diff --git a/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md b/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md
index 66cecfd6..5f3eab5a 100644
--- a/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md
+++ b/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md
@@ -89,14 +89,16 @@ note. Each gap says what is open, why it matters, and what would close it.
    account answered as the operator. An agent could therefore post comments, pull requests and approving reviews
    as the operator. The operator's own forge account is also a site administrator, so acting as it is acting as
    an administrator.
-   *Closes with:* the tool sending only a known list of query keys and never `sudo` (being fixed in
-   mesh-catalog #153); later, a non-administrator account for the tools (gap 7).
+   *Closed* on 2026-10-09 by mesh-catalog #153: the tools send only a known list of query keys, never `sudo`, and
+   every caller-supplied path segment is checked, so `..` cannot reach another endpoint. A non-administrator account
+   for the tools (gap 7) remains.
 
 13. **The forge applies only the first protection rule that matches a branch.** A rule named for the branch comes
    before a glob rule. A weak rule named for a branch next to a strong glob would leave the branch weakly protected,
    while a reader that asks "does any rule protect it" sees it as protected. No repository has such a pair today
    (every rule is named `main`), and the tools refuse to create one.
-   *Closes with:* every reader judging the first matching rule, as the forge does.
+   *Closed* on 2026-10-09 by mesh-controller #177: the build-source check judges the first matching rule, as the
+   forge does.
 
 ## Why it is an issue