diff --git a/docs/session-handoff.md b/docs/session-handoff.md
index 4ef2a13..85872c2 100644
--- a/docs/session-handoff.md
+++ b/docs/session-handoff.md
@@ -55,6 +55,33 @@ version bump / CHANGELOG / tag / push — the fix lives on the branch only. The
 
 ---
 
+## 2b. DONE — Server-Details UX + hardening polish (2026-06-14)
+
+Seven reported issues fixed on `feat/v1-foundation` (committed, **not** tagged/pushed). Spec:
+`docs/superpowers/specs/2026-06-14-server-details-hardening-polish-design.md`; plan:
+`docs/superpowers/plans/2026-06-14-server-details-hardening-polish.md`.
+
+1. **Buttons unified** — `x-btn`: retired borderless `ghost`/`ghost-danger`, added `danger-soft`
+   (red-tinted border+bg, always). Löschen/trash now consistent, no hover-only red. All 10 usages
+   migrated (servers/settings/files).
+2. **Firewall + fail2ban panels** — render only when the tool is installed **or** the read failed
+   (`readError`); 2-col `lg` grid when both, full width when one, hidden when absent. Removed the
+   redundant "nicht installiert" boxes.
+3. **Auto-updates** — reframed as an operator preference: `secure` always true, muted
+   aktiv/inaktiv chip (never SICHER/OFFEN). `HardeningService` `neutral` row flag.
+4. **Create-server** — verifies the SSH login inside the create transaction via
+   `FleetService::testConnection` (echoes a marker, requires it in output — proves exec, tolerates
+   missing exit-status). Failure rolls back + shows the SSH reason. New server starts `pending`.
+5. **`pending` status** = "Initialisierung" (cyan, never red) across status-pill/dot, server-item,
+   fleet index, and the details hero. Promotes on first contact.
+6. **SSH key-only hint** on the SSH-Passwort-Login checklist row while password auth is on.
+
+Verified: 16 tests pass (`ButtonComponentTest`, `StatusComponentTest`, `HardeningServiceTest`,
+`FleetTestConnectionTest`, `CreateServerTest`, `ServerShowPanelsTest`, `ServerShowSshHintTest`);
+Pint clean; R12 browser DE+EN at 375/768/1280 (200, 0 console, 0 leaked tokens); Codex clean after
+3 review rounds. **Pre-existing** stock `tests/Feature/ExampleTest.php` still fails (asserts `/` =
+200 but the app redirects to login) — unrelated; a task chip was spawned to delete/fix it.
+
 ## 3. Other open items / follow-ups
 
 - `resources/js/app.js` `dualChart` is **dead code** — the dashboard chart is a server-rendered