diff --git a/CONTEXT.md b/CONTEXT.md
index 2f5830c..6251fdf 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -21,8 +21,14 @@
   **GC verdict:** no appliance-staleness GC exists (`applianceStaleAfter` is a display badge only) → the
   7-day token TTL stands alone, single-active-per-customer, no reaper needed. **Controller/agent
   untouched; R-27b (controller second-box dismissable prompt) DEFERRED, mechanism sketched.** Green:
-  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **LIVE validation pending deploy
-  (this session).** See REPORT.md.
+  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **DEPLOYED + LIVE (hub 0.66.0 on
+  k3s, Synced/Healthy).** Live through the real ingress: `GET /bind/<garbage>` → 200 Hungarian expired
+  page (public, logged-out, no-oracle — the 200-not-500 proves `selfbind_tokens` migrated live); `/` +
+  `/hosts` → 302 /login (gate intact); `POST /bind/<garbage>` no-CSRF → 200 (exempt) while
+  `POST /customers/acme/block` no-CSRF → 302 /login (exemption is `/bind/`-only). **PENDING
+  (operator-gated, NOT-live):** operator "Send self-bind link" + the customer's real two-factor success
+  (hub UI password-gated → CC can't log in) + the new-ISO console banner on a re-imaged box → fold into
+  the R-1 rehearsal. See REPORT.md.
 
 - **2026-07-17 — PBS DR STORAGE VISIBILITY + Offsite tab split + dual gauges shipped (hub v0.65.0 +
   tenantsync v1.2.0, R-5), LIVE.** Scoping correction (Viktor): "restic box" and "PBS box" are NOT two
diff --git a/REPORT.md b/REPORT.md
index 6424cd2..5a47e83 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -66,9 +66,22 @@ simply reads as expired (no security or storage pressure).
   `/configuration`, `/offsite` all `302 → /login` through `RequireAuth`, while `/bind/<token>` renders
   `200` — proving the exemption is tight (`TestSelfBind_D_AuthGateIntact`, `TestSelfBind_E_TheTrap`).
 
-### Live validation
+### Live validation (hub 0.66.0 live on k3s, through the real `hub.felhom.eu` ingress, 2026-07-18)
 
-Filled in after deploy — see the CONTEXT.md live-state note.
+- **Public page renders logged-out, no oracle:** `GET /bind/<garbage>` → `200` rendering the Hungarian
+  *"Doboz összekötése … érvénytelen vagy lejárt"* page (an unknown token folds into the generic
+  expired state — no *was-this-real* signal). The `200` (not `500`) also **proves the `selfbind_tokens`
+  table migrated live** — `SelfBindTokenByHash` queried it successfully (a missing table would 500).
+- **Auth gate intact (THE TRAP is tight live):** `GET /` and `GET /hosts` → `302 → /login`.
+- **CSRF exemption is `/bind/`-only, live:** `POST /bind/<garbage>` with **no** CSRF/session → `200`
+  (exempt at gate site 1), renders the generic failure; the control `POST /customers/acme/block` with
+  no CSRF → `302 → /login` (auth fires first — the exemption did not widen).
+- **Clean startup:** migrate() ran without error; `Listening on :8080`, all checkers seeded.
+
+**Pending (NOT-live, as anticipated):** the operator-minted full customer walk (the "Send self-bind
+link" button and the customer's real two-factor success are behind the operator password gate → CC
+cannot log in) and the new-ISO console pairing-code banner on a physically re-imaged box — both fold
+into the supervised rehearsal (R-1).
 
 ### Not in this slice (deferred)