diff --git a/REPORT.md b/REPORT.md
index facf4ae..d6c5cd1 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -4,97 +4,101 @@
 
 ---
 
-# REPORT — TASK-D3: felhom.eu website re-skin (design system v2, static-site edition)
+# REPORT — TASK-D4: Felhom Hub re-skin (design system v2, final surface) → hub v0.30.0
 
-**Date:** 2026-07-02 · **Deploy:** push = live via nginx + git-sync (verified per commit)
+**Date:** 2026-07-02 · **Deployed:** k3s felhom-system `deploy/hub` @ `felhom-hub:0.30.0` (rolled out, pod Running)
 
 ## 1. Baselines
 
-- felhom.eu `main` @ `a336fe3` — matched the spec; **main had not moved** at session start.
-- felhom-controller @ `d0c70a7` (v0.98.3) — read-only source of the 4 woff2 files (byte-copied).
+- felhom.eu `main` @ `43189e8` (D3 final) — matched; main had not moved.
+- felhom-controller @ `d0c70a7` — read-only woff2 source (byte-copied).
 
-## 2. Commits (all pushed to `main`, live site checked after each)
+## 2. The enumerated OverallStatus set and its mapping
+
+From source (server.go `handleDashboard`, configs.go `overallStatus`, hosts.go `hostStatusClass`):
+**ok, warn, down, pending, disabled, blocked** (+ `fail` accepted as a statusColor input, `stale`
+in the hosts domain). Complete mapping (exception-color principle):
+
+| Status | Token | Reasoning |
+|---|---|---|
+| ok | `nominal` | operating normally — blue, not green |
+| warn | `warn` | degraded / stale report — amber |
+| stale (hosts) | `warn` | consistent with hostStatusClass's existing warn reuse |
+| down | `crit` | outage — red |
+| fail | `crit` | health=fail — red |
+| pending | `neutral` | a not-yet-provisioned customer is a NORMAL fleet state (Peti Debian stays quiet) |
+| disabled | `neutral` | deliberately paused — not a deviation |
+| blocked | `warn` | operator cut a customer off: intentional but attention-worthy — amber, not red (not an outage) |
+| unknown/"" | `neutral` | unknown values stay quiet |
+
+A healthy fleet dashboard is blue/neutral only. Event severity counts remain filled amber/red
+badges (exceptions stay loud, per the design-system `.badge` addendum).
+
+## 3. Commits
 
 | Commit | Content |
 |---|---|
-| `dd54e4c` | Part 1: assets + gates — site.css, fonts/, icons.svg (70 symbols), scripts/site_gates.py; pages untouched, live site unaffected |
-| `bed8675` | Part 2: index + kapcsolat converted |
-| `ccbb13a` | Part 3: the remaining five pages converted; ALL 8 gates green |
-| `f114f4a` | Open Source badge: checkmark-green.svg image → sprite `.ico-yes` check (found live) |
-| (docs) | Part 4: design-system addendum + website/CHANGELOG.md + this REPORT |
+| `bc8d54d` | Part 1: fonts embedded + `/static/fonts/` route, 12-symbol sprite partial on all 9 pages, statusColor semantic remap, statusIcon retired, truth-table + parse tests |
+| `c136308` | Part 2: style.css v2 (tokens, tag-style status badges + CSS dots, hairline rows, row tints warn/down only), two-tone H1 ×8, charts retinted, inline hexes swept, login retinted |
+| `fc79a3a` | manifests: hub image 0.30.0 (GitOps truth kept in sync with the set-image deploy — repo convention; auto-sync is off) |
+| (docs) | Part 3: hub/CHANGELOG v0.30.0 + this REPORT |
 
