diff --git a/docs/agents/GITEA-SETUP.md b/docs/agents/GITEA-SETUP.md
index 7cb08a9e..45608eda 100644
--- a/docs/agents/GITEA-SETUP.md
+++ b/docs/agents/GITEA-SETUP.md
@@ -9,17 +9,25 @@ Steps are marked **👤 you** (a decision or a credential only you can make) or
 
 ## Where things stand
 
-* ✅ `main` carries the play-tested port work and the rewritten briefs (`cd3a81af`).
-* ✅ The briefs already describe this workflow. **They describe tooling that does
-  not exist yet** — which is why the agents are stopped and must stay stopped
-  until Phase 7.
-* ❌ Nothing exists on the instance: no agent users (only `fabi`), no API
-  tokens, no labels, no milestones, no branch protection.
-* ⏳ The MCP wiring (Phase 5) is written and in the tree; the images have not
-  been rebuilt, and no token exists for it to use yet.
+**Updated 2026-09-04, against the live instance.** Phases 1–4 and 6 are done.
 
-⚠️ **Do not start an agent before Phase 7.** Its brief will tell it to read
-notifications and open issues, and it will have no tool that can.
+| phase | state |
+|---|---|
+| 1 · identities | ✅ `sylph-decoder`, `sylph-port`, both collaborators at **Write** |
+| 2 · protection | ✅ applied and **verified behaviourally** — a real push to `main` was refused with `pre-receive hook declined`, as the repository owner |
+| 3 · tokens | ✅ three, each functionally probed: right identity, `403` on `branch_protections` for both agents |
+| 4 · labels | ✅ 11 labels, 4 milestones, idempotence confirmed by a second run creating nothing |
+| 5 · MCP | ⏳ **written and merged; the images are NOT rebuilt.** This is the remaining blocker |
+| 6 · items | ✅ 9 issues seeded with 3 dependency edges, read back. All `state/proposed` — **awaiting the human's approval of the shapes** |
+| 7 · restart | ⏳ after the rebuild |
+
+⚠️ **Do not start an agent before Phase 7.** Until the images are rebuilt, the
+briefs tell it to read notifications and open issues with no tool that can.
+
+📌 **This block goes stale first.** It was already wrong once — it read "nothing
+exists on the instance" while nine issues were live. If it disagrees with
+`gitea-protect --verify` or the issue list, believe those: they measure, this
+remembers.
 
 ---