diff --git a/deploy/2026.08.25.01.report.md b/deploy/2026.08.25.01.report.md
new file mode 100644
index 00000000..66801350
--- /dev/null
+++ b/deploy/2026.08.25.01.report.md
@@ -0,0 +1,131 @@
+# 2026.08.25.01 — report
+
+**5 of 5 target hosts succeeded.** Two hosts skipped by plan (`officer-dev`, `edge-pertento-bridge`);
+neither is a failure. Every target ended at `007cc9a1` = `deploy/2026.08.25.01` exactly.
+
+The schema change was verified **by query on each host's own database**, not by exit code. All five
+returned both columns.
+
+First release under a new watcher. The claim was taken by the watcher before this agent was spawned;
+this agent recorded `done` after the rollout.
+
+## The schema change
+
+Two nullable columns on `api_keys`. The plan's query, run per host:
+
+```sql
+select column_name from information_schema.columns
+ where table_name = 'api_keys' and column_name in ('permissions','excluded_kinds');
+```
+
+| Host                         | `permissions` | `excluded_kinds` | Result           |
+| ---------------------------- | ------------- | ---------------- | ---------------- |
+| `alpha`                      | ARRAY, null   | ARRAY, null      | 2 rows — pass    |
+| `fofos`                      | ARRAY, null   | ARRAY, null      | 2 rows — pass    |
+| `production-pertento-bridge` | ARRAY, null   | ARRAY, null      | 2 rows — pass    |
+| `deadpool-rezio-bridge`      | ARRAY, null   | ARRAY, null      | 2 rows — pass    |
+| `macbookpro`                 | ARRAY, null   | ARRAY, null      | 2 rows — pass    |
+
+No half-applied push anywhere — no host returned `permissions` alone.
+
+`bun db:push` exited 0 on all five and printed `Changes applied`. That was treated as not-evidence, per
+the plan; the table above is the evidence. `postdb:push` seeders ran clean everywhere (`seed:roles`
+0 seeded / 4 already present on all five).
+
+**No direct SQL was run on any host.** None was authorised and none was needed.
+**No `bun install` was run on any host**, per the plan — `bun.lock` is untouched by this release.
+
+## Per host
+
+### `alpha` — success
+
+- HEAD `23657210` (`deploy/2026.08.24.02-29-g23657210`) → `007cc9a1` (`deploy/2026.08.25.01`)
+- Tree clean of tracked changes. No untracked files.
+- Path `/home/pastilhas/officerdev/platform`, taken from PM2 `pm_cwd` — **not** the stale second
+  checkout at `~/dockers/officer.dev/platform`.
+- `bun db:push` exit 0 → verified by query, 2 rows.
+- `bun run plugins:update` — **14/14 updated in 57s**, exit 0. Fourteen plugin sidecars restarted
+  themselves during this step (atelier, bitcoin-wallet, email, gitea, invoices, jellyfin, minesweeper,
+  music, offscale, photos, soulseek, transcribe, transmission, vault).
+- `pm2 restart officer` — `restart_time` 2 → 3, `online`.
+- Health after: **21/21 processes online**, none errored.
+
+### `fofos` — success
+
+- HEAD `e0d80fd3` (`deploy/2026.08.24.02`) → `007cc9a1`
+- Tree clean of **tracked** changes. One untracked file present: `scripts/chk.ts`. Noted, not touched,
+  not a reason to skip — a fast-forward could not have affected it.
+- Remote is HTTPS here, as documented. Pulled in place.
+- `bun db:push` exit 0 → verified by query, 2 rows.
+- `bun run plugins:update` — 1/1 (gitea), exit 0; its sidecar restarted itself.
+- `pm2 restart officer` — `restart_time` 28 → 29, `online`.
+- Health after: **10/10 processes online**, none errored.
+- The August root-ownership problem did not recur: git and the plugin step both ran clean.
+
+### `production-pertento-bridge` — success
+
+- HEAD `e0d80fd3` (`deploy/2026.08.24.02`) → `007cc9a1`
+- Tree clean, no untracked files.
+- `bun db:push` exit 0 → verified by query, 2 rows.
+- `bun run plugins:update` — 1/1 (gitea), exit 0.
+- `pm2 restart officer` — `restart_time` 7 → 8, `online`.
+- Health after: **15/15 processes online**, none errored.
+- Cosmetic only: the interactive shell prints an nvm warning about a `globalconfig`/`prefix` in
+  `~/.npmrc`. It did not affect any step. Not fixed — outside a rollout's scope.
+
+### `deadpool-rezio-bridge` — success
+
+- Logged in as **`br`**, not `pastilhas`. Checkout `/home/br/officerdev/platform`.
+- HEAD `e0d80fd3` (`deploy/2026.08.24.02`) → `007cc9a1`
+- Tree clean, no untracked files.
+- `bun db:push` exit 0 → verified by query, 2 rows.
+- `bun run plugins:update` — 2/2 (email, offscale), exit 0; both sidecars restarted themselves.
+- `pm2 restart officer` — `restart_time` 13 → 14, `online`.
+- Health after: **9/9 processes online**, none errored.
+
+### `macbookpro` — success (it was awake)
+
+- Awake and reachable, so it was a target rather than a skip.
+- HEAD `8e2670ff` (`deploy/2026.08.24.02-96-g8e2670ff`, one commit short of the tag) → `007cc9a1`
+- Tree clean, no untracked files.
+- `/opt/homebrew/bin` **appended** to PATH for the `bun` commands; `pm2` run as a separate command
+  through `$SHELL -ic`, per `docs/servers.md`. Both worked.
+- `bun db:push` exit 0 → verified by query, 2 rows.
+- `bun run plugins:update` — `no plugins installed — nothing to update`, exit 0. Nothing restarted here
+  by that step.
+- `pm2 restart officer` — `restart_time` 15 → 16, `online`.
+- Health after: **6/6 processes online**, none errored.
+
+## Skipped
+
+### `officer-dev` — skipped, and deliberately
+
+The host this rollout ran on. Not pulled, not restarted, nothing touched. Restarting `officer` here
+would have ended the rollout mid-flight.
+
+Its checkout is **ahead** of the tag: HEAD `e1f5d01b`, two commits past `007cc9a1`, with uncommitted
+work belonging to another session (`src/servers/hono.ts`, `src/workspaces/hooks/src/useClient.ts`, and
+an untracked `src/servers/hono-error-shape.test.ts`). It therefore already holds this release's code and
+more. **The owner restarts it deliberately when they are happy with the rest** — that is the one
+outstanding action from this deploy.
+
+### `edge-pertento-bridge` — skipped by the plan. NOT a failure.
+
+Excluded by name in `deploy/2026.08.25.01.md`, which is the authority here. It has no `roles` table
+while both its accounts hold roles, so a single `db:push` would create the foreign key against an empty
+`roles` and fail — possibly while still exiting 0. It also missed two releases carrying one-off steps
+that a fast-forward does not replay.
+
+Not contacted at all. No time spent on it. Bringing it forward is a watched, by-hand operation the owner
+is doing separately.
+
+## What did not get done
+
+- `officer-dev` was not restarted — by design, see above. It is the only host not running a
+  freshly-started `officer` process, though it is on newer code than the tag.
+- No verification of the release's *behaviour* was attempted: whether a commander asks its first
+  question in the owner's language, and whether a Member's phone can now register for notifications,
+  are the plan's "what to check" items and they need a human with a browser. Hard-refresh before
+  judging either — a stale bundle looks exactly like a failure.
+- Documentation was not checked or edited. `bun run docs:check` is the release-cutter's step, not this
+  agent's.