diff --git a/REPORT.md b/REPORT.md
index fd968b3..f06f506 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -53,21 +53,21 @@ the live cluster confirmed to carry the **old** key before the change (hash matc
 |-------|--------|
 | New key send-capable | ✅ Resend `POST /emails` from host 180 → **HTTP 200**, id `79df5b65…` |
 | contact-mailer end-to-end | ✅ form POST → **HTTP 200**; pod log `[OK] Email sent: resend_id=c13d86ae…` (new key via `resend-api`) |
-| hub | ✅ running pod env `RESEND_API_KEY` = **new** key (hash match) + uses the identical, now-proven Resend send path; `Healthy`. A literal `/notify` was **not** fired — it emails a real customer in Hungarian and no operator-owned target was readable without the DB. Can run a live hub send on request. |
-| Gmail | ⏳ **operator-manual (S4)** — update "Send mail as" SMTP password to the new key |
+| hub | ✅ **end-to-end** `/notify` (event_type=`test`) → log `Notification email sent to nagyfenyvesi.viktor@gmail.com`, `{"sent":true}`. Sent via `Secret/resend-api` (new key). Used a throwaway prefs row `_resend-rotation-test`, then **blanked it** (follow-up notify → `sent:false, no_email`). |
+| Gmail | ✅ **S4 done** — operator updated "Send mail as" SMTP password; confirmed test mail arrives. |
 
-(All test mail was sent to `info@felhom.eu` from the verified `felhom.eu` domain. Operator confirms inbox
-arrival.)
+(contact-mailer/direct-key test mail went to `info@felhom.eu`; the hub test went to the operator's Gmail.
+Operator confirmed arrival of both.)
 
-## STOP — §13 gate (operator action required before S7)
+## STOP — §13 gate (only S7 remains — operator action)
 
-**Do not delete the old key in Resend (S7) until:**
-1. **Gmail "Send mail as" (S4)** is updated to the new key — otherwise S7 breaks Gmail send. Gmail is the
-   one remaining consumer still on the old key.
-2. You've confirmed the two test emails above (+ a Gmail test send) arrived.
+All consumers (hub, contact-mailer, Gmail) verified sending on the **new** key. The one remaining,
+irreversible step is **operator-only**:
 
-Then delete the old key in Resend and re-verify one consumer still sends (proves nothing was left on the
-old key). After that, this can be marked fully closed.
+- **S7 — delete the OLD key in Resend** (dashboard → API Keys). Then re-verify one consumer still sends
+  (e.g. submit the contact form again) to prove nothing was left on the old key.
+
+After S7 + re-verify, the rotation is fully closed (only the S8 history-scrub remains, deferred).
 
 ## S8 — history scrub (deferred)