From 61f61b5d068b2c275755ec84d6d7c242d5093a7c Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 21 Sep 2026 01:52:53 +0200
Subject: [PATCH] Reconcile the open issues against main

An audit of the six code repositories found eleven open issues fixed on main
with commits and beds to show (025, 027, 033, 036, 037, 040, 045, 047, 050,
052, 053), three partly (007, 026, 035), nine not (020, 031, 041, 046, 049,
054, 064, 065, 066) and one whose fix would live outside those repos (006).
Resolved ones name their evidence; partly ones say what remains; 041 records
that the exposure has widened since it was reported.
---
 .../checks/__pycache__/cycle.cpython-314.pyc    | Bin 0 -> 12092 bytes
 .../00-report.md                                |   1 +
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   2 +-
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   2 +-
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   9 +++++++++
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 .../00-report.md                                |   4 ++--
 16 files changed, 34 insertions(+), 24 deletions(-)
 create mode 100644 00-META/checks/__pycache__/cycle.cpython-314.pyc

diff --git a/00-META/checks/__pycache__/cycle.cpython-314.pyc b/00-META/checks/__pycache__/cycle.cpython-314.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..d78646152b63d0f664fbe0b1e48af959d5b4d9ea
GIT binary patch
literal 12092
zcmcgSTTmNUmbdjlPmp9D;uX_?!3Yp<$2NAH@DQ<$4WtE)9b-U94Ja0p(k+ao*_mbM
zXTZr0CX+4ju4fH3t})q~t?|sHDpc)mm8UjS$;W;`Bm?eHmD%0-+1i>aJ0v^1`Pn`9
zwpx;jY|m6}(k1od_POVt*FER-J+~$+Q;*;%K6CGlmr4=(cl;n9n)uD$F$$qs#Gnuw
zMhta^3Q^>$2r0-_8B&s~Dx|us=p*=K6w<XX^T}uY^b|<b9}Q_q1F35PO7X!c7)6Ux
zx|iER`Ub>kr>Kwtt~$6H;i`vgCZn{XP!^+tvx!l|+010X*>d>+qd9f~Ax|Ml2whh7
zRZ19B&!y<Hr4+Tqo8+-dKu+c4Z!@^=Wgyf)$<ZF}D(4FXr#OFzc8A?Qu9kLBa_%df
