diff --git a/REPORT.md b/REPORT.md
index e200b46..a567d6b 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -38,9 +38,11 @@ Green gate `go build ./... && go vet ./... && go test ./...` — **ALL-GREEN** (
 - Hub `internal/offsite`: descriptor carries `HostFingerprint` from a faked scanner; a scan failure fails-closed.
 
 ## Deploy verification
-(To be filled by the deploy step: controller `:0.106.0 Up (healthy)` on guest 9201 + clean startup logs;
-offsite is disabled in the demo config, so the bridge no-ops — the deploy proves the image ships sshpass +
-the bridge wiring, not a live apply.)
+Deployed to guest 9201 (golden/bootstrap mechanism): `:0.106.0 Up (healthy)`, `controller_started … (0.106.0)`,
+`errors=0 warnings=0`, startup hub report sent. Offsite is disabled in the demo config, so the bridge async
+goroutine (gated on `cfg.Offsite.Enabled`) correctly no-ops — no `offsite-apply` log lines. The image ships the
+new offbox-install tools: `sshpass` (`/usr/bin/sshpass`), `ssh-copy-id`, `sftp` all present in the container.
+This deploy proves the image + bridge wiring + `sshpass` dependency, not a live apply (that's the next runbook).
 
 ## NOT yet live-applied
 The supervised end-to-end (hub provisions on the new pool box `u629488`/project `15282031` → controller