diff --git a/scripts/e1-live-check.sh b/scripts/e1-live-check.sh
new file mode 100644
index 0000000..339d42e
--- /dev/null
+++ b/scripts/e1-live-check.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# E1 живая проверка на CT108: логин по пользователю, сессии, lockout, права
+set -e
+echo "=== login admin/pass123 (legacy-пользователь, без unit):"
+curl -s -m 15 -X POST localhost:8000/api/v1/auth/login \
+  -H 'Content-Type: application/x-www-form-urlencoded' \
+  --data 'username=admin&password=pass123' > /tmp/e1-login.json
+python3 -c 'import json; d=json.load(open("/tmp/e1-login.json")); assert "access_token" in d; print("login OK, token получен")'
+TOKEN=$(python3 -c 'import json; print(json.load(open("/tmp/e1-login.json"))["access_token"])')
+echo "=== /me (permissions через legacy-роль):"
+curl -s -m 15 localhost:8000/api/v1/auth/me -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
+echo "=== logout:"
+curl -s -m 15 -X POST localhost:8000/api/v1/auth/logout -H "Authorization: Bearer $TOKEN" | head -c 100
+echo
+echo "=== me после logout — должен быть 401:"
+curl -s -o /dev/null -w "%{http_code}\n" -m 15 localhost:8000/api/v1/auth/me -H "Authorization: Bearer $TOKEN"
+echo "=== таблицы RBAC в живой БД:"
+docker exec vector-postgres psql -U postgres -d vector_mchs -t -c \
+  "SELECT 'roles='||count(*) FROM roles UNION ALL SELECT 'permissions='||count(*) FROM permissions UNION ALL SELECT 'matrix='||count(*) FROM role_permissions UNION ALL SELECT 'auth_events='||count(*) FROM auth_events UNION ALL SELECT 'sessions='||count(*) FROM sessions;"
\ No newline at end of file