zr%tcO09X8h86W4F;OKE*V1}-0Xt1Am^taUq`GA`fgnD=mT;=$yUT&st%44GiS6HBD
z0{j(v3fcwQ>)~9q{S?h}0_Wo0lW?#1aBi>Q4ft_;C}1DMWC-2~^6U<HfCiV}Lkr=l
zU??z!fxLn+&EXr5*EQh}2wnj{jC-%u(fyMFfumhKNAuG@PN>!6t}gOG3n5nsNSFk=
zy&*s%vqo37z3S-ccM^i_b~-c(@8Ac3b+iMx2}6s2f}Z3sTF&JW=z!lB){pZ6e`v}T
z3UPcbJ;u3R(=aq1WLltoUc#-PP5~lpfcyv^&L?mn)4@p>A%*jg2Y5H<Y1Qj#nSC0R
z!H4OFW_zc@dFIs~+7ocoK^HFoU$ooB^IqU))aMFweCsF;gt!Tr-jD!-;W>9Gz=tK-
zxd5qrU=8}|QHjph(K@<~?(em?I|z2aYYK1zNj}acgn&(~i@0{GM&(<fb<{?Kp!|Up
zym6h)ctewc=@7_VhQ^Rs3jx2Iqes1dJJ`wu=wBG613WZL1$`VgIL<SQ^+HHU!Hd}e
zim?K)G0;_`_>!OihDn-i>fpqJLRh?#4PvR+0bXJ}0u2Q2lf;QQg}#6r>;#Cx)PYgK
zZ7qmdYPEa)AZtlXA(#(98ONVUAy?v3>P9dCrvcwp2?=SokA(q6oG2iVG-A%HKrmoI
z?!dGkc(&V9u$K7)#0G1@I03>Hbd7m^-cXq4u6YF@whY^=%MU+chU0CR&%_K%!>EfM
zo#0)b={TS937bL_P&0}xdI|(BnGmtX6pBJFeu4wjjVnwdM8E^fdKcpM>vFrfAkYXD
zxdXfhQ_48nI!?E>pL5{pF(vVYy-h3a_F~AfFtHz^LNNNnLdw7?6ACCxvMIYAOs=G4
zcoz)tAq*9FQ`p9*v8~l&)wr-wIX(rqMB!ne{91_fdxUynI>^C%1KS2?;qv<NY?1i`
z^OyWWFyO@slO{5rGXB6=z!RotygpwF@^LRr0^n>s-~-o*?U{50{CI}UOnSi^N?s=}
zDS@5{V1MG{Xs@3RasikqK-(ntK;Sw$IiGio<3WeMFx}JJPbYi`J(@5&NfH8hhcKSg
zS78PwEqRpYz^8`kDp$h0;t8V<P4j-x0-naeBlu+SZbTvD;8f^ImjKO@<=Z6Va0zyx
z9E1yRIOqwlWhn`C6$m*DPF`^HKrb)~f+A)MUJRor4Ksigckyr@uwEjyAh_LtzggB@
zJqbiYJqb&7!LYt3qNuBL$D=6;ZYnq{;lFnlPP1r;G~!dAB5|9z=~E|e6E`dxf<P!8
zE%83(=sl{(rV<qaK~x1@p-EB0b3SsTVtRY~Z4{3&37C*d@ofEMV2Z1MBLLL;aa4Q*
zL?+bx16Kpr>g#YItQR;p&xHj0RoApHR6qG9j+rEe?qg6?!Z^GR(AHx7RyfU~T|?%=
z(fOkbFVDZc+;S%;YN*^$Rqnwn^n@fZ7a$4M-VmHY5(z1>5b+ts(Kv5?SX%oIIZp^u
zLs*{V=u1dNZb7INF-kTSMw@&m-^uw+P{Aq=#~UYL%woi-$`PyRGsuw1>o6r}DD?ov
z_Xm}%GF^7YsAV`aa!_532n92qOK}F9A?r1$VKp*M9_U?+SassrhMxx=wUAZGM_-z}
zkJUVz1DV1S)a^v*xzuS=sME4qnHouA-64cn?X$;w%6o-OM_-zZRMt2DSFEltTjn--
zWwdf{nI6wLk(RD6Hwh)*F^T*(0o^M>4^xbhLTNRrmq#$80sXY14oxe%su6ng@18}k
zj6W_N&=jkG7JQGQ8|IM?9R%z_{h*@~NOn-&CD2dD7)TBc7F>+#K=1K)c7z7sW!3Q~
