diff --git a/REPORT.md b/REPORT.md
index 2d7e0eb..1dcdd2f 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -80,23 +80,37 @@ of which actually fired during authoring, which is the argument for running a pr
 
 Both ride the spec'd R-39 agent train. Recorded, not improvised.
 
-## Live state of the demo box at hand-off
+## The demo box — HEALED and proven (2026-07-18)
 
-The wrapper is **hotfixed on the N100** (`/usr/local/sbin/felhom-pbs-apply`, backup kept at
+The wrapper is hotfixed on the N100 (`/usr/local/sbin/felhom-pbs-apply`, backup kept at
 `.bak-20260718-preR39`, `bash -n` clean) so the repo and the box agree.
 
-**The box is not yet healed, and cannot be by CC.** During diagnosis the agent was made to re-apply
-(marker moved aside — never deleted, the R-22 precedent), which proved the mechanism but consumed
-the one pending secret against the still-unfixed wrapper. The agent parked correctly in
-`consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe worked.
+Diagnosis had consumed the one pending secret against the still-unfixed wrapper; the agent parked
+correctly in `consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe
+worked. Viktor then clicked **"Re-issue PBS credentials"** (the one password-gated action CC cannot
+perform) and the whole chain closed itself in **9 seconds**:
 
-Healing needs one password-gated operator action CC cannot perform:
+| Time (CEST) | Event |
+|---|---|
+| 20:28:44 | hub: `tenantsync: reissue ok` → `pbsdr credentials re-issued … fresh consume-once secret stored` |
+| 20:28:51 | agent: `one-time token secret consumed`, wrapper `reconcile` invoked — **now the patched one** |
+| 20:28:53 | agent: **`pbsdr: converged state=applied`** — no CONSUMED-BUT-FAILED this time |
 
-> **Viktor: click "Re-issue PBS credentials" for `demo-felhom` on the hub.**
+`consumed-failed.json` was cleared automatically by `finishConverged` and `marker.json` rewritten.
+The agent picked the re-issue up unaided because `marker.json` was absent, so the L235 hash
+short-circuit did not apply.
 
-The agent will then pick it up unaided — `marker.json` is absent, so the L235 short-circuit does not
-apply — consume the fresh secret, and the patched wrapper will now apply it. Verification to run
-afterwards: `pvesm status` shows `felhom-pbs` **active**, then one on-demand PBS backup of guest 9201
-confirmed in the PBS-side listing (the tier's first real backup on the reborn box).
+**Proof the tier is genuinely alive, not merely reported alive:**
 
-Nothing was destroyed: `.pw`, `.enc` (K), and the `storage.cfg` entry are all intact and verified.
+| Check | Before | After |
+|---|---|---|
+| `pvesm status` | `401 Unauthorized` / `inactive` | **`active`** |
+| Direct token probe, `/api2/json/version` | `401` | **`200`** |
+| Real backup | none possible | **`felhom-pbs:backup/ct/9201/2026-07-18T18:31:06Z`, 9 744 319 312 B, finished in 13m36s** |
+
+The backup is encrypted under key fingerprint `7e:a6:af:f7:ea:6d:3e:d9` — the **escrowed** key, i.e.
+the one customer zero holds the recovery code for. This is the DR tier's **first real backup on the
+reborn box**.
+
+Nothing was destroyed at any point: `.pw`, `.enc` (K), and the `storage.cfg` entry were verified
+intact after the rejected `pvesm set` (PVE rejects atomically, so the set-only law held).