diff --git a/REPORT.md b/REPORT.md
index 472dda3..92fcf33 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,27 +1,18 @@
-# REPORT — two template fixes from the first nightly rotation (2026-09-13)
+# REPORT — privatebin drill bump and revert (BIGNIGHT, 2026-09-14)
 
-*Overwritten each session.*
+**What:** a real one-step upstream release, `privatebin/pdo` 2.0.5 → 2.0.6, pushed (`d5d91e0`) so the big night's
+test box could walk the guarded Update end to end, and reverted (`a161ccb`) in the same phase. No other template moved.
 
-- **adventurelog — `DEBUG=False`** (`ed2c018`, R-482). The image defaults Django to DEBUG=True and served
-  debug pages on the public origin. Proven live after the sync: the same CSRF failure renders the
-  300-byte production page.
-- **glance — a seeded `glance.yml` on first boot** (`50ad286`, R-473). Fresh installs crash-looped without
-  a config. Proven live: a throwaway install healthy in 21 s, 0 restarts, front door 200.
+**Why:** the drill required an Update on real data; no app in the catalog had a newer version.
 
-- **adventurelog — the backend's own paths go to the backend** (`3172258`, R-483, re-ranked P2 by the
-  operator). Photos uploaded but rendered broken on demo-hp while they rendered on his k3s: the k3s
-  ingress routes `/media`, `/static`, `/admin`, `/accounts` to the backend; the catalog routed every
-  path to the frontend, which has no `/media`. A traefik router on the backend service now carries
-  those prefixes. Proven without a browser on the operator's own instance after the guarded Update
-  recreated its containers: a photo placed through the backend API is listed at
-  `https://travel…/media/images/<id>.webp` and that URL answers 200 through the public origin; the
-  frontend's non-browser multipart 500 is upstream and recorded. **Second cut: the router targets port 80 (the nginx inside the
-  backend image that serves Django's X-Accel media). Confirmed by the operator in a browser at 21:49 — R-483 closed.**
-- **catalog-since gate** (R-452): `scripts/check-catalog-since.py` — an `image:` move must bump that app's `catalog_since`; five decoys; red-proofed.
+**Result on the test box (VM 333, controller 0.242.0):** the change reached it on the next 15-minute sync, 14 m 25 s
+after the push; the app page offered „Frissítés elérhető — ma"; the guarded Update found a Tier-2 copy 13 min old, pinned
+2.0.6, pulled, verified healthy and finished in **11 s**; two encrypted pastes decrypted equal afterwards.
 
-No version moved. Gates green on every push (`catalog_gates.py --fast`, now five gates).
+**What the revert exposed:** the box that had already updated then showed „Frissítés elérhető" for the older 2.0.5 —
+a downgrade offered as an update. Filed in felhom.eu as **R-524** (controller). No catalog change is needed for it.
 
-## Observations
+**Net state:** the template is back on 2.0.5; `catalog_since` stays 2026-09-14 because the `catalog-since` gate
+requires an image move to carry the day of the move. Gates: `catalog_gates.py --fast` OK on both commits.
 
-1. **`wger`, `tandoor`, `paperless-ngx` are Django too and their DEBUG default is unmeasured.** NOT-A-FINDING: recorded in R-482's closure; each is measured on its own rotation night, not guessed.
-2. **adventurelog's photo upload fails from any non-browser client.** FILED: R-483
+Full drill: `felhom.eu/documentation/audits/BIGNIGHT-household-month-2026-09-14.md`.