diff --git a/REPORT.md b/REPORT.md
index bd6850e..0a49bcf 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -14,8 +14,27 @@ STOP-1 evidence and the four red-proofs).
 |---|---|
 | Hub v0.68.0 | **SHIPPED + DEPLOYED** — GitOps manifest bump `0.67.0→0.68.0`, ArgoCD `Synced/Healthy`, rollout complete, pod 1/1 |
 | Agent v0.91.2 | shipped + published + deployed to felhom-pve |
+| Hub v0.68.1 | **SHIPPED + DEPLOYED** — fixes the Configuration layout the v0.68.0 field broke |
 | STOP-1 | done + verified |
-| **STOP-2 / STOP-3** | **BLOCKED — need the operator.** I cannot authenticate to the hub UI (login → HTTP 401); the password is a bcrypt hash I do not hold, by design. |
+| **STOP-3 — manifest save** | **DONE by the operator 2026-07-21 08:31:12Z.** All six fields persisted, including `artifact_wrapper_sha256 = 104db0a4…` (matches the agent's reported hash → drift gauge reads **ok**) and `artifact_min_agent = 0.91.2`. |
+| **STOP-2 — live re-issue** | **NOT DONE — the wrong Re-issue was pressed.** The hub recorded `offsite_reissued` (the restic/Hetzner offsite credential), not the PBS-DR one. Evidence: `host_pbs_secrets` is untouched (created + consumed 2026-07-18, `generation = 0`) and the `pbs_dr` descriptor still carries **no** `secret_generation` key. See §STOP-2 below. |
+
+## STOP-2 — what actually happened, and the side effect
+
+The button pressed was the **offsite** re-issue, not **PBS DR**. Hub events at 08:29:29Z:
+`offsite_reissued` followed immediately by `escrow_stale`
+("A helyreállítási kulcs-letét elavult az offsite jelszó cseréje miatt").
+
+**Consequence that needs an action:** rotating the offsite restic password makes the escrow blob seal
+a password that no longer opens the repo, so the hub correctly stops advertising "ceremony done"
+(the designed v0.57.0 `stale_at` behaviour — not a bug, but a real follow-up). **The recovery-code
+ceremony has to be re-run** before the offsite leg is trustworthy again.
+
+**PBS-DR is untouched and healthy** — a live probe with the stored credential still returns 200 and
+the secret file's mtime is unchanged (2026-07-18 20:28:52), which is exactly consistent with "no PBS
+re-key happened".
+
+The R-39 proof therefore still needs the **PBS DR** re-issue specifically.
 
 ## What shipped hub-side