diff --git a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
index 58fa584..526bec7 100644
--- a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
+++ b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
@@ -73,3 +73,18 @@ refuses the undeclared shape. The controller, the instance this was opened on, r
 its credentials from files. The 35 other containers carry a declared reason; converting each where
 its software accepts a path remains per-module work and is not this issue's.
 
+## The declared exceptions, surveyed 2026-09-21
+
+Of the 35 containers marked when the rule landed, a survey of each image's own configuration
+loader (read at the pinned digest where it was cached) found: 24 variables convertible now, 8 not
+convertible (baserow, mssql, only-office, umami, mailu's initial admin), 9 read by the code of
+Novox's own applications outside the mesh repositories (amqp-email-forwarder, de-spiegel,
+invoicing, photos), 4 unverifiable (keycloak's admin, letta, mailu's other containers), and 2
+dead deliveries that nothing read. Converted and proven in a bed: amqp-ping, minio, mongodb,
+mesh-catalog and model-usage; the two dead deliveries removed. The 25 that remain carry the
+surveyed reason on the container. Gitea, nextcloud, mailu-admin, influxdb, step-ca and n8n are
+convertible and wait for a bed that exercises their credential
+([issue 073](../073-beds-carry-copies-of-catalogue-manifests/00-report.md)); icecast, keycloak's
+database, searxng and nextcloud's object store convert through a generated configuration file
+rather than a variable.
+