z5ESmsg5^#tN(dG&vSmho-wz@AV%zz1^cc9-E8r_bGaTn9QElAILmCyD34n{YLsIC+
zsT;Vu?_A-+tu*hN0WaX2=Ila<hk)>1@O<aJe(#ja2e}9xoaTd&5Y$4yD>(7Q(Nh4=
z*9x9KFg-B|k%W(r!ucR61wV_^2b`}90PgbOXyt?aKu-ptt0elMlh=<)vEgv@1_Uqg
z*bu=25X>R(4RKS#2^u1T+vRidIQ~Ee508YxI{jDb>Cm|S*n5<y<@}I|0oh-fhk?5x
ze^p)e%eEmu-1mr-K4KXj5^C&2LUmPL4YUi@ha!2yRhQcAue<CK`{f#2D|uIKJ0wz<
zMC!6g)r#mp{ud6LK~x2ToL^L7E<^>-iE5JGij-4SPw;{1pr{stkN}Apt{?z<;1TEx
zih3ZI4+%IA#PoT{oy|Zzw5SR}SQn`&QB86PQ3(M~RDvc%6&8o6!n})$D_2D|5tv9_
z6|jS<lv8I&s<4w24JkPYUjr=-@E2Oa$<CrLjL2xdp<14a84hn7YBvqFQA6Eq=dM=2
zpuMi$upC<P{H*=wo$qx<wT-iFpBan~P1!qn)}@KXiDlQ1-dHJH@!U|(I(E#tONK?m
za_6?WbWXKvvMgM?er+SacFhwtHP5L&Gnke-c8sRKJiX96-@Dv-`|QoLD{ubI`Ixc#
zp)qGS)3k8m`h|_W`g=Li%opbrpP4MsypwBPy0CZwhPkv-cDHJ^YOV1nHQQy)n`O<>
zvLkZ?I|lQ%p=i@kwA`_6pg%FtD+70jSBLL)Y*!rnq~h34O~XCQy{5Gj+chUQYfi2^
zV>NA2Ywu=F+luR>!Cw!4bn%vMnYyjHsrg$SG;UgZ=Q`d#y_0$1#@O4JcB}>X>9^M6
z8_Ks&KYjsO${rm=M$_!s|M}d2^7|;k2r~RlzO~Di@tc+$IJ;A0HjYF%R_(39X%?}l
zFA>q8A%3ul$bsX{IEgcLs2t%KC>^XK>4W7sAo~#yfoBx}uSvqoo~aMV;eChfITILw
zN{AwgI;tGJNIBy1xHh$@ghW}?!zZpEtP?(hu(=6fd0?{qK@6hg%i+RT;1l>gB;byf
zm2qoRW9TpsAqt(xFCB22MLXKe1>L;vM)_M=vu!&X?f1hwCd-^|*Ic;Vc+0bGF8{<_
zKG(RRI{kk3z1Mz~_d)S5ia$8`%Y$o;Yvs^*pMevP*FoIyPaN3V@z{HMGeR!&EU*zU
zv*u=sL006`1`$(7f-MBI8Bh;@AemSUCDfHJ*(!Zb@JlD&Axs`Q7zIl)$`)({aL6i=
zuY@8<!Gg-9a?>R&=|T^yl(8@>5(0qxV$=;v7)pfuBur4ns>Z=iLCKK*uu4cl;#@<3
z?}R|2N*92b40#Mzacl;bYD!ZuXr9-nRbhlBAy&~!8BvoeIo?zHCBkn|&8mkEND@Qn
zI7}B0gt`RfdR9#^8&WiwfR^d~+L#K4!cvNd+<yWoB~k!Z#TaGk<OwkW8cd9sDZed&
zM2o3E4y48L{OdkESu&)IN1B@5UxI`sxtmyZZHCMnSVTe#5YWLx<1h_(taO*c;Wufc
zX2!xCc)E>t{XMbJKh>&Uc&b%Bsp&jf8h@0g6VOl9w3=za8uFB54L+geY+2f}b|xUH
zOlUdhX_^6@H>T)(exJ^B_hXIg{KpBM=RFN`_s_poJzGJ~`OnbvXWyuv^Zz70C!n99
z=Yo_OJ-SaTg|b$H@Zprucj~Mzk|AJLXP8kJd~*ji&+)@WG7rh?b9$r+zRBpoYGfK@
zE@evNHgqmwL&dBnz2E2_mTagSd=d5@^(d(Qmi)#G%t84xS*BmUf;`VY-I^}8oS<Y*
