diff --git a/docs/arena-deployment.md b/docs/arena-deployment.md
index 12c864b..baa3dcc 100644
--- a/docs/arena-deployment.md
+++ b/docs/arena-deployment.md
@@ -288,3 +288,28 @@ ssh debian@146.59.87.168 '
 
 22, 80, 81, 443, 2100, 2101, 2222, 3000, 3009, 5355, 7788, 8000, 8092, 8123,
 8443, 8444, 9443, and now **9100** (this deployment).
+
+## 1.2.0 public-contract verification (plan 09-05, 2026-07-31)
+
+All checks below ran against `https://botfights.archipelago-foundation.org`
+(never `127.0.0.1`/the raw port) after `docker compose pull && up -d` recreated
+the container on the `botfights:1.2.0` tag (post-poll-fix build):
+
+| Check | Result |
+|---|---|
+| `GET /api/health` | `{"status":"ok","name":"botfights"}` |
+| `GET /api/docs/prompt` | 200, `text/markdown`, arena URL substituted 9×, zero leftover `{{ARENA_URL}}` tokens |
+| `GET /api/auth/me` (no token) | 401 |
+| `POST /api/bots` (anonymous, from off-host) | 200, id+secret issued; bot immediately visible in `GET /api/bots` |
+| `GET /api/fights/poll` (bot auth via `Authorization: Bot id:secret`) | 200 `{"pending":false}` — see the `GET /:id` route-order fix above; this was 404 before it |
+| `POST /api/queue/join/<botId>` → poll again | matched into a real fight within seconds; poll returned the live challenge payload |
+| `GET /api/fights/<id>/stream` (SSE) | Incremental delivery confirmed: `spectator_count`/`ping` events at connection open, a second `ping` ~15s later, then `round_end`/`round_start`/`poll_challenge` in a fresh cluster ~4-5s after that — spread over a live 25s capture window, not buffered until stream close |
+| `JWT_SECRET` survived the roll | `/opt/botfights-arena/.env` mtime predates this session's image rolls (unchanged); container's `JWT_SECRET` env still sources `${JWT_SECRET}` from that same file, not a freshly generated value |
+| Data integrity | `GET /api/bots` → 101 (100 original + 1 test bot from an earlier verification pass), `?type=classic` → 15, unchanged/grown from the pre-roll 100+15 |
+
+**Test bots left in the arena, clearly named per this plan's own naming
+convention (no bot-deletion API exists in this codebase to remove them
+cleanly):** `wavetest2`, `wavetest3` — both anonymous, harmless, real
+fighters; consistent with the arena's existing `FIGHT_LOOP_ENABLED=true`
+mock-bot background activity. `wavetest3` fought one live match as part of
+verifying the SSE stream above.