diff --git a/REPORT.md b/REPORT.md
index c153a07..cfac7e1 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -197,6 +197,26 @@ was deleted. Log retained beside its predecessor: `180:/mnt/5_hdd/felhom.eu/dril
 the hub*. I did **not** render the hub's golden **dropdown** — that is the password-gated operator
 UI, and it remains part of STOP-2.
 
+## 4d. STOP-2 — hub saves: **DONE** (operator, 2026-07-20)
+
+Both password-gated saves applied in the correct order and confirmed by screenshot:
+
+| Setting | Value |
+|---|---|
+| Day-0 artifact — Golden | **0.153.0**, sha256 `15fdd191f3c660a60dc8651111053dd84281aeebc6c4c0f9ecdd3a87cb45a9d0` (matches the bake exactly) |
+| Day-0 artifact — Agent | 0.90.0 (unchanged) |
+| Min agent | 0.90.0 (unchanged — v0.153.0 declares no coupling) |
+| Managed-updates global floor | **v0.153.0**, source `DB (hub_settings)`, saved **last** ✓ |
+
+**Agent 0.90.1 is absent from the dropdown — correct, not a defect.** It was built on the old
+Windows workstation but **never published**: `felhom-agent/0.90.1` in Gitea returns **404** (0.90.0
+returns 206), and felhom-pve reports `felhom-agent 0.90.0`. The hub lists only published versions.
+The v0.90.1 source IS committed (`9596d5a`, the R-39 `pvesm set --server` hotfix), so shipping it is
+a build+publish away — tracked under R-39, out of scope here.
+
+Build guest **9100 destroyed** (`pct destroy 9100 --purge`, all three LVs removed); only 9201
+remains on the host.
+
 ## 5. NOT yet live-validated — remaining human/supervised work
 
 - ~~**STOP-1**~~ — **DONE 2026-07-20, PASSED.** See §4b for the log ordering, timestamps and the
@@ -205,11 +225,15 @@ UI, and it remains part of STOP-2.
 - ~~**Phase C**~~ — **DONE 2026-07-20.** Golden 0.153.0 baked, published, all gates green
   (§4c). `GOLDEN_SHA256=15fdd191f3c660a60dc8651111053dd84281aeebc6c4c0f9ecdd3a87cb45a9d0`.
   Housekeeping left for whoever is next at the host: `pct destroy 9100 --purge`.
-- **STOP-2 (Viktor, password-gated):** Day-0 manifest Golden → 0.153.0 (Agent 0.90.1 / MinAgent
-  0.90.0 unchanged — the CHANGELOG's no-coupling declaration is the authority), then floor →
-  v0.153.0 saved **LAST**. Watching the demo box wake during the manifest save banks the **R-23(a)**
-  operator-UI save→apply evidence — log the timestamps if observed.
-- **Viktor's C6 customer-restore UI run** (note the empty-the-trash method).
+- ~~**STOP-2**~~ — **DONE** (§4d). Golden 0.153.0 + floor v0.153.0 saved in the right order.
+- **Viktor's C6 customer-restore UI run — STILL OUTSTANDING, and it is the one that matters.**
+  The 2026-07-20 reconstitute restored over an ALREADY-GOOD state (11 assets before, 11 after): it
+  proves the H4 window is closed and the operation is clean and non-destructive, but **nothing was
+  ever lost in it**. C6 needs the destructive shape — delete photos, **empty the trash** (deleting in
+  an app's own UI usually means trash, and a drill written that way merges 0 files, flashes success
+  and proves nothing), then restore and verify the app's *content*, not the file count.
+- **The R-23(a) operator-UI save→apply evidence** was not captured: nobody was watching the demo box
+  wake during the manifest save. Cheap to bank on the next manifest save.
 
 ## 6. Observations (out of scope, recorded not acted on)
 
@@ -228,3 +252,12 @@ UI, and it remains part of STOP-2.
   is asserted on the persist half only. That is the half the split could break; the tail is
   byte-identical code that was moved, not rewritten.
 - **R-29a (`estimate.go` gate finding)** remains open and was not touched.
+- **CORRECTION to an earlier claim in this session.** Mid-run I reported that the controller password
+  in `180:~/.config/credentials` was **stale** and had been superseded by the customer-claim flow.
+  **That was wrong.** The values in that file are single-quoted (`PASSWORD='…'`) and my
+  `cut -d= -f2-` extraction kept the quotes, so a 15-character string with literal `'` on both ends
+  was sent instead of the 13-character password. Re-tested with the quotes stripped: `302` + session
+  cookie. The credential was correct the entire time; no rotation, no drift, nothing to reconcile.
+  The lesson recorded in memory is the general one: **an auth failure is evidence about the bytes you
+  sent, not proof about the stored secret** — a 2-character length discrepancy is this bug's
+  signature, and it was stated confidently three times before being caught.