diff --git a/REPORT.md b/REPORT.md
index 66fd857..3a47e8c 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -36,12 +36,18 @@
   through). PASS.
 - Send-failure→502, 401/503/400 paths, token-bucket unit (injected clock), LOGIN auth + From-domain parse. PASS.
 
-### Deployment & live validation
-- **Deploy:** build `felhom-hub:0.18.0` on 180 → bump `manifests/hub.yaml` image → ArgoCD sync (auto-sync off).
-  The `mail` config is optional (defaults 30/min, `felhom.eu`); the Resend key is already injected via
-  `Secret/resend-api` (`RESEND_API_KEY`), so the relay activates on deploy.
-- **End-to-end (app → shim → hub → Resend → real inbox):** result recorded here after the live run; method
-  stated. The Resend key is supplied to the hub out-of-band — never on the guest, never committed.
+### Deployment & live validation — DONE (2026-06-29)
+- **Deployed** `felhom-hub:0.18.0`: built on 180 → bumped `manifests/hub.yaml` → ArgoCD `felhom` app hard-refresh
+  + sync (auto-sync off). Rollout OK; live image `…felhom-hub:0.18.0`; startup log:
+  `[INFO] App-email relay enabled (limit 30/min/customer, From domains [felhom.eu])`. The Resend key is injected
+  from `Secret/resend-api` (`RESEND_API_KEY`); no key in any committed file.
+- **End-to-end (app → on-box shim → hub → Resend):** a raw MIME message with an inline CID image, From
+  `vaultwarden@felhom.eu`, was relayed from guest 9201's shim through this hub to the live Resend account. Hub
+  log: `/api/v1/mail: relayed for demo-felhom (from=vaultwarden@felhom.eu rcpts=1 bytes=789)`; the box's shim got
+  `hub=200` and returned `DATA 250 "OK: queued"` to the sender (Resend accepted/queued for the verified
+  `felhom.eu` domain). Operator inbox arrival is the final confirmation (sent to the operator's own address).
+- **Security backstop (live):** a send From `evil@notfelhom.example` was rejected at the box's shim (`550`) before
+  ever reaching `/api/v1/mail` — the hub From-allowlist + rate-limit are the documented second backstop.
 
 ### Observations
 - App-relay is a **separate** code path from the hub's own structured alerts (which keep using the Resend