diff --git a/migration-report.md b/migration-report.md
index 25cfb8b342..cc84aa1080 100644
--- a/migration-report.md
+++ b/migration-report.md
@@ -47,6 +47,51 @@ Installed Quarkus features at boot: agroal, cache, cdi, hibernate-orm, hibernate
 - **Private intercepted methods:** three `@Transactional` private methods made package-private; `quarkus.arc.fail-on-intercepted-private-method=false` for `@AssertTrue` private validation getters.
 - **RESTEasy `@BeanParam`/multipart binding:** added `@QueryParam`/`@RestForm` to several request DTO fields.
 
+## Docker + Cucumber E2E (runtime validation)
+The Quarkus uber runner-jar was packaged into a minimal `eclipse-temurin:25-jre` image and run in
+Docker (login disabled, CLI endpoints removed - approximating the `ultra-lite` profile). The
+project's `behave` (Python Cucumber) API suite was run against it on `:8080`.
+
+**Result: 161 / 258 scenarios pass (62%), 1365 steps pass, 80 skipped (JWT-dependent; login off).**
+
+Getting from "boots" to "serves real PDF traffic" required fixing a chain of systemic runtime bugs
+the build/augment gates could not catch (each masked the next):
+1. **OIDC required at boot** - `quarkus-oidc` aborts startup without `auth-server-url`; defaulted
+   `quarkus.oidc.enabled=false` (re-enabled by an OAuth2 deployment).
+2. **Redis/Valkey eager init** - the Valkey backplane beans eagerly injected an inactive
+   `RedisDataSource`; gated them at build time (`@IfBuildProperty cluster.backplane=valkey`) and
+   disabled the redis health check. Single-node now boots with no Redis.
+3. **`GlobalExceptionHandler` threw `UT000048`** - injected the undertow `HttpServletRequest` into a
+   RESTEasy-Reactive `ExceptionMapper`; touching it on a reactive thread throws, masking every real
+   error. Replaced with `@Context UriInfo`.
+4. **Request-path servlet access** - the audit interceptors (`ControllerAuditAspect`, `AuditAspect`),
+   `AutoJobAspect`, and `JobExecutorService` all read `HttpServletRequest` on reactive threads
+   (`UT000048`). Routed through the guarded `AuditService.getCurrentRequest()` / Vert.x
+   `CurrentVertxRequest`. This unblocked the entire `@AutoJobPostMapping` endpoint class (most PDF
+   operations).
+5. **License singleton PK race** - Spring Data `save()` on the manually-`@Id`'d `UserLicenseSettings`
+   singleton was an upsert; the migration's `persist()` is insert-only and threw a PK violation when
+   the startup license sync raced the first request. Made creation race-safe (JVM lock + committed
+   `QuarkusTransaction.requiringNew()` create-once). **This `save()`->`persist()`-should-be-`merge()`
+   pattern likely affects other manually-`@Id`'d entities and is a recommended audit.**
+6. Reactive-safe `HttpServletRequest` replacement also applied to `AuthController` / `UserController`
+   / `ConfigController` (`UriInfo` / `HttpHeaders` / Vert.x `HttpServerRequest`).
+
+### Remaining cucumber failures (97), categorized
+| Cause | Count (approx) | Nature |
+|-------|------|--------|
+| `500` on endpoint | 34 | Real per-endpoint migration bugs to chase down individually |
+| `400` bad request | 15 | Multipart/`@RestForm` binding gaps (documented TODO - some DTO list/file fields not yet bound to `FileUpload`) |
+| `403` disabled endpoint | 14 | CLI/feature-gated endpoints absent in the lite image (config, not a bug) - mobile-scanner, OCR, Python-backed tools |
+| `FileAlreadyExistsException` temp file | ~6 | Real bug: temp-file creation collides on a fixed name (needs unique name / `REPLACE_EXISTING`) |
+| `PDF corrupted` on split-pages | ~8 | PDF read/repair path rejects the generated test PDFs - needs investigation |
+| Feature-not-enabled / external tool | ~20 | mobile-scanner / Python / OCR not in the lite image (config) |
+
+A large share of the 97 are environmental (lite image lacks CLI tools / optional features), not
+migration defects. The genuine code-level follow-ups are the 500s, the multipart-binding 400s, and
+the temp-file-collision bug. SAML/SSO validation (`testing/compose`) is not yet attempted - the SAML
+layer is still incomplete in code (see below).
+
 ## Known Issues / Follow-up
 | Area | Status | Notes |
 |------|--------|-------|