diff --git a/03-DESIGN/01-to-be/00-work-breakdown.md b/03-DESIGN/01-to-be/00-work-breakdown.md
index 6d7fdc4..94242a4 100644
--- a/03-DESIGN/01-to-be/00-work-breakdown.md
+++ b/03-DESIGN/01-to-be/00-work-breakdown.md
@@ -2,7 +2,7 @@
 layer: to-be
 status: designed
 code: []
-updated: 2026-08-31
+updated: 2026-09-01
 decisions:
   - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md
   - 02-DECISIONS/0005-the-node-host.md
@@ -257,6 +257,32 @@ Each exercises something the first one does not.
 **3.3 is the hardest thing in this document** and is deliberately last. If the declaration
 language turns out to be insufficient, it says so here.
 
+### Where Phase 3 actually stands — *2026-09-01*
+
+All three have manifests. All three parse, resolve and plan. **None of them can start**, and the
+two reasons are both filed rather than guessed at.
+
+The **vocabulary held**. Nothing in 3.1–3.3 turned out to need a new shape: the identity provider,
+the forge and the mail system are all expressible with what exists, including the mail system's
+several containers on a private network — which was the one expected to break it. That is the
+question this phase was designed to answer, and the answer is yes.
+
+What did not hold was underneath the vocabulary:
+
+- **[`022`](../../04-ISSUES/022-one-credential-per-node-per-provision-not-per-module/00-report.md)**
+  (fixed) — a credential belonged to a machine, so a node running several modules against one
+  database could not be planned. The refusal was loud on the provider and silent on the consumer.
+- **[`023`](../../04-ISSUES/023-a-consumer-cannot-build-a-connection-string/00-report.md)** (open)
+  — a consumer gets its password and still cannot connect: the user name is invented by the
+  provisioner and recorded nowhere, and the bound values cannot reach a configuration file.
+
+A third fault was in the manifests themselves rather than the design: each declared a secret at a
+path named `.env` and read it as one, when a sealed file holds a password and nothing else. They
+parsed and resolved and could never have worked, which is what a manifest checked only by a parser
+buys. Two tests now refuse both halves of it.
+
+**023 is the whole of what remains before 3.1 runs.**
+
 ## The conversion is done by hand, and that is a decision
 
 *2026-08-31.* **Moving from the current system to this one is a person at a command line, working