diff --git a/REPORT.md b/REPORT.md
index 70ba0ad..581c293 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,24 +1,16 @@
-# REPORT — live-test commits for controller slice 4 (2026-09-13)
+# REPORT — two template fixes from the first nightly rotation (2026-09-13)
 
-*Overwritten each run. This records the most recent work only. The implementation report is
-`felhom-controller/REPORT.md`.*
+*Overwritten each session.*
 
-**No net change to the catalog.** Four image-tag commits served the live validation of the controller's
-guarded update on demo-hp, and each was reverted in the same phase. `templates/glance` and
-`templates/uptime-kuma` are byte-identical to `3525e35` — `git diff 3525e35 HEAD` over both → 0 lines.
+- **adventurelog — `DEBUG=False`** (`ed2c018`, R-482). The image defaults Django to DEBUG=True and served
+  debug pages on the public origin. Proven live after the sync: the same CSRF failure renders the
+  300-byte production page.
+- **glance — a seeded `glance.yml` on first boot** (`50ad286`, R-473). Fresh installs crash-looped without
+  a config. Proven live: a throwaway install healthy in 21 s, 0 restarts, front door 200.
 
-| commit | purpose | revert |
-|---|---|---|
-| `a1f1c38` | glance v0.8.4 to install from | `045495f` (glance abandoned — R-473) |
-| `01c631d` | uptime-kuma 2.3.2 to install from | `28ce33b` (Scenario A's upgrade) |
-| `29a8cbe` | uptime-kuma 2.4.999, non-resolving | `41dd686` (Scenario E) |
-| `6ce3f65` | uptime-kuma alpine:3.20 | `6d8c7ab` (Scenario F, reverted early) |
+No version moved. Gates green on both pushes (`catalog_gates.py --fast`).
 
-**Observations**
+## Observations
 
-1. **The glance template crash-loops on every fresh install** — the image needs `/app/config/glance.yml`
-   and nothing seeds it. **FILED: R-473.**
-2. **A catalog push is a deploy, so a live-test tag is exposed to every new install.** The alpine tag
-   was reverted about two minutes after it landed; neither demo box installed uptime-kuma in that
-   window. **NOT-A-FINDING: the exposure was bounded and measured, and the practice is recorded here
-   and in the controller report.**
+1. **`wger`, `tandoor`, `paperless-ngx` are Django too and their DEBUG default is unmeasured.** NOT-A-FINDING: recorded in R-482's closure; each is measured on its own rotation night, not guessed.
+2. **adventurelog's photo upload fails from any non-browser client.** FILED: R-483