diff --git a/documentation/pilot/DRILL-GL6-2026-07-08.md b/documentation/pilot/DRILL-GL6-2026-07-08.md
index 504bd2f..72ba96b 100644
--- a/documentation/pilot/DRILL-GL6-2026-07-08.md
+++ b/documentation/pilot/DRILL-GL6-2026-07-08.md
@@ -198,6 +198,33 @@ guard-narrowing to `felhom_guests` recorded as a candidate. GL6-F1/F2 remain v1.
   browser). NOT an install-correctness defect — the install is green; it is a Cloudflare-zone /
   onboarding gap that also matters for Peti (GL-7 / G9).
 
-## Gate 2 — [Viktor]: <pending — install green + F4 proven; 2b blocked on F5 (public DNS), decision below>
+### Phase 2b — bring-to-life (browser, CC-driven) — drive re-enroll + data-visible PASS
+
+DNS unblock: Viktor added a Pi-hole split-horizon A record `felhom.demo-felhom.eu → 192.168.0.105`
+(LAN path to the guest); dashboard then loaded in-browser. (The public Cloudflare path is ALSO
+correct — forced-DoH resolution returned HTTP 200 with the real page; only the client-side resolver
+via the box's broken dnsmasq (F6) was failing.)
+
+- **Dashboard live:** "Demo Ügyfél", 3 running / 56 total apps, mem 1.1/8 GB, backup "Még nem futott".
+- **Drive re-enrollment (CC-driven UI):** Storage → Meghajtók showed all 3 drives detected-but-
+  UNREGISTERED (the agent's registration state was wiped in uninstall #1; the drives + data survived
+  per F2, tagged **"Adatot tartalmaz"**). Clicked **Regisztrálás** on `felhom-usb`
+  (uuid `da9e7089…`, /dev/sdd1) — it moved to **Adattárolók → Aktív**, ext4 /dev/sdd1[/felhom-data]
+  HD710 PRO, additive (no format). **Data-visible PASS:** the witness file is now readable in the
+  guest at `/mnt/felhom-drives/felhom-usb/userdata/actualbudget/canary_hdd_actualbudget.txt`,
+  hash `7b00bc35…` == the Phase-0 value. Additive doctrine proven end-to-end through the real UI.
+- **GL6-F6 (MED, byo coexistence):** the box runs a leftover **broken dnsmasq** (active, bound to
+  `0.0.0.0:53`, but queries time out — empty `/etc/dnsmasq.d/`, no upstream) on a byo host where
+  `lan_resolver` is OFF. It breaks DNS for LAN clients that use the box as a resolver (it broke the
+  drill's browser resolution). Fix pile with F1/F2: byo install/uninstall should stop+mask the
+  leftover dnsmasq. Immediate drill unblock was the Pi-hole entry.
+- **G9/G10 — password is OPERATOR-set, currently UNSET → dashboard OPEN.** Settings → Biztonság:
+  *"A jelszavas védelem nincs beállítva. Kérd az üzemeltetőt a beállításhoz."* The dashboard password
+  comes through the real config pipeline (hub customer-config → controller.yaml bcrypt — the anti-F9
+  path), NOT a customer-set field here. Until the operator sets it the public-reachable dashboard is
+  UNAUTHENTICATED (the known G10 exposure, now confirmed live). Geo-restriction also OFF. **Operator
+  leg pending:** Viktor sets the dashboard password via the hub, then CC verifies login is enforced.
+
+## Gate 2 — [Viktor]: <pending — install+F4+drive-reenroll all green; password-set (operator/hub) is the last 2b leg>
 
 *(Phases 3–6 appended as they run.)*