diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index c247c4d..fb25b4e 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -29,10 +29,13 @@ filesystem JSON storage (no SQL). i18n TH/EN. No self-registration (admin provis
 > users. Server-side token validation via stdlib urllib (no new dep; Google tokeninfo + Facebook
 > app/debug-token/me), fail-closed when creds absent (login page shows no social buttons),
 > rate-limited per-IP + per-email. **348 backend tests pass (11 new), frontend build clean, manual
-> security review PASS.** Committed locally (see `docs/engineering-log/2026-08-20-oauth-google-facebook.md`).
+> security review PASS. PUSHED + LIVE (verified 2026-08-20)** — backend booted, OAuth routes
+> registered and fail-closed disabled until creds set, new bundle served. To enable, set
+> `OAUTH_*` creds + `OAUTH_DEFAULT_ORG` in EasyPanel env. See
+> `docs/engineering-log/2026-08-20-oauth-google-facebook.md`.
 > Also: the `website/` marketing site was **moved out of this repo** into its own project
 > `~/Gitea/Sales Trainer Website/` (own git repo, `7e2b74d`, not pushed) — this repo is now
-> **app-only** (commit `74de0d4`, not yet pushed).
+> **app-only** (commit `74de0d4`, pushed with the OAuth deploy).
 > **2026-08-19:** app UX/UI redesign (8 files, 100% presentational: global design-token system
 > rebuild in `style.css` + polish of App/Login/Chat/MyBoard/Personas/Setup/Training) AND a new
 > self-contained marketing landing site (`website/index.html` + `main.css`, TH-primary with EN
diff --git a/docs/engineering-log/2026-08-20-oauth-google-facebook.md b/docs/engineering-log/2026-08-20-oauth-google-facebook.md
index 9523e53..33b49b5 100644
--- a/docs/engineering-log/2026-08-20-oauth-google-facebook.md
+++ b/docs/engineering-log/2026-08-20-oauth-google-facebook.md
@@ -101,6 +101,15 @@ M docs/engineering-log.md  (this entry)
 ```
 
 ## Next action
+## DEPLOY — SUCCESSFUL (pushed + live, verified 2026-08-20)
+- Operator approved push. `ece187b..d6e7cff main -> main` pushed → Gitea→EasyPanel webhook
+  auto-deployed (~3 min). Live verification:
+  - Backend booted: `POST /api/auth/login` → 400 (Flask alive, no crash-loop).
+  - `GET /api/auth/oauth/config` → **200** `{"google":false,"facebook":false,"google_client_id":"","facebook_app_id":""}` — OAuth routes live + **fail-closed disabled** (creds not set, correct/safe).
+  - Live bundle `index-CyyCBLha.js` = the freshly-built OAuth bundle (hash matches local build).
+- Deploy status: code LIVE. OAuth stays disabled until creds configured (safe default).
+
+## To ENABLE OAuth in production (operator)
 - Operator approves push → deploy to EasyPanel (oauth disabled by default until creds set).
 - To ENABLE OAuth in production, set in EasyPanel env: `OAUTH_GOOGLE_CLIENT_ID` +
   `OAUTH_GOOGLE_CLIENT_SECRET` (or FB equivalents) + `OAUTH_DEFAULT_ORG`. Until then the login