diff --git a/docs/outline/04-agent-runbook.md b/docs/outline/04-agent-runbook.md
index 89b9a9c..7e63d71 100644
--- a/docs/outline/04-agent-runbook.md
+++ b/docs/outline/04-agent-runbook.md
@@ -242,6 +242,24 @@ file or the running `hub` container.
 | `docker exec <container> /app/hub -healthcheck` | exit 0 (the compose healthcheck) |
 | Container with the image's default `nonroot` user | 401 on `/ask`, `omniroute: unknown` (the finding above) |
 
+### Live deploy result — 2026-10-10
+
+Sam accepted the approval card. The deploy ran from the project folder.
+
+| Step | Result |
+|---|---|
+| `scripts/provision-hub-tokens.sh` | Added 5 keys to the secrets file. Mode 600 kept. Backup `10-secrets.conf.bak.20261010T065304Z`. Values not shown. |
+| `docker compose up -d --build` | Exit 0. Container `hub` recreated and started. |
+| Image | `central-ai-hub:local`, `sha256:f6b773c8a33a` |
+| Container user | `1000:100` |
+| `GET /health` | `ok: true`, `omniroute: ok`, `log: ok` |
+| `POST /ask` `"cut the kids internet"` (`HUB_TOKEN_ESP32`) | `status: "refused"`, `route.kind: "refused"`, `route.reason: "high_consequence_control"` |
+| `POST /ask` with a bad token | HTTP 401 `unauthorized` |
+| `docker inspect hub` | `healthy` |
+
+The control refusal ran with no LLM call, as the `understand/control.go` phrase
+check runs first. The Hub now serves the AUD-49 build on port 8788.
+
 ## After Phase 1
 
 Follow the build order in `AGENTS.md`. Do not start a destination before the