diff --git a/.planning/STATE.md b/.planning/STATE.md
index 5703e9ff..7c78b45e 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -5,7 +5,7 @@ milestone_name: milestone
 current_phase: 09
 current_phase_name: BotFights Platform Upgrade
 status: planning
-stopped_at: Phase 10 COMPLETE; Bitcoin-RPC delivery gap found+fixed+proven on archi-dev-box; Phase 1 resumed — 01-04 (FED-05 Lightning mesh facts) complete
+stopped_at: v1.7.120-alpha STAGED — built, deployed and verified on archi-dev-box; awaiting operator go/no-go + signing (mnemonic is operator-only)
 last_updated: "2026-08-02T23:20:00.000Z"
 last_activity: 2026-08-02
 last_activity_desc: 01-04 shipped (lnd.getinfo identity+uris, LightningInfo mesh message, mesh.lightning-peers/send-lightning-info) — 1087 tests green; found 3 wholesale-rebuild paths that would have silently wiped MeshPeer.lightning_uri
@@ -163,6 +163,33 @@ Decisions are logged in PROJECT.md (10 locked ADRs in the `<decisions>` block +
 | Fleet | FLEET-02 per-app deep health assertions (~34 apps) | v2 | 2026-07-29 |
 | Fleet | FLEET-03 LUKS2 data-partition encryption | v2 | 2026-07-29 |
 
+## Release staging — v1.7.120-alpha (2026-08-03)
+
+Built from `4d67f56b` (release profile, 15m15s, exit 0), deployed to archi-dev-box,
+`.bak` rollback at /opt/archipelago/rollback/archipelago.bak.
+
+Verified on the node: both security gates 401 unauthenticated from a non-loopback
+address; CORS origin-scoped; AIUI assets 200 AFTER the frontend rsync (the deploy that
+would have wiped a copied-file fix); mesh.lightning-peers/send-lightning-info answer
+correctly; system.stats host_secrets = per-node; served bundle sha256-matches the build
+on all three chunks; 31 containers up, none down, no restart loop.
+
+NOT verified, deliberately: the new torrc SocksPort/SocksPolicy block. regenerate_torrc
+only fires on a Tor services change, so the live torrc still reads only `SocksPort 9050`.
+Gateway detection was proven in isolation (10.89.0.1 10.89.0.0/24; missing network exits
+non-zero -> stays loopback-only). The change is INERT this release since bitcoind has no
+-onion flag yet (Phase 12), so forcing a torrc regeneration would risk bouncing every
+onion service for zero benefit.
+
+Frontend is a proven no-op this cycle — built chunks are byte-identical to those already
+served — so a fleet node only changes binary + the two app-UI images + nginx.
+
+Remaining to ship: operator go/no-go, then `scripts/create-release.sh 1.7.120-alpha`
+(stops at the signing prompt — reads the master mnemonic interactively, operator-only),
+then publish-release-assets.sh to gitea-vps2, then push tags. CHANGELOG.md already
+carries curated v1.7.120-alpha notes (create-release.sh hard-fails without them).
+The 5x lifecycle gate was NOT run.
+
 ## Session Continuity
 
 Last session: 2026-08-02T23:20:00.000Z