zB~Mxcbf=9#3188yV71SYb(%s*G6LdHp>B{TmeCOSCh3q9p`h-Y%>rQNeJu<4Mn_CL
z*K1|A;rfk^o;IR<YonJibW++(DN`md8l_SY)U%K(cKs)@Qphi)12Us>=8z2E2l>wa
zBVjRy6l*No4~2_lsiQp`HWiXplIYb=qSqlAZ~EdGQ^6XBk}y>=bn+_C&!CYt$}`Rb
z*%CxOV;}zh+jk_Fu+CFVWiS<cDv|MCu#k3`HOM{;r1=U+(+G<(_50AmV~PY)@*f#4
zZHD_C3T0m-Um=qPsp0wE{d?)kYJsK&ph=O;i3h)*x->S7QlDf@>AX`=#WVpn4`9no
zpTV-3a{pk~5dP*N2b(q2B;U)Dk~I;}B0;ij*1onEq3!=mj#)BY@)aaC9+%XjEUCUD
zGL^}zZ0o=`SUCP}3M$Cg(-Fvts#2ma<WYk*oWI36DoDgFo6Iwe36@H{?@@V#Z`21V
znChe#kU5vHL*EV!Y5kx~L+XV3mgq?v6`oBGn^;6mr8j7Dnq`ai93#F8yDf4sHA!xq
z<^=YXSueMhprK^1+H_yi$^OYc!>~w^($CJCp2&>A3h_|_+bPPCt@(+?7)%3RDBe2<
zr<2qyaw^g-$1tf2FNv>q{7uPFEEWH@OpL?8!i!BAQP6Zm(MtE&6g*BZNcjWSN8s}w
ziOQMDu&5n(d41Eke2f<=Dl2EDB{}67EEHO%aEb0DE^zsTQ+3cZ2rvT9g8v(@n3xw#
z*G+faYlnX7{blw>{*f*1i)0PtD>d165YZ({?GaTq>;{PFpitR)-hpqkpr)0w>?f*8
z-94fs7rc-f$vFWlu(%8+*WPifm;q}(upuC#k*;*agqv~Q3s(vQ<Fu$tl*%GaQepXt
z@)@iflV?&4O)YRsWqDDB%i)oMIQj~K9)q$SDUrv^)X<w$sd1H&VEW_h<sgw3`x&Qm
zz~L0B>WC34RZ>kAOGKY6Bt}Y~96tF5GfRq$5v^SOj+8$MEVoPL=Xg;yVrXczGY+St
zjp;ZY$$D~IiKt6duf+_hOdTmtG!X&Bi`NMekV<W&LTZk;R=`@kRCe_QpumfDLh6#h
zXA^9>=s4p%)7#^W=q@$bk6$MCpoy32B8uv2DEx^!Sd^dU1=#Ds8^OqUoICUQ6Q9q4
zQ>3Vhbp1}tckP#8F?`52bh)<ta?KFlXd-Imx_D#`7w+XExoixW9BDg;R7oIZPf{Ky
z<>Cn#6BplIuuEl%)Q4SAKTQ_Qll9kDT>nmN28hcAmu*2cu#JXP!V_#YR7aY~NUd~*
zCs8f05^VGsEX7|T)rQm!7ZNNFtA!|1`}K~AEjICe3%G<11VgdHrm!g@S{Rp<jw5Pv
zAx({TG8uXBhsdV*%8;^QL^Pyq7O^QrP2A34K_73^0H1-^Mn$b${kADZO}vs1m4QSl
zKa!ca_rPWh+Y2yBVV?l!5mghuz!<LrB=L#?u8!~;f^^I!aCmx>1%KX-+f35FoDpY#
zTmOL5;UsIcViuV&iAK>Pn{l!!L#ltn5-=Cy@nQ^b#rWVc$YXECL+D35E<W=3V;P(t
z>>YsW1TQLG9uHrKU*MX9s3zqaQR#zXi8=^1q>#<RL)L?M91=toAs9PPX@$8J-@T0A
zWJvora4nmZl|(h!c_C_qz%=Yb5_p`n^N_EkEK7?TQd{CYJkD|iNLNs@G9ul*B6(vK
zcEmh<Q=@(i`4Lcn9k9tVd-_Wir9S$F7Ug$Q^M*O~ZcgE?mfOew`uH8@?%?X+-J#W?
z_YbWb?hkz26|Hbai~6^72Ie|({bOc+X4_P<X)0M!MNJiJMKM#$Lv#La4t~z5m~-ry
za;|^(p*j0T=SE?5%v=L6p=lvJA6~XbO{FXSF_R5mFLvI~{ixvA1s@;XYIA-vaB-vX