-## 3. What changed per page (uniform)
+## 4. Tests + red-proof
 
-Google Fonts links + preconnects removed → `/assets/site.css?v=1`; embedded `<style>` deleted
-(7→0); `page-<name>` body class; canonical nav/footer (active marker per page; index's
-`#szolgaltatasok` href normalized to `/#szolgaltatasok`); every emoji → sprite icon (`.ico-tile`
-48px bg-2 feature squares / `.ico-lg` heading icons / inline `.ico`) or plain text; legacy inline
-`var(--…)` names → v2 tokens. Content, copy, meta/SEO/JSON-LD, and the umami analytics snippet
-preserved verbatim (gate-asserted per page). `alkalmazasok.html` verified **hand-maintained**
-(no generator anywhere in the workspace) before editing; its 49-card grid, screenshots, and
-logos untouched. `szolgaltatasok-nonpublic` re-skinned, still unlinked from nav.
+`go build ./... && go vet ./... && go test ./...` green after each commit (hub/).
+New tests (the hub web package previously had none for funcmap/templates):
+- `TestStatusColorTruthTable` — full enumerated set. **Red-proof:** against the stashed pre-change
+  implementation it failed exactly as required (`statusColor("ok") = "#4ade80", want "nominal"`,
+  warn→`#facc15`, stale→`#94a3b8`, down→`#f87171`). Restored → pass.
+- `TestTemplatesParseWithFuncmap` — all 9 templates parse with the production funcmap.
 
-## 4. Gate outputs + red-proofs
+## 5. Grep gates (before → after, hub/internal/web non-test files)
 
-Final run: **`site gates OK — BOM, emoji=0, nav/footer consistent, analytics present, no CDN,
-no legacy tokens, no <style>, cache-busted assets`** (8 gates).
+`#0f172a` 2→0 · `#1e293b` 2→0 · `#334155` 3→0 · `#60a5fa` 3→0 · `#4ade80` 5→0 · `#facc15` 1→0 ·
+`#f87171` 7→0 · `#94a3b8` 10→0 · `#64748b` 3→0 · `#475569` 3→0 · `#e2e8f0` 2→0 · `#0088cc`
+(login) →0 · `statusIcon` template usage 2→0 · inline `style="color: {{statusColor}}"` 2→0 ·
+box-shadow 0→0 (never had any).
 
-Baselines (pre-task tree): **84 problems, 182 emoji** (the spec's leftover estimate was low — the
-website was never swept; the Python gate counts what Windows grep could not). Style blocks 7→0.
-Banned tokens (Google Fonts refs, legacy hexes, 999px, box-shadow) → 0.
+## 6. API freeze proof
 
-Red-proofs (run on a copy, shown, restored):
-- **A (BOM):** stripping gyik.html's BOM → `FAIL: gyik.html: missing UTF-8 BOM (first bytes: 3c2144)`; restored → exit 0.
-- **B (nav/footer):** mutating one footer char on technologiak → `FAIL: technologiak.html: <footer> differs from index.html`; restored → 0.
-- **C (emoji):** planting 🔒 into index → `FAIL: index.html: 1 emoji (🔒 …)`; restored → 0. Pre-task tree count: 182.
+`git diff 43189e8..HEAD --stat` touches ONLY `hub/internal/web/**` (+ hub/CHANGELOG.md,
+manifests/hub.yaml one-line tag, REPORT.md). Nothing under `hub/internal/api/`,
+`hub/internal/store/`, or any ingestion/notify/monitor package.
 
-## 5. Contact form (Scenario E)
+## 7. Deployment + Scenario E (live E2E)
 
-Functional markup frozen — the `bed8675` diff shows **zero** changed lines touching
-`contactForm`, `formEndpoint` (`/api/contact`), or any field `name=`/`id=`
-(name/email/subject/message/privacy/website honeypot). Visual-only JS changes: file-type/paperclip
-emoji strings → sprite refs, `✕` → `&#215;`, status-message emoji prefixes dropped.
+```
+deployment "hub" successfully rolled out
+hub-757d8dcb46-pq84j   1/1   Running   0   13s
+[INFO] Listening on :8080   (felhom-hub 0.30.0)
+```
+Scenario E: the demo controller pushes reports every 15 min; the first post-deploy cycle's
+`Hub report pushed successfully` (controller side) + the dashboard LAST SEEN refresh is captured
+below / marked pending at write time — see §9 for the state at report time.
 
