docs(report): STOP-3 DONE; STOP-2 still pending (offsite re-issue was pressed, not PBS-DR)

REPORT.md

@@ -10,8 +10,8 @@ Companion: hub **v0.68.0** (`felhom.eu`).
 | Part 1 — hub v0.68.0 | **SHIPPED + DEPLOYED** (GitOps sync, Synced/Healthy) |
 | Part 2 — agent v0.91.2 | **SHIPPED + PUBLISHED + DEPLOYED** to felhom-pve |
 | **STOP-1** — felhom-pve update | **DONE + VERIFIED** (§5) |
-| **STOP-2** — live re-issue | **BLOCKED: needs the operator.** I cannot authenticate to the hub UI — the operator password is a bcrypt hash I do not hold (verified: login → HTTP 401). |
-| **STOP-3** — manifest save | **BLOCKED: same reason.** Values to record are in §7. |
+| **STOP-3** — manifest save | **DONE by the operator 2026-07-21 08:31:12Z** — agent 0.91.2 + sha + **wrapper sha `104db0a4…`** + MinAgent 0.91.2, all six fields persisted. The agent reports the same wrapper hash, so the R-50b drift gauge reads **ok**. |
+| **STOP-2** — live re-issue | **NOT DONE — the OFFSITE re-issue was pressed, not the PBS-DR one.** `host_pbs_secrets` untouched (generation 0, consumed 2026-07-18); the descriptor still has no `secret_generation`. Side effect: the offsite restic password rotated, so the escrow blob is now STALE and the recovery-code ceremony must be re-run. PBS-DR itself is unaffected (probe still 200, secret mtime unchanged). |
 
 ## 1. Probes