diff --git a/docs/build-status.md b/docs/build-status.md
index 3d73007..9afd872 100644
--- a/docs/build-status.md
+++ b/docs/build-status.md
@@ -224,3 +224,21 @@ externally over v4+v6). UDP data plane on all four service addresses :8442 — t
 the stun-5780 substrate. Daily randomized self-update timer installed (checksum-verified
 against SHA256SUMS; signature verification still TODO before treating the source as untrusted).
 Host config in `/etc/echolot-server.env`. SSH access for sessions: `ssh claude-echolot`.
+
+## Server v0.3.0 — STUN + TCP echo + observations + actions (2026-07-31)
+Shipped and deployed to fmr via the server's own `--self-update` (first real exercise:
+checksum-verified download v0.2.0→v0.3.0, atomic replace, restart — worked). Added over v0.2.0:
+- **STUN** (RFC 5389 + 5780): 4 service addrs × primary/alt-port grid. Externally verified on
+  v4 AND v6 — binding success with XOR-MAPPED, RESPONSE-ORIGIN, OTHER-ADDRESS present, so the
+  profile now advertises **`stun-5780`** (the second IP earns its keep).
+- **TCP echo** (:8441): JSON greeting with observed src + real Linux TCP_INFO — verified
+  externally `mss:1440` (v6, 1500−60), options `[sack,wscale]`, then byte-echo.
+- **Observations API** `GET /v1/sessions/{id}/observations` (per-packet UDP view, connect-back
+  results, TCP records correlated by source IP).
+- **Actions** `POST /v1/sessions/{id}/actions`: `delayed_echo` (DELAYED_ECHO at the observed
+  data-plane source — NAT-lifetime primitive) and `connect_back` (dials the control-plane
+  source, records connected/refused/timeout+rtt).
+- Capabilities computed from what's actually wired: `udp-probe, delayed-echo, connect-back,
+  tcp-echo, stun-5780`.
+Still not implemented: TLS-echo/JA4, HTTP echo, tls-reference, canary DNS (§6.1 reference
+records), and the train/big-send/frag/throughput actions. Admin UI still token-mint + health only.