docs(archreview): record docker-dev live-/run pass — 4 R2 gates live-confirmed

R2-02 (S-6 range warning + S-8 disabled cells), R2-11 (Writable checkbox),
R2-07 (PureAdd + PureRemove, rebuild=False — F10b MUST), R2-04 (younger-crash
keep-oldest survives sole primary; oldest-crash reproduced the documented SBR
asymmetry, not an R2 regression). R2-05 partial (deny unobservable under
DisableLogin). R2-10/R2-03 unit-verified, live-trigger constrained.

archreview/plans/STATUS.md

@@ -229,3 +229,36 @@ shared docker-dev rig / VPN infra isn't contended. To run one-at-a-time:
 ### Deferred behavior-change follow-up (deliberately not shipped)
 **R2-11 Phase C** — flip the runtime driver parsers to strict (typo'd enum ⇒ `BadNodeIdUnknown` instead of a
 wrong-width `Good`). Land only after fleets have run `Deployment:TagConfigValidationMode=Error` clean.
+
+## docker-dev live-`/run` pass (2026-07-13) — 4 gates LIVE-confirmed on the built-from-source `6aeb53a9` rig
+
+Brought up the 2-node central cluster (`central-1`+`central-2`, SQL, traefik) from source at merged master `6aeb53a9`
+(single-tenant rig; drove the `:9200` AdminUI via browser + Client.CLI on `:4840`/`:4841`).
+
+- **R2-02 (S-6 High) ✅ LIVE** — on the Modbus driver's *Resilience overrides*, entering `timeoutSeconds:0` renders the
+  exact range-validation banner: *"Out-of-range values will be clamped to a safe value on deploy: Read timeout must be
+  between 1 and 86400 seconds (got 0)."* **S-8 ✅** — the Write and AlarmAcknowledge RETRIES cells are disabled ("never").
+- **R2-11 (T22) ✅ LIVE** — the typed Modbus tag editor shows the **Writable** toggle; saving persists `writable: yes`.
+- **R2-07 (P1 — F10b MUST) ✅ LIVE** — central-1 boot apply logged `AddressSpaceApplier: applied plan
+  (kind=PureAdd, added=91, removed=0, changed=0, rebuild=False)`; deleting a UNS virtual-tag + redeploy logged
+  `(kind=PureRemove, added=0, removed=1, changed=0, rebuild=False)` and the node vanished from the address space
+  (`capper-03` lost its `production-count` child). **Surgical add AND remove both execute in prod with no full rebuild —
+  the remove path's 3 new sink members are wired, not inert.**
+- **R2-04 (S4 MUST) ✅ LIVE (achievable guarantee)** — **younger-crash** (kill `central-2`): `SBR took decision
+  DownUnreachable and is downing [central-2]`, `Member removed`, `central-1` stays Up, AdminUI serving, ServiceLevel
+  **250** (sole primary, no split-brain). **Oldest-crash** (kill `central-1`) reproduced the **documented keep-oldest
+  asymmetry** live: the survivor took `SBR … DownReachable … including myself` and CoordinatedShutdown (ExitCode 3) —
+  i.e. crashing the *oldest* node does **not** fail over. This is the pre-registered SBR topology gap (a deferred USER
+  strategy decision), **not** an R2 regression; R2-04's `PrimaryGatePolicy` write-gate change is orthogonal + unit-verified.
+- **R2-05 (T15) ✅ (partial, as expected)** — every config/read page renders under the all-roles `multi-role-test` session
+  (named-policy gating didn't over-gate a legitimate admin); deny is unobservable under docker-dev `DisableLogin=true`, as documented.
+- **R2-10 (T10) / R2-03 (T12) — unit-verified; live-trigger constrained, not forced.** R2-10's breaker needs a wrapped
+  subscribe/discover/write exception (Modbus's cheap paths don't throw wrapped — the known trigger is an idempotent
+  write-to-dead-endpoint or S7). R2-03's live observable is a Client.CLI `read` StatusCode, but the CLI `read` throws a
+  `FetchValueAsync` stack trace even on valid nodes on this rig, so quality wasn't cleanly observable via CLI. Both are
+  solidly covered by unit suites (Core resilience 128, publisher/guard 6; Runtime 372, RoslynVTEvaluator 20).
+
+**Rig note:** the pass mutated the persisted ConfigDb (added a `drv-modbus-line3-01` Modbus driver on MAIN; removed
+`capper-03`'s `production-count` virtual tag for the PureRemove test). Reset with
+`docker compose -f docker-dev/docker-compose.yml down -v`. The remaining integration-suite sweep + genuinely-external
+gates (R2-06 VPN, R2-08 live LDAP, R2-01 S7 blackhole) still need their infra.