diff --git a/REPORT-hub-tokens.md b/REPORT-hub-tokens.md
index 1bea4858..f9acd5be 100644
--- a/REPORT-hub-tokens.md
+++ b/REPORT-hub-tokens.md
@@ -23,11 +23,11 @@ test failed both times. All hub tests pass.
 **Off-site (R-1059 = A, same day).** No token can re-issue a household's off-site password or PBS-DR token either.
 „Off-site: write" keeps the windows and freeze.
 
-**Is it live?** Deploying on your „yes" (see the end of this file).
+**Is it live?** Yes, since 13:39. With CC's token, for a customer that does not exist, all six routes answered
+„403 session only" (the off-site re-issue too, although the token holds „Off-site: write").
 
 **What you do now.**
-1. Say „yes" to deploy hub 0.153.0.
-2. Nothing else for this; R-1059 is decided (A) and built.
+Nothing for this. Still open from before: change the hub password and delete the `HUB_PW` line.
 
 ## The Customers-write routes, checked one by one (`hub/internal/web/routes.go`)
 
@@ -62,4 +62,5 @@ Register: before 157 · after 156 · opened 1 (R-1059, off-site re-issue) · clo
 
 ## Teardown
 
-Nothing provisioned. No live change: the hub still runs 0.152.0.
+Machine and host: nothing provisioned. Hub: v0.153.0 deployed (manifest `1dc1a08`); live probes used a customer id
+that does not exist, so a broken guard could change nothing real. Evidence: `audits/hub-tokens-2026-10-15/C153-live.txt`.
diff --git a/STATUS.md b/STATUS.md
index 71151e49..36e2f3af 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -2,7 +2,7 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.152.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
+**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.153.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
 `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
 
 ## What works
@@ -46,7 +46,7 @@
 
 ## Waiting on you — do
 - **Change the hub password now — CC no longer needs it.** CC uses its token „cc-releases" (tested live: the floor works; the vouch and the password-only pages are refused). Then delete the `HUB_PW` line in `~/.config/credentials` on DooPlex (CC does not delete it). Your token is wider than planned (it can also change off-site windows and approve OS updates) — revoke and re-create it narrower if you want. If you do nothing: CC still holds a password that can do everything.
-- **Hub 0.153.0 (your rulings 13:20 + R-1059 „A"): no token can resend a claim code, create or edit a customer, make a passphrase or a link, or re-issue an off-site password.** Deploying now on your „yes".
+- **Hub 0.153.0 (your rulings 13:20 + R-1059 „A"): no token can resend a claim code, create or edit a customer, make a passphrase or a link, or re-issue an off-site password.** Live since 13:39 (checked with CC's token: all six refused).
 - **Remove the test server „plex-k6” from your Plex account** (plex.tv → Settings → Authorized Devices). The claim test passed and the server is gone from Tester 1. If not: a dead server stays listed in your Plex apps.
 - System poster needs a refresh: every public name answers only over https (http → 301).
 - **Clear demo-hp's own floor** (hub → Demo HP → floor: empty → Save floor). It still reads 0.311.0. If not: the next global raise passes demo-hp by.
diff --git a/documentation/audits/hub-tokens-2026-10-15/C153-live.txt b/documentation/audits/hub-tokens-2026-10-15/C153-live.txt
new file mode 100644
index 00000000..26da3c91
--- /dev/null
+++ b/documentation/audits/hub-tokens-2026-10-15/C153-live.txt
@@ -0,0 +1,17 @@
+hub 0.153.0 deploy: manifest 1dc1a08, digest sha256:9214ab2225c29699ead77773a41b0bea96c91ece171f02f36932867d0344a003; ArgoCD Synced/Healthy rev 1dc1a08; pod ready 11:39 UTC
+hub 0.153.0 live check with CC's token (customer id that does not exist: zz-probe-none)
+403 /configs/zz-probe-none/offsite-reissue Forbidden: session only — never by a token
+403 /configs/zz-probe-none/pbsdr-reissue Forbidden: session only — never by a token
+403 /configs/zz-probe-none/claim-resend Forbidden: session only — never by a token
+403 /configs/zz-probe-none/edit Forbidden: session only — never by a token
+403 /configs/new Forbidden: session only — never by a token
+403 /customers/zz-probe-none/create-config Forbidden: session only — never by a token
+200 GET /configuration footer 0.153.0: True
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/offsite-reissue → 403
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/pbsdr-reissue → 403
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/claim-resend → 403
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/edit → 403
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/new → 403
+2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /customers/zz-probe-none/create-config → 403
+2026/10/15 13:39:54 [INFO] access token "cc-releases": GET /configuration → 200
+Boxes reporting after the restart (hub DB + WAL from the running pod, last_report_at > 11:39:40 UTC): demo-felhom-8363b5=11:49:40 demo-hp-bb76ea=11:41:03 tester-1-d70be4=11:41:30 (Tester-2 off since 2026-10-04, known)
diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index c1d1e290..d70a0005 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -16,7 +16,9 @@ Operator ruling 2026-10-15 13:20 (`09` §3 decision 252, R-1055 = A). `documenta
 - **R-1059 (operator „A", same day):** `POST /configs/{id}/offsite-reissue` and `/pbsdr-reissue` are session only too —
   each mints a household credential for the box (the off-site password; the PBS-DR token). „Off-site: write" keeps the
   windows and freeze. Same test; red-proved (offsite-reissue back in the group → the handler was reached, 502).
-- **Not deployed** — the operator's „yes" first.
+- **Deployed 2026-10-15 ~13:39 Budapest** on the operator's „yes" (manifest `1dc1a08`, digest `sha256:9214ab22…`). Live with
+  CC's token, for a customer id that does not exist: the two re-issues, claim resend, edit, create and create-config
+  each → 403 „session only" (`documentation/audits/hub-tokens-2026-10-15/C153-live.txt`).
 
 ## v0.152.0 — operator access tokens with scopes; an empty password no longer opens the UI; R-952 (2026-10-15)