diff --git a/REPORT.md b/REPORT.md
index 67a8f040..ad0d01bb 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -88,11 +88,48 @@ immediately; `git diff` clean.
 
 **Green gate:** `go build ./... && go vet ./... && go test ./...` in `hub/` — 18 packages, rc 0.
 
-## 6. Deployment
+## 6. Deployment and live verification
 
-PENDING at the time of writing — see the follow-up commit. The two halves ship independently and in
-either order: the hub renders "unknown" for any box still on controller 0.224.0, which is correct
-rather than wrong.
+Hub **0.109.0** built, pushed, manifest bumped, ArgoCD hard-refreshed and synced. Controller
+**0.225.0** deployed to both demo boxes. Verified from the live objects, not from a rollout message
+(an ArgoCD "rolled out" can name the old image):
+
+```
+argocd:  sync=Synced  rev=36f86300209e9ce914f2a97dac16ee9eeea249e2   (== HEAD)
+deploy:  gitea.dooplex.hu/admin/felhom-hub:0.109.0
+pod:     hub-6795879c4b-pf4lz  ...felhom-hub:0.109.0  Running
+boxes:   ...felhom-controller:0.225.0  Up (healthy)   on demo-felhom AND demo-hp
+```
+
+**The card, fetched from the live hub** (endpoint-level: the exact URL the operator's browser
+requests; the residual is client-side rendering only — there is no browser on DooPlex):
+
+| | demo-hp | demo-felhom |
+|---|---|---|
+| Off-site snapshots | **67** | **10** |
+| Repo size | **134.3 MB** | **132.5 KB** |
+| Last successful run | 15h ago | 15h ago |
+| Soft quota | 50 GB | 50 GB |
+| Integrity row | **absent** (grep count 0) | **absent** (grep count 0) |
+
+Both read `Snapshots 0 · Repo Size 0 MB · Integrity Unknown` before this change.
+
+**Cross-checked against the source, not just against itself** — the numbers on the card are the
+numbers on the boxes:
+
+```
+demo-hp      settings.json offbox: snapshot_count 67, repo_size_bytes 140829678, stats_known true
+demo-felhom  settings.json offbox: snapshot_count 10, repo_size_bytes 135635,    stats_known true
+                                   135635 / 1024 = 132.5 KB  → matches the rendered value
+```
+
+**One honest detail worth keeping:** demo-felhom's "Last DB dump" reads `—`. That is correct, not a
+regression — its only app (`opengist`) has no database, so the box has never taken a DB dump.
+
+**Not verified live: the "never measured" branch.** Both boxes report `stats_known: true`, so the
+degradation path could not be exercised on real hardware without falsifying a box's state. It is
+covered by `TestBackupCard_ThreeWayRuling` and `TestBackupCard_OldControllerDegradesToUnknownNotEmpty`
+at render level, and this is stated rather than implied.
 
 ## 7. The push bypassed a gate, deliberately, and here is the declaration