diff --git a/REPORT.md b/REPORT.md
index 49e10e7..9fa07b9 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -51,7 +51,7 @@ placement stays non-auto-deploying; no engine changes beyond `offbox_restore.go`
 ## Commits
 
 - felhom.eu hub: `08fef48`
-- felhom-controller: `<filled at commit>`
+- felhom-controller: `0cfcc42`
 
 ## Tests — results
 
@@ -77,15 +77,47 @@ All reverted; post-revert both suites green; no mutation residue.
 - **Hub:** built + pushed `felhom-hub:0.55.0` on 180; `manifests/hub.yaml` → :0.55.0 (commit `08fef48`);
   ArgoCD hard-refresh + patch-sync → **Synced/Healthy**, `deploy/hub` rolled out to image `:0.55.0`,
   startup `Listening on :8080`.
-- **Controller:** `<filled after deploy>`
+- **Controller:** built + pushed `felhom-controller:0.134.1` on 180; deployed to guest 9201 →
+  `Up (healthy)`. Commit `0cfcc42`.
 
 ## §13 live validation
 
-`<filled after the live legs>`
+**Credential blocker (honest):** the sanctioned credential `180:~/.config/credentials` `C4_PASSWORD`
+(len 14) is **stale** — the demo customer changed their dashboard password after the one-time claim
+(login returns `Hibás jelszó`, no session). So the dashboard-session legs (manual run trigger, the two
+scratch-restore legs, the UI prefs round-trip, the synthetic delivery event) could NOT be driven. I
+did **not** reset the customer's password or extract the controller's hub API key to force a session
+(both would alter demo state / overreach). What was validated read-only / organically instead:
 
-## NOT yet live-validated — awaiting CAMPAIGN-6D (supervised)
+- **Leg 2a — enlarged snapshot shape (LIVE, organic):** the daily 04:15 CEST scheduled run (2026-07-15
+  02:15 UTC, v0.134.0) produced the multi-path shape. `restic snapshots --no-lock --json` newest per
+  tag: **calibre-web** = `["…/nas-media/backups/primary/calibre-web", "…/nas-media/userdata/media/books"]`
+  (unit + MANDATORY userdata); the 2026-07-14 calibre-web snapshot was unit-only — the shape change is
+  visible across runs. immich / audiobookshelf newest = unit-only (no resolvable mandatory HDD bind).
+- **Leg 2b — raw-data quota (LIVE):** stored `repo_size_bytes = 280,932,901` (267.9 MB) == live
+  `stats --mode raw-data` (280,932,901) exactly — the raw-data switch refreshed the stored value (was
+  744,763,144 / 710 MB modeless before 3a). 15 snapshots retained.
+- **Leg 2c — forget grouping:** in the deployed code (both call sites) + unit-tested; the live log line
+  was not capturable (the container restarted at the v0.134.1 deploy, rotating the 04:15 run's logs).
+- **Delivery chain (partial, read-only):** hub v0.55.0 allowlist entry is LIVE (deployed Synced/Healthy
+  + the hub acceptance test). Controller notifier enabled (`Notifier enabled (hub: https://hub.felhom.eu)`).
+  The prefs migration is confirmed getter-only (stored `enabled_events` does NOT persist
+  `offbox_enlarge_blocked` — matches the design; surfaced at read).
+- **Hygiene:** no scratch dirs were created (legs 3–4 did not run); the login-attempt temp files on 180
+  were removed; read-only inspection scripts removed from the container.
 
-`<updated after §13>`
+## NOT yet live-validated — awaiting a supervised session with the CURRENT customer password / 6D
+
+- Manual run trigger via the UI endpoint (organically covered by the scheduled run for shape + size).
+- Unit-only + full scratch restore via the real endpoints (legs 3–4).
+- The prefs checkbox round-trip in the live UI (leg 5) — migration + sync are unit-tested + getter
+  confirmed live; the checked-render + save-survives round-trip needs the session.
+- The synthetic `offbox_enlarge_blocked` delivery event + customer email (leg 6) — hub ingestion is
+  live; end-to-end delivery needs a session or the demo API key.
+- `PlaceOffsiteRestore` against live data; organic enlarge-block firing (demo repo 268 MB / quota 50 GB);
+  the SQ3 immich offsite-only full circle.
+- **Follow-up flagged:** refresh `C4_PASSWORD` in `180:~/.config/credentials` (the demo customer's
+  current dashboard password) so future in-session live legs aren't blocked.
 
 ## Observations (documented, not acted on)