z^_cn6PHy4S#l?%u*P^*qb6q>8+*>0tQ!N4ihsqBt|E1(Xy9{Z{zA^K|Ki{<$FAuDA
zZ(AEau{J!+u`a7N4l=PE=T3IP#tSF5vQK>I__$)@wZZMq3$e}%1mF>(O4_KMjx%2>
zsgkqQ9}tz>O?^>{a#`xJ63gR@YGkp#8(Ip#6TWlcu65OVw|KSqXP$fA_p|T&qoo5;
zE4yVLgldqvXt^^Abs;rWY_7lb&}h1$+Q_Sn84u$kk0o!ZV6kBNSk!W8E@Q`FxpfdK
zQ2?{3`qlV9j(<4(;8g!c-ayRA!n=)JTg+g4zhYgz{%6}w=RRpV7e{t{z3V|<d(7BD
zfU36))$bo!&%LkTZtjjXcgKNFtdBp)>)bLr9$S&+0`*04dh*ZTZ{9e4AzFGdYJGjn
zeCbc6KUPp3GeA`<&Opq;J~%bFk#`|xya>eIxU^-UcXJDukE~Qhb8F_hKFcnM8^Oyl
z^DCbg(l;`8tp!Uni!)2#Tm0UgvAYwi6L)>9zV}<!^P-inY+Ku6*0#6;9Uo^rIM}n5
z)4QieMWv4mkY$K^REEH8U)?q5rO`~!{qAUKU)1{AmYI2iubTP~YVOsnH*GhzZ#K5y
zKNf8~w^4n5PV=r}NwcWgHq)DCdL<`nu8e9AKUO1)lY%LcX@1Kw>)17AFNCj$ZymU8
zy=lE&e6#qDXRUiZdwo1w;E0;Kb}hL}1@9ExYPx;&=F!_HZ=U>_YHe!WxzWx<i=0tQ
zKNy#Jfcjk;s4MHu_p_o!y-`cwmuiLiHR_8DbO4NHA2RQH&id78QP&2;#w>$hYLw;+
z)a<K!T4c$`g-DoRD@S9dnr&0Vrl}!nYJx`Clk(#Hi#NI-7)tJx-K|`$d|;?r>x>y1
zU<6C{lJ*_#MgdeV-*5k*^A}*a$LHEUD=oXxxO8;!=yKz`t!oOH;Q&|kP7%zV_5LkO
z`&`?O(Xw!6{>-~$xH7t(SGk#2x$@@Snbn!KH-8d|<~3~@oA;FHKnL~M1eEO^kjR6X
z@#>Gyua!P1u8o@Q+vesCbMw6ebLvmCUz+Q{HC5fBZn^wNS#xc>rh?_tTh47$Y0Ol5
z*R|@3zr9s<`|!=f+lAGeh1F|~(L(!{xo%H`a!z42<v%i_(yF_etC>GFZEB0>RP+A1
z5VpeCw+tmKom+>Fkf{MP-TFH9Ux>=QL_xRG1}F;ajBj@?oVgxnXvw$eyVJ5(bkDQi
z70v628lfEQ*wtsg?OE_%_uf+AD(Y?HP2-*ZwG->g_2Fp#xoFn;sJ;i(tLvqHmlpD+
z_419Ed!zY%(X7{^dIprN1G~yVhOD`Xw`xI?I_o1PQXBtZL|XH%HghAZ{X^%+`Tu<R
zK^7C!I-z9_hM)H?Yol4EF>TpHlX+LA+t43dKl(u59#eHZG#E*~ENVwau!kQRIYkn4
zt(18{0M){dC%k9DBkEjZu;~+WTo2y?F@T3f1w^2wc!vWu--%CMa1!<MPG0}SDV*0s
zUEdwTY1J48IRz(Mj;I+Kfh}euBRnjMA}LDaU<qL}EJ*QM>ksf#cxx8ljbCUW6~_?}
z(>w0<anKdVa{fF%_25%4KH=46DXQc31`@V#58QKPL{ven4!ws6<5G0fo}3DJV0ZB;
zehT367mV;jI6YEQ6!lnDOsV!xBFgwF(vhG3w;J6KX8vMkTVvhSSeFy3U6BIb$m+<w
z3(<;G_f_{j(fsbH=G?66-wq7SnncU1vsq%!u?=MTJcFVRf37X0OrN)^U~~KDSsseY
keAJ^vD&t%vrYzV|X?}3}`={so-(t5^IS@@$g@oS!1D<cCTmS$7

