diff --git a/docs/build-status.md b/docs/build-status.md
index 9afd872..4b044d9 100644
--- a/docs/build-status.md
+++ b/docs/build-status.md
@@ -242,3 +242,15 @@ checksum-verified download v0.2.0→v0.3.0, atomic replace, restart — worked).
   tcp-echo, stun-5780`.
 Still not implemented: TLS-echo/JA4, HTTP echo, tls-reference, canary DNS (§6.1 reference
 records), and the train/big-send/frag/throughput actions. Admin UI still token-mint + health only.
+
+## Canary DNS live — server v0.3.1 on fmr (2026-07-31)
+Zone `c.echo-lot.app` delegated (NS → fmr-1/fmr-2) and authoritative on all 4 service IPs
+udp+tcp/53. Verified through full public recursion: `ttl-5` A→192.0.2.5 (Cloudflare), `ttl-3600`
+AAAA→2001:db8::3600 (Google), `big-txt` TXT returned (TCP fallback, truncated over UDP as
+designed). End-to-end session attribution works: a `<nonce>.<session-prefix>.c.echo-lot.app`
+query resolved via a public resolver shows up in `GET /v1/sessions/{id}/observations` →
+`dns_canary` with the resolver's real egress IP, transport, and EDNS. First real test already
+caught a finding: **Google applies 0x20 case randomization** (mixed-case qname), Cloudflare does
+not — captured via `case_preserved`. Capabilities now: udp-probe, delayed-echo, connect-back,
+tcp-echo, stun-5780, canary-dns. Kept the hand-rolled stdlib DNS (no miekg/dns) — validated
+against independent clients. Deployed via `--self-update` (v0.3.0→v0.3.1, checksum-verified).