diff --git a/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md b/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
index 9e81ca5..ddbdb44 100644
--- a/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
+++ b/documentation/audits/SPIKE-drive-enrollment-2026-07-01.md
@@ -8,9 +8,13 @@
 >   `RegistryKnownTargets` (watchdog Known from intent registry + `.mount` units, not PVE storages) +
 >   idempotent existing-drive migration. Live-validated on felhom-pve (candidates returns only /dev/sdd;
 >   the registry-sourced watchdog detects + self-heals a drive; no false detach).
-> - **PENDING: Impl-2b** — the controller wizard rewiring (consume `/disks/candidates`) + enroll
->   orchestration + a live end-to-end raw enrollment (format via the Impl-1 guarded path). **Impl-3** —
->   the shared-box operator gate for self-serve format.
+> - **SQ4 wizard wiring + end-to-end raw enrollment → Impl-2b DONE** (controller **v0.95.0**: wizards
+>   fetch `/api/disks/candidates` + `resolveEnrollUUID`; agent **v0.56–0.58**: raw-drive first-class —
+>   durableIDForMount / ReassertGuestBinds / HostReader wiring / `/disks` GuestPath+BoundUnderParent).
+>   Live-validated on felhom-pve: raw `/dev/sdd` enrolled via the real UI → **"Aktív"** (mount+bind+intent+
+>   guest-bind+health-tracked). KNOWN follow-up: `runStorageInit` doesn't poll the agent's detached-format
+>   status, so a SLOW-device format doesn't complete the enroll in one flow (validated via the attach path).
+> - **PENDING: Impl-3** — the shared-box operator gate for self-serve format.
 >
 > See the felhom-agent + felhom.eu REPORTs + `RUNBOOK-usb-enrollment-3bfix-2026-07-01.md`.