literal 0
HcmV?d00001

diff --git a/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md b/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md
index 011eb1d..061215d 100644
--- a/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md
+++ b/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md
@@ -4,6 +4,7 @@ opened: 2026-08-23
 located-in: [hal]
 fixed-by:
   - "the instance only: PR #962 — incus hook. Merged, ran on one node in 6s of a 60s budget; pipeline #6832 green in 48s. The class remains open."
+  - "partly, on the mesh: mesh-host 73c010e, 9d8239a — preflight and the profile detectors ask the daemon, not the package (installed-but-broken reports absent). The class question the report asks of hal is not answered"
 amended-design:
 ---
 
diff --git a/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md b/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md
index 9f20414..ff339b4 100644
--- a/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md
+++ b/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-control, mesh-host]
-fixed-by: partly — mesh-control ee3cc1b
+fixed-by: mesh-controller ee3cc1b (pinned() refuses a placeholder at compose), 43c9c97 (the builder publishes digests); proven by one-node-mesh.test.ts (the catalogue holds no placeholder digest). Six placeholders remain in three manifests deferred under issue 064
 amended-design:
 ---
 
diff --git a/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md b/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md
index 9e39f1a..6afc292 100644
--- a/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md
+++ b/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md
@@ -2,7 +2,7 @@
 status: located
 opened: 2026-09-01
 located-in: [mesh-control]
-fixed-by: partly — mesh-control 53eb000, withdrawn in 83c6a2f
+fixed-by: partly — mesh-controller f5b03e1 declares the data directories; the gate refusing a container mount the module never declared (53eb000) was withdrawn in 83c6a2f and nothing replaces it
 amended-design:
 ---
 
diff --git a/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md b/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md
index c88562d..d75ee4c 100644
--- a/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md
+++ b/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-host, mesh-control]
-fixed-by:
+fixed-by: mesh-host aa441ba, 652984b (container restart-on, PR #2, under issue 009); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---
 
diff --git a/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md b/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md
index b7089ab..26c50ce 100644
--- a/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md
+++ b/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-04
 located-in: []
-fixed-by:
+fixed-by: mesh-host aa441ba (restart-on); mesh-catalog 550393b (runtime config as a mergeable file + restart-on); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---
 
diff --git a/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md b/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md
index 8c8bd49..a7631ee 100644
--- a/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md
+++ b/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md
@@ -2,7 +2,7 @@
 status: open
 opened: 2026-09-02
 located-in: []
-fixed-by:
+fixed-by: partly — mesh-host 24e9ae4 (a run-once step writes a seed only if absent, ADR 0052); mesh-catalog ec1e718 (mosquitto). A file resource itself has no create-once semantic, and no bed asserts a seed's grown content survives a re-apply
 amended-design:
 ---
 
diff --git a/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md b/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md
index 071d7df..230c47c 100644
--- a/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md
+++ b/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-02
 located-in: [mesh-control, mesh-catalog, mesh-host]
-fixed-by: 02-DECISIONS/0051-shared-data-is-the-operators.md
+fixed-by: ADR 0051 access: mesh-controller aeb65a3, mesh-host f06eea5, mesh-catalog 69c8a5e; proven by mesh-lab assigned-catalogue-media.test.ts (sonarr and radarr share one operator-owned directory)
 amended-design: 02-DECISIONS/0051-shared-data-is-the-operators.md
 ---
 
diff --git a/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md b/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md
index ad36933..a66a0c8 100644
--- a/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md
+++ b/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-05
 located-in: [mesh-control, mesh-host, mesh-catalog]
-fixed-by: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
+fixed-by: ADR 0052 run-once container: mesh-host 19e5dd8, PR #5 24e9ae4; ADR 0053 scheduled twin 9d1f001; proven by mesh-lab assigned-catalogue-mqtt.test.ts
 amended-design: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
 ---
 
diff --git a/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md b/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md
index ee7c02f..c4a2061 100644
--- a/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md
+++ b/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-10
 located-in: []
-fixed-by:
+fixed-by: mesh-host cmd/mesh-bootstrap (ADR 0067); mesh-lab genesis.ts is the one description of genesis both beds call. Still open: a running mesh cannot say it was raised by the installer
 amended-design:
 ---
 
diff --git a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
index 2e6088a..d7e79d2 100644
--- a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
+++ b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
@@ -56,3 +56,12 @@ either way.
 - What is the actual reach of the exposure on a node — which identities can talk to the container
   runtime, and is that set smaller than "anything running as the operator"? The answer decides
   whether this is a hardening item or something sharper.
+
+## Reconciled 2026-09-21
+
+Still open, and worse than reported: the controller's own manifest now delivers its store
+connections **and** its broker credentials through an env-file, so both halves reach the process
+environment; 28 catalogue manifests use env-file for a secret, and nothing in the catalogue
+engine refuses a `${secret:…}` placeholder in one. The vault work of
+[ADR 0085](../../02-DECISIONS/0085-a-secret-is-a-provision.md) rests on the seal this weakens.
+
diff --git a/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md b/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md
index dbf387e..4824f1e 100644
--- a/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md
+++ b/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-13
 located-in: []
-fixed-by:
+fixed-by: mesh-host e7f94e0 (restart-on digests folded into the container spec, a standing comparison); unit-tested in apply_test.go, no lab assertion yet
 amended-design:
 ---
 
diff --git a/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md b/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md
index f3f27e0..674fe3c 100644
--- a/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md
+++ b/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller c8d8211 (forward chain drops by default, never closes ssh), 25e42b3; proven by one-node-mesh.test.ts (a machine filters exactly what its modules declared)
 amended-design:
 ---
 
diff --git a/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md b/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md
index c22f42e..e9e800e 100644
--- a/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md
+++ b/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller 3ae7b88, 2b82872; mesh-catalog d2dce34; proven by one-node-mesh.test.ts (the catalogue holds every module the control plane built)
 amended-design:
 ---
 
diff --git a/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md b/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md
index 8ad3468..2d8ff95 100644
--- a/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md
+++ b/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller dda001d (the firewall opens the port the mesh itself runs on), 25e42b3; TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt
 amended-design:
 ---
 
diff --git a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md
index 42e6a0c..8434d35 100644
--- a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md
+++ b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-15
 located-in: []
-fixed-by:
+fixed-by: mesh-tools b618057 (the SDK resolved by version from the registry, one pin); mesh-host 7986306; mesh-controller 4b9bc50. Caveat: the base image still builds with npm install and no lock, so the build is not reproducible
 amended-design:
 ---