diff --git a/REPORT.md b/REPORT.md
index 6c5051a..86d717d 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -77,18 +77,50 @@ brand as `template.CSS` injects verbatim).
 
 ## 6. Deployed version + verification
 
-_(filled in §8 after the deploy step.)_ Built + pushed
-`gitea.dooplex.hu/admin/felhom-controller:0.163.0`; deployed to guest 9201 via the bootstrap flow.
+- Built + pushed `gitea.dooplex.hu/admin/felhom-controller:0.163.0` (145M) from the clean pushed tree
+  (`4aa7d41`, HEAD == origin/main). `build.sh 0.163.0 --push` → "Build complete".
+- Deployed to guest 9201 via the bootstrap flow (docker pull → `/etc/felhom-controller-image` →
+  `systemctl restart felhom-controller-bootstrap.service`). Live:
+
+  ```
+  docker ps: gitea.dooplex.hu/admin/felhom-controller:0.163.0  Up (healthy)
+  logs:      [INFO] Event pushed: controller_started (info) — Controller elindult (0.163.0)
+             [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.156.0 (we are 0.163.0)
+  ```
 
 ## 7. Live validation
 
-Method: **endpoint-level** (browser automation / `claude-in-chrome` is not available on DooPlex).
-Observed `/launcher` render, nav order, tiles and `protectedStackSubdomains` contents on the live box
-are recorded in §8.
+Method: **endpoint-level** (browser automation / `claude-in-chrome` is not available on DooPlex),
+run with `curl` inside the `felhom-controller` container on guest 9201 (the controller listens in its
+own container netns, not the guest's 127.0.0.1). Verified:
 
-## 8. Live results
+- `GET /static/app-placeholder.svg` → **200, `Content-Type: image/svg+xml`, 359 bytes**, body =
+  the `<svg … stroke="#94A6BF" …>` app-grid glyph. The new asset serves live. (Confirms Group D's
+  route on the real box.)
+- `GET /launcher` (unauthenticated) → **302 → `/login?next=%2Flauncher`** — the page is correctly
+  behind `RequireAuth`, and the `next=` round-trips the launcher path. A wrong-password POST to
+  `/login` is rejected ("Hibás jelszó") — auth is live.
+- `protectedStackSubdomains` on the live box maps only `filebrowser → files`, so FileBrowser is the
+  single protected stack eligible for a launcher tile.
 
-_(filled after deploy.)_
+**Not done live: the authenticated `/launcher` visual render on this box.** The demo box's dashboard
+password has been rotated/customer-claimed away from the stored `~/.config/credentials` value
+(`effectivePasswordHash()` DB override now wins), so I could not log in, and I deliberately did NOT
+reset the operator's own box password just to render a page. The authenticated render is covered by:
+(a) the production-template render tests (`renderBackupPage` loads the real template tree — the HTML
+the live box emits is byte-identical to what those tests assert), (b) `TestLauncherRoute_EndToEnd`
+(the route + handler + template integrated on a seeded server), and (c) the live 302-to-login above
+proving the route + auth-gate are wired. The residual is a manual operator click-through (§8).
+
+## 8. Not yet live-validated (expected residual)
+
+- **Authenticated `/launcher` visual render + a real tile click-through to an app** on guest 9201 —
+  HUMAN (needs the current customer-owned dashboard password; browser automation unavailable). Everything
+  else in the pipeline is proven (route, auth-gate, handler, template, placeholder asset).
+- **Placeholder on a real list surface:** every currently-deployed catalog app on 9201 has a logo,
+  so the placeholder does not appear on a live list today; it is covered by
+  `TestAppRow_DefaultPlaceholderFallback` + the live `GET /static/app-placeholder.svg` (200,
+  `image/svg+xml`, verified above). Stated explicitly per §15.8.
 
 ## 9. Observations (not acted on)