diff --git a/REPORT.md b/REPORT.md
index 746c733..77a5d87 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,9 +1,32 @@
-# REPORT — v0.41.0: first-boot base-infrastructure bring-up + self-heal (+ Section-G mount fix)
+# REPORT — v0.41.0–0.41.2: base-infra bring-up + controller routing (+ Section-G mount fix)
 
-**Repo:** `felhom-controller` · **Version:** 0.41.0 · **Date:** 2026-06-11
-**Pushed commit:** `abbd948` (controller) · paired with `felhom-agent` v0.20.0 (`1799fcd`) + golden rebake.
+**Repo:** `felhom-controller` · **Version:** 0.41.2 · **Date:** 2026-06-11
+**Pushed commits:** `abbd948` (0.41.0) → `91736eb` (0.41.1) → `2bed7ce` (0.41.2) · paired with
+`felhom-agent` v0.20.0 (`79ba2f1`) + golden rebake (controller 0.41.2).
 
-## What shipped
+## Follow-up after live diagnosis (v0.41.1 + v0.41.2)
+
+The base-infra bring-up stood up traefik/cloudflared/filebrowser, but **nothing routed the controller
+itself** — `felhom.<domain>` 404'd (controller on `bridge` only, no traefik labels, empty `dynamic/`).
+A live inside-out diagnostic confirmed the **tunnel chain was already healthy** (token tunnel-id matches
+the DNS tunnel `8b4edf48…`; CF ingress `*.<domain> → https://traefik`; traefik routes `files.*` 200) —
+the **only** gap was the controller wiring. filebrowser self-registers via Docker labels + network
+membership in its compose; the controller can't (started by the golden bootstrap before `traefik-public`
+exists, and the v2 bootstrap carries no domain), so the wiring must happen post-pull.
+
+- **v0.41.1** — `infra.RenderControllerRoute(domain)` (traefik file-provider route `Host(felhom.<domain>)
+  → http://felhom-controller:8080`, websecure) + `wireController` in `EnsureBaseStack`: write
+  `dynamic/controller.yml` (write-if-changed) and `docker network connect traefik-public felhom-controller`.
+- **v0.41.2** — two fixes found in live validation: (1) `containerOnNetwork` misread the absent-key
+  `<nil>` as "already attached" → the auto-connect was skipped (traefik 502'd); fixed by listing+matching
+  network names. (2) Removed a **dead `CrossDrive*` block** in `dashboard.html` (a slice-8C de-privileging
+  leftover) that `gt <nil> 0`-**500'd the entire dashboard** — only surfaced once routing made it reachable.
+
+**Live result:** `felhom.demo-felhom.eu → HTTP 200` serving `<title>Vezérlőpult — Felhom.eu</title>`;
+`files.*` still 200; 0 dashboard template errors; auto-connect proven (fresh `bridge`-only container →
+`[infra] connected felhom-controller to traefik-public`).
+
+## What shipped (v0.41.0 base)
 
 A freshly-onboarded controller came up ONLINE on the hub but **Health = FAIL: protected containers not
 running — traefik, cloudflared, filebrowser**: nothing ever deployed the base stack on a Proxmox