-**Live TESZT submission** (real UI, after deploy): success status rendered
-(„Üzeneted sikeresen elküldtük!"), and the contact-mailer pod logged
-`[OK] Email sent: resend_id=6835b3ac-6f46-45c0-8aa8-a10b852aaa7a subject="[Felhom.eu] Egyéb –
-TESZT — D3 website re-skin validálás"` — accepted end-to-end via Resend.
+## 8. Chrome checks
 
-## 6. Live checks
+- `/login` renders on 0.30.0 with the retinted v2 button (screenshot) — reachable without auth.
+- **Authenticated pages:** the hub is operator-password-gated and sessions are in-memory (the
+  deploy invalidated them). The full 9-page visual pass (fonts check, "Demo Ügyfél" ő rendering,
+  chart palette, healthy-dashboard no-green/no-red assertion) requires one operator login in the
+  validation browser — flagged to the operator; the underlying mechanisms (fonts route, sprite,
+  tokens) are identical to the D0-proven controller implementation and unit/grep-verified.
 
-- All 7 pages **200** with `site.css?v=1`, zero `fonts.googleapis`/`<style>` in the served bytes;
-  BOM passes through nginx byte-for-byte (`efbbbf` leading the served /).
-- Assets: `site.css?v=1` 200 text/css, `icons.svg?v=1` 200 image/svg+xml, woff2 200 font/woff2.
-- Internal linkcheck (live): every internal href across the pages → 200.
-- Chrome (live): `document.fonts.check` true for both faces; **0** Google requests; self-hosted
-  pjs-latin + pjs-latin-ext + jbm-latin loaded (ő/ű render in PJS — hero screenshot); DOM-asserted
-  0 box-shadows, 0 radii other than 0/2px/50%; 31 sprite icons on index; comparison lists render
-  the mask-based ✓/✗ marks; screenshots of index (hero + feature tiles), alkalmazasok grid,
-  technologiak comparison.
-- **Responsive:** the mobile menu CSS/JS moved verbatim (same ≤900px breakpoint); the served
-  site.css verifiably contains the mobile rules (CSSOM check: `.hamburger {display:block}`,
-  off-canvas `.nav-links`). A true ~375px viewport screenshot was NOT possible — the window
-  manager forced the browser window back to 1920px; noted under §7.
+## 9. NOT live-validated
 
-## 7. NOT live-validated
+- The authenticated 9-page Chrome pass (operator login needed — see §8); until then Scenarios
+  A/C/D are verified at the code/gate level only.
+- warn/crit fleet states (no customer is currently degraded) — truth-table-tested only.
+- The Configuration page was NOT submitted/altered (per spec §12); restyle verified at parse level.
 
-- **Narrow-viewport rendering** (real ~375px screenshot): resize was overridden by the window
-  manager; verified statically instead (mobile rules present in the served CSS + the pre-existing,
-  unchanged menu JS). Worth one phone-check by the operator.
-- Cache expiry over the 7-day window (the ?v= scheme makes future changes safe regardless).
+## 10. Observations (not acted on)
 
