docs(pilot): GL-6 Phase 4 PASS — C7 live-validated; F7 (R2 heal bring-up-only)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/pilot/DRILL-GL6-2026-07-08.md

@@ -260,6 +260,29 @@ password) is now a GL-7 onboarding prerequisite.** Findings F1/F2/F3/F6 → post
 authorizes a real signed op end-to-end.** Combined with legs 1–3 (box==repo==manager fingerprints,
 armed-from-first-boot), the operator-signed self-update path is fully live-validated.
 
-## Gate 3 — [Viktor]: <pending>
+## Gate 3 — [Viktor]: **GO** — armed-key chain proven both directions.
+
+## Phase 4 — drift-heal, live (the R2 fix earning its keep) — PASS, 1 finding
+
+- **4a induce drift:** `pveum pool modify felhom --vms 9201 --delete 1` → pool members `[9201]` → `[]`;
+  the agent selftest immediately reflected it (`pool read: pool "felhom", 0 member(s)`) — the exact
+  silent drift R2 addresses.
+- **GL6-F7 (MED, new):** the R2 `PoolAddVMID` re-assertion is **bring-up-only** (`bringup.go:498`,
+  after restore-over-existing) — there is NO continuous pool-membership reconcile (the stale-lock
+  reaper READS membership, `stalelock.go:183`, but never repairs). Confirmed live: 2 min after the
+  removal, no re-assert, pool stayed `[]`. So out-of-band membership drift does NOT auto-heal; it
+  needs a bring-up or `--adopt-pool`. (R2 itself DID fire correctly at this drill's provision —
+  `pool membership re-asserted vmid=9201` — so the fix works for its designed path.) Candidate:
+  a periodic membership reconcile; acceptable for the pilot (verify catches it, --adopt-pool fixes).
+- **4b C7 — the verify assert firing on real drift (read-only):** installer `--resume` re-ran
+  `step_verify` → **`[ERROR] pool: guest 9201 NOT in pool felhom (the scoped token cannot manage it —
+  adopt with --adopt-pool)`** → `Day-0 provision completed WITH WARNINGS`. The ACL grants + `authz
+  signers: 2` stayed green (only membership was perturbed). C7 (GL-2's structural assert catching a
+  real silent drop) is now LIVE-VALIDATED — closes the GL-2 "not testable pre-drill" gap.
+- **Repair:** `--adopt-pool --vmid 9201` re-added it (pool `[9201]`), re-verify → **SUCCESS**. Demo
+  healthy. (Also incidentally re-proved the v1.11.3 F4 fix: the `--resume` re-ran token/enroll/grows
+  cleanly and reached verify — no crash-loop, no flag error.)
+
+## Gate 4 — [Viktor]: <pending>
 
 *(Phases 3–6 appended as they run.)*