docs: record hub 0.66.0 self-bind live validation (R-27 slice 1)

Live through the real ingress: public /bind/ renders logged-out with the
no-oracle expired state (200-not-500 proves selfbind_tokens migrated);
gate intact (/ and /hosts -> /login); CSRF exemption is /bind/-only
(POST /bind/ no-CSRF 200 vs POST /customers/x/block no-CSRF 302).
Operator-minted full walk + new-ISO console banner remain operator/R-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017qDiBqKKQ5vPB5fXBqu7Kp

CONTEXT.md

@@ -21,8 +21,14 @@
   **GC verdict:** no appliance-staleness GC exists (`applianceStaleAfter` is a display badge only) → the
   7-day token TTL stands alone, single-active-per-customer, no reaper needed. **Controller/agent
   untouched; R-27b (controller second-box dismissable prompt) DEFERRED, mechanism sketched.** Green:
-  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **LIVE validation pending deploy
-  (this session).** See REPORT.md.
+  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **DEPLOYED + LIVE (hub 0.66.0 on
+  k3s, Synced/Healthy).** Live through the real ingress: `GET /bind/<garbage>` → 200 Hungarian expired
+  page (public, logged-out, no-oracle — the 200-not-500 proves `selfbind_tokens` migrated live); `/` +
+  `/hosts` → 302 /login (gate intact); `POST /bind/<garbage>` no-CSRF → 200 (exempt) while
+  `POST /customers/acme/block` no-CSRF → 302 /login (exemption is `/bind/`-only). **PENDING
+  (operator-gated, NOT-live):** operator "Send self-bind link" + the customer's real two-factor success
+  (hub UI password-gated → CC can't log in) + the new-ISO console banner on a re-imaged box → fold into
+  the R-1 rehearsal. See REPORT.md.
 
 - **2026-07-17 — PBS DR STORAGE VISIBILITY + Offsite tab split + dual gauges shipped (hub v0.65.0 +
   tenantsync v1.2.0, R-5), LIVE.** Scoping correction (Viktor): "restic box" and "PBS box" are NOT two

REPORT.md

@@ -66,9 +66,22 @@ simply reads as expired (no security or storage pressure).
   `/configuration`, `/offsite` all `302 → /login` through `RequireAuth`, while `/bind/<token>` renders
   `200` — proving the exemption is tight (`TestSelfBind_D_AuthGateIntact`, `TestSelfBind_E_TheTrap`).
 
-### Live validation
+### Live validation (hub 0.66.0 live on k3s, through the real `hub.felhom.eu` ingress, 2026-07-18)
 
-Filled in after deploy — see the CONTEXT.md live-state note.
+- **Public page renders logged-out, no oracle:** `GET /bind/<garbage>` → `200` rendering the Hungarian
+  *"Doboz összekötése … érvénytelen vagy lejárt"* page (an unknown token folds into the generic
+  expired state — no *was-this-real* signal). The `200` (not `500`) also **proves the `selfbind_tokens`
+  table migrated live** — `SelfBindTokenByHash` queried it successfully (a missing table would 500).
+- **Auth gate intact (THE TRAP is tight live):** `GET /` and `GET /hosts` → `302 → /login`.
+- **CSRF exemption is `/bind/`-only, live:** `POST /bind/<garbage>` with **no** CSRF/session → `200`
+  (exempt at gate site 1), renders the generic failure; the control `POST /customers/acme/block` with
+  no CSRF → `302 → /login` (auth fires first — the exemption did not widen).
+- **Clean startup:** migrate() ran without error; `Listening on :8080`, all checkers seeded.
+
+**Pending (NOT-live, as anticipated):** the operator-minted full customer walk (the "Send self-bind
+link" button and the customer's real two-factor success are behind the operator password gate → CC
+cannot log in) and the new-ISO console pairing-code banner on a physically re-imaged box — both fold
+into the supervised rehearsal (R-1).
 
 ### Not in this slice (deferred)