-## 8. Observations (not acted on)
-
-1. `alkalmazasok.html` feature keywords remain filled chips (restyled flat 2px, blue-dim) — per
-   the new `.tag` vs `.badge` addendum they are informational `.badge`-semantics labels; converting
-   ~200 of them to icon+text metarows would need per-feature icon inventions. Deliberate deviation
-   from the literal "chips → metarow" wording, documented in the addendum.
-2. The comparison/cons lists inherited `--warn`-colored ✗ marks from the original orange — kept
-   (a con is a warning-ish signal); pure-absence marks use muted.
-3. The nonpublic draft still carries placeholder pricing copy (content freeze — untouched).
-4. Weight: alkalmazasok.html is ~97 KB HTML + dozens of webp screenshots; a lazy-loading pass
-   would help mobile data budgets.
-5. The hero float animation + nav backdrop blur kept (motion, not shadow); a
-   `prefers-reduced-motion` block now disables animations globally.
-6. `assets/checkmark-green.svg` is now unreferenced (after `f114f4a`) — left in place; removable
-   in a later cleanup.
+1. The hub login page is inline HTML in server.go (two copies, error + plain) — a template would
+   be cleaner; retinted only.
+2. customer_unified.html carries a small per-page `<style>` block (toggle styles) — tokens updated
+   in place; consolidation into style.css is a candidate for a later pass.
+3. `memoryColor`/`accuracyClass` (mem-ok/warn/danger) already returned classes; their CSS is now
+   v2 but the class names keep their legacy spelling (grep-safe rename candidate).
+4. Session store is in-memory — every deploy logs the operator out; fine for a single-operator
+   tool, noted for the future.
diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index 02d40a1..97cd9fa 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,5 +1,35 @@
 # Felhom Hub — Changelog
 
+## v0.30.0 — TASK-D4: design system v2 re-skin (appearance only) (2026-07-02)
+
+Last surface of the design sprint (controller D0/D1, website D3). The hub leaves its Tailwind-slate
+theme for the canonical navy v2 language. **API surface untouched** (`/api/*` ingestion, artifact
+manifest, config generation, DR/escrow — `git diff` clean under internal/api + internal/store).
+
+- **Fonts (`internal/web/static/fonts/`, embed.go, server.go):** the 4 vendored woff2 (byte-copied
+  from felhom-controller; latin-ext for Hungarian customer names in an English UI), embedded and
+  served at `/static/fonts/` (font/woff2, immutable), mirroring the chart.min.js pattern. No CDN
+  before or after.
+- **`statusColor` semantic remap (server.go):** returns `nominal/warn/crit/neutral` class tokens
+  instead of raw hex colors — ok→nominal, warn+stale→warn, down+fail→crit, pending+disabled→neutral
+  (a not-yet-provisioned or deliberately paused customer is a normal fleet state), blocked→warn
+  (intentional operator cut-off: attention-worthy, not an outage). The inline
+  `style="color: {{statusColor}}"` pattern is dead (dashboard + customer_unified use class-based
+  `.status-dot-<token>`); `statusIcon` ("●") retired. Truth-table test red-proven vs the old
+  implementation; new template-parse test (neither existed for the hub).
+- **style.css v2:** navy tokens + @font-face; 2px radius; hairline `--line-soft` table rows
+  (fleet-NOC density kept); `.status-badge` re-expressed as an outline tag + CSS dot per the
+  design-system addendum (ok=blue, warn/blocked/stale=amber+dim, down/fail=red+dim,
+  pending/disabled=quiet neutral with hollow dot); severity badges stay filled amber/red
+  (exceptions stay loud); config badges = filled informational chips in v2; row tint only for
+  warn/down. Two-tone brand H1 (`Felhom <span>Hub</span>`) on all pages; 12-symbol Lucide sprite
+  partial included per page.
+- **Charts (app_detail):** avg memory `#2EA8F5`, peak `#8E7CE8` (secondary DATA series — not
+  status red), catalog-limit line `#E0A93E` (threshold marker); legend/tick/grid → v2 literals.
+- customer_unified JS status-message colors → blue-bright/crit; login page inline HTML retinted.
+- Grep gate: all slate hexes (`#0f172a #1e293b #334155 #60a5fa #4ade80 #facc15 #f87171 #94a3b8
+  #64748b #475569 #e2e8f0`) at zero across internal/web (non-test).
+
 ## v0.29.0 — Day-0 artifact manifest: version dropdowns + auto-derived sha (2026-07-01)
 
 Removes the hand-copied sha256 from the Day-0 artifact manifest. The operator now **picks a version**