diff --git a/.planning/WINDOWS.md b/.planning/WINDOWS.md
index a9fdba22..132ccb9d 100644
--- a/.planning/WINDOWS.md
+++ b/.planning/WINDOWS.md
@@ -1,10 +1,10 @@
 ---
 schema_version: 1
-open_count: 13
+open_count: 12
 waived_count: 0
-fixed_count: 1
+fixed_count: 2
 total_count: 14
-last_updated: 2026-08-02T22:44:15.215Z
+last_updated: 2026-08-02T23:00:30.894Z
 ---
 
 # Broken Windows Ledger
@@ -27,7 +27,7 @@ last_updated: 2026-08-02T22:44:15.215Z
 | 10 | 02 | deviation | neode-ui/src/views/server/OpenWrtGateway.vue |  | OpenWrtGateway revisit-ms regression (663.5->1148->1460ms across 3 runs); confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session) | open |  | 2026-07-31T10:56:26.933Z |  |
 | 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md |  | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open |  | 2026-08-02T19:07:39.861Z |  |
 | 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh |  | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open |  | 2026-08-02T19:07:40.217Z |  |
-| 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs |  | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | open |  | 2026-08-02T19:07:40.522Z |  |
+| 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs |  | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | fixed |  | 2026-08-02T19:07:40.522Z | 2026-08-02T23:00:30.894Z |
 | 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs |  | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open |  | 2026-08-02T22:44:15.215Z |  |
 
 ````json
@@ -183,10 +183,10 @@ last_updated: 2026-08-02T22:44:15.215Z
     "file": "core/archipelago/src/api/rpc/system/handlers.rs",
     "line": null,
     "description": "system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call.",
-    "status": "open",
+    "status": "fixed",
     "reason": "",
     "recorded_at": "2026-08-02T19:07:40.522Z",
-    "resolved_at": null
+    "resolved_at": "2026-08-02T23:00:30.894Z"
   },
   {
     "id": 14,