diff --git a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
index 526bec7..a845e43 100644
--- a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
+++ b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md
@@ -81,7 +81,10 @@ convertible (baserow, mssql, only-office, umami, mailu's initial admin), 9 read
 Novox's own applications outside the mesh repositories (amqp-email-forwarder, de-spiegel,
 invoicing, photos), 4 unverifiable (keycloak's admin, letta, mailu's other containers), and 2
 dead deliveries that nothing read. Converted and proven in a bed: amqp-ping, minio, mongodb,
-mesh-catalog and model-usage; the two dead deliveries removed. The 25 that remain carry the
+mesh-catalog and model-usage; the two dead deliveries removed. One image, mongodb's, drops to its
+own user before it reads the file, so its manifest names that user as the owner of its secrets — the
+first use of the owner field outside the controller, and the check any converted image needs: run it
+with a file its user cannot read. The 25 that remain carry the
 surveyed reason on the container. Gitea, nextcloud, mailu-admin, influxdb, step-ca and n8n are
 convertible and wait for a bed that exercises their credential
 ([issue 073](../073-beds-carry-copies-of-catalogue-manifests/00-report.md)); icecast, keycloak's