated: agent v0.73.0 (F2 mount-role
fallback), controller v0.102.0 (async restore family, F4 re-adjudicated as a UX
bug not a restore bug), catalog healthcheck sweep. All three accepted live on the
demo node.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/audits/CAMPAIGN-nomercy-2026-07-06.md

@@ -291,3 +291,7 @@ live sync smoke `POST /api/sync` → 2xx post-deploy.
 The P9 finale FAIL in the main report was a harness volid-format bug (epoch vs ISO-8601), fixed in
 the DooPlex workspace copy; the DR restore mechanism itself is sound (9201 recovered from R1). The
 other harness mis-scores (H2–H8) stand as written.
+
+---
+**F2 UPDATE (2026-07-06): CLOSED** — `felhom-agent` v0.73.0 mount-role fallback; live-proven eject +
+decommission on `/mnt/teszt_enroll` (both were 403). See `RERUN-p1p3-2026-07-06.md` closure appendix.

documentation/audits/RERUN-p1p3-2026-07-06.md

@@ -130,3 +130,33 @@ backup/restore (P1–P3) defect.
   and per-test isolation (a failed redeploy shouldn't cascade into a later phase). The throwaway
   harness got the pilot-critical coverage; a productionized test harness would fix these.
 - **P4–P9** (storage / fault / reboot / finale) — a later mini-campaign after F2 ships.
+
+---
+
+# Closure appendix (2026-07-06) — pilot-blockers bundle shipped + live-validated
+
+The three findings this campaign + re-run surfaced are now fixed, deployed, and live-accepted on the
+demo node. Commits: agent `7545af8` (v0.73.0), controller `c529a45`/`c…` (v0.102.0), catalog `8ddd3c9`.
+
+- **F2 (agent role gate) — CLOSED.** `felhom-agent` v0.73.0 gave `roleForMountPath` a mount-table
+  fallback (device-keyed + whole-disk containment; Observe-error fail-safe kept). A bind-mounted
+  enrolled user-data drive is no longer mis-classified `system`. Live on `/mnt/teszt_enroll`: eject
+  **200** and decommission-anyway **200** (both were the campaign's 403 "role: system"), no rebind
+  across an agent restart, re-commission, end state == pre-state.
+
+- **F4 (restore UX through the tunnel) — RE-ADJUDICATED + FIXED.** F4 was NOT a product-restore bug
+  (the restore always succeeded); it was that all three restore surfaces were **synchronous** HTTP,
+  so through cloudflared's 100s cap the customer saw an error page (and the offbox one, bounded on
+  `r.Context()`, was actively CANCELED mid-flight). `felhom-controller` v0.102.0 makes the restore
+  family async (background goroutine + instant redirect + a polled progress banner + op-status API).
+  Live: restore POST **0.018s** internal / **0.235s external through the tunnel** (was a 100s error),
+  canary bit-identical.
+
+- **Healthcheck observation — ESCALATED + FIXED.** The vaultwarden `localhost`→IPv6-`::1`
+  docker-`unhealthy`-while-serving quirk was a class (48/53 templates). Catalog sweep →
+  `127.0.0.1` in every healthcheck `test:` line. Live: vaultwarden recreated → docker-`healthy`.
+  (bookstack's residual `unhealthy` is an unrelated app-level HTTP 500, documented.)
+
+**Still open:** agent `deviceRole`/`roleForMountPath` unification (deferred, non-blocking);
+controller restore op-status is in-memory (by design); the P1–P3 harness-v2 quality items and P4–P9
+mini-campaign remain future work.