diff --git a/SECURITY.md b/SECURITY.md
index 93b9e1e..24d46b1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -113,7 +113,7 @@ These entries are implementation evidence, not a production risk-acceptance deci
 | RISK-013 | PROMO-001 [#102](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/102) sets both current Checkout creators to promotion entry off and automatic tax off. Exact payload and signed event tests require an explicit all-zero breakdown; malformed or nonzero discount, tax, or shipping data creates durable review evidence while definitive failed/expired Sessions still cancel. | Privately inventory pre-change Sessions/provider promotion settings, keep the guard through protected staging/deploy, verify provider and live state separately, and implement an approved authoritative discount/tax/shipping contract before ever enabling it. |
 | Part of RISK-014 | SUPPLY-001A [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127) removes the unused direct `gpxparser` dependency and 50 lockfile entries without changing any retained package version, source URL, or integrity hash. A fresh Node 20 install lowers the root production audit from 33 findings (3 critical, 9 high) to 22 (1 critical, 8 high), and the optimized production asset hashes remain identical. | #192 completes the separately tested router patch. Remediate or time-bound the remaining root and Functions findings through the Firebase, Stripe, build-system, and scanning slices; do not use a forced audit upgrade. |
 | Part of RISK-014 | SUPPLY-001B [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192) pins `react-router-dom` and `react-router` 6.30.4 with `@remix-run/router` 1.23.3. The only lockfile identity changes are those three nodes. A fresh Node 20 production audit removes all three router findings and lowers the root total from 22 to 19 and high findings from 8 to 5. The declarative router opts into `v7_startTransition` and `v7_relativeSplatPath`; focused tests cover warning removal, double-slash normalization, wildcard navigation, login/account harnesses, and the standalone callback boundary. | The remaining 19 root and 9 Functions production findings are not accepted as safe or fixed. Patch Firebase in separate compatibility slices, replace the unmaintained build chain, and add continuous scanning. Source/tests/merge do not prove website publication or live route behavior. |
-| Part of RISK-014 | SUPPLY-001C [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202) pins the Firebase browser SDK to 11.10.0 and its Rules helper to 4.0.1. A fresh Node 20 production audit falls from 19 findings (1 critical, 5 high) to 6 (0 critical, 3 high); the root production `protobufjs` path resolves to 7.6.5 and Firebase's root `undici` path is removed. The upgraded Rules helper first failed closed because Jest lacked `fetch`; a dedicated Node 20 environment exposes only the host's native web APIs, after which 348/348 Rules cases pass. Focused Firebase/Auth/App Check tests pass 71/71, the full frontend passes 198/198, and applicable Functions units pass 1,077/1,077. | The remaining 6 root and 9 Functions production findings are not accepted as safe. An older dev-only `protobufjs` remains nested under `firebase-tools`; the build chain still accounts for the root findings. Reproducible clean builds change the main optimized bundle from `main.fdd058b4.js` to `main.56edbdb7.js`, +8.29 kB gzip (about 3.3%); overall build output grows 180 KiB (about 1.0%). Complete SUPPLY-001D/F/G through separate reviewable changes. This source/test result does not publish the website, deploy Firebase, change a provider, or prove live behavior. |
+| Part of RISK-014 | SUPPLY-001C [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202) pins the Firebase browser SDK to 11.10.0 and its Rules helper to 4.0.1. A fresh Node 20 production audit falls from 19 findings (1 critical, 5 high) to 6 (0 critical, 3 high); the root production `protobufjs` path resolves to 7.6.5 and Firebase's root `undici` path is removed. The upgraded Rules helper first failed closed because Jest lacked `fetch`; a dedicated Node 20 environment exposes only the host's native web APIs, after which 348/348 Rules cases pass. Focused Firebase/Auth/App Check tests pass 71/71, the full frontend passes 198/198, and applicable Functions units pass 1,077/1,077. | The remaining 6 root and 8 Functions production findings are not accepted as safe. An older dev-only `protobufjs` remains nested under `firebase-tools`; the build chain still accounts for the root findings. Reproducible clean builds change the main optimized bundle from `main.fdd058b4.js` to `main.56edbdb7.js`, +8.29 kB gzip (about 3.3%); overall build output grows 180 KiB (about 1.0%). Complete SUPPLY-001D/F/G through separate reviewable changes. This source/test result does not publish the website, deploy Firebase, change a provider, or prove live behavior. |
 | Part of RISK-014 | SUPPLY-001D1 [#212](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/212) uses an exact Functions-only override to resolve the sole installed `form-data` node from 2.5.5 to the patched 2.5.6 release without changing the direct Firebase Admin, Firebase Functions, or Stripe versions. The exact lock change updates that node's registry URL, integrity, and `hasown` constraint. A clean Node 20 production audit falls from 9 findings (1 high) to 8 moderate findings (0 high or critical). A focused test requires one exact installed/locked resolution and uses only synthetic multipart names to prove carriage return, line feed, and quote characters cannot create an extra header. | The remaining 8 moderate Functions findings are not accepted as safe. They stay in the Firebase Admin dependency chain and require separate compatibility work rather