Reconcile the open issues against main

An audit of the six code repositories found eleven open issues fixed on main
with commits and beds to show (025, 027, 033, 036, 037, 040, 045, 047, 050,
052, 053), three partly (007, 026, 035), nine not (020, 031, 041, 046, 049,
054, 064, 065, 066) and one whose fix would live outside those repos (006).
Resolved ones name their evidence; partly ones say what remains; 041 records
that the exposure has widened since it was reported.

04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md

@@ -4,6 +4,7 @@ opened: 2026-08-23
 located-in: [hal]
 fixed-by:
   - "the instance only: PR #962 — incus hook. Merged, ran on one node in 6s of a 60s budget; pipeline #6832 green in 48s. The class remains open."
+  - "partly, on the mesh: mesh-host 73c010e, 9d8239a — preflight and the profile detectors ask the daemon, not the package (installed-but-broken reports absent). The class question the report asks of hal is not answered"
 amended-design:
 ---
 

04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-control, mesh-host]
-fixed-by: partly — mesh-control ee3cc1b
+fixed-by: mesh-controller ee3cc1b (pinned() refuses a placeholder at compose), 43c9c97 (the builder publishes digests); proven by one-node-mesh.test.ts (the catalogue holds no placeholder digest). Six placeholders remain in three manifests deferred under issue 064
 amended-design:
 ---
 

04-ISSUES/026-the-data-directories-are-not-declared/00-report.md

@@ -2,7 +2,7 @@
 status: located
 opened: 2026-09-01
 located-in: [mesh-control]
-fixed-by: partly — mesh-control 53eb000, withdrawn in 83c6a2f
+fixed-by: partly — mesh-controller f5b03e1 declares the data directories; the gate refusing a container mount the module never declared (53eb000) was withdrawn in 83c6a2f and nothing replaces it
 amended-design:
 ---
 

04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-host, mesh-control]
-fixed-by:
+fixed-by: mesh-host aa441ba, 652984b (container restart-on, PR #2, under issue 009); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---
 

04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-04
 located-in: []
-fixed-by:
+fixed-by: mesh-host aa441ba (restart-on); mesh-catalog 550393b (runtime config as a mergeable file + restart-on); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---
 

04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md

@@ -2,7 +2,7 @@
 status: open
 opened: 2026-09-02
 located-in: []
-fixed-by:
+fixed-by: partly — mesh-host 24e9ae4 (a run-once step writes a seed only if absent, ADR 0052); mesh-catalog ec1e718 (mosquitto). A file resource itself has no create-once semantic, and no bed asserts a seed's grown content survives a re-apply
 amended-design:
 ---
 

04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-02
 located-in: [mesh-control, mesh-catalog, mesh-host]
-fixed-by: 02-DECISIONS/0051-shared-data-is-the-operators.md
+fixed-by: ADR 0051 access: mesh-controller aeb65a3, mesh-host f06eea5, mesh-catalog 69c8a5e; proven by mesh-lab assigned-catalogue-media.test.ts (sonarr and radarr share one operator-owned directory)
 amended-design: 02-DECISIONS/0051-shared-data-is-the-operators.md
 ---
 

04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-05
 located-in: [mesh-control, mesh-host, mesh-catalog]
-fixed-by: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
+fixed-by: ADR 0052 run-once container: mesh-host 19e5dd8, PR #5 24e9ae4; ADR 0053 scheduled twin 9d1f001; proven by mesh-lab assigned-catalogue-mqtt.test.ts
 amended-design: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
 ---
 

04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-10
 located-in: []
-fixed-by:
+fixed-by: mesh-host cmd/mesh-bootstrap (ADR 0067); mesh-lab genesis.ts is the one description of genesis both beds call. Still open: a running mesh cannot say it was raised by the installer
 amended-design:
 ---
 

04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md

@@ -56,3 +56,12 @@ either way.
 - What is the actual reach of the exposure on a node — which identities can talk to the container
   runtime, and is that set smaller than "anything running as the operator"? The answer decides
   whether this is a hardening item or something sharper.
+
+## Reconciled 2026-09-21
+
+Still open, and worse than reported: the controller's own manifest now delivers its store
+connections **and** its broker credentials through an env-file, so both halves reach the process
+environment; 28 catalogue manifests use env-file for a secret, and nothing in the catalogue
+engine refuses a `${secret:…}` placeholder in one. The vault work of
+[ADR 0085](../../02-DECISIONS/0085-a-secret-is-a-provision.md) rests on the seal this weakens.
+

04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-13
 located-in: []
-fixed-by:
+fixed-by: mesh-host e7f94e0 (restart-on digests folded into the container spec, a standing comparison); unit-tested in apply_test.go, no lab assertion yet
 amended-design:
 ---
 

04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller c8d8211 (forward chain drops by default, never closes ssh), 25e42b3; proven by one-node-mesh.test.ts (a machine filters exactly what its modules declared)
 amended-design:
 ---
 

04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller 3ae7b88, 2b82872; mesh-catalog d2dce34; proven by one-node-mesh.test.ts (the catalogue holds every module the control plane built)
 amended-design:
 ---
 

04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller dda001d (the firewall opens the port the mesh itself runs on), 25e42b3; TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt
 amended-design:
 ---
 

04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-15
 located-in: []
-fixed-by:
+fixed-by: mesh-tools b618057 (the SDK resolved by version from the registry, one pin); mesh-host 7986306; mesh-controller 4b9bc50. Caveat: the base image still builds with npm install and no lock, so the build is not reproducible
 amended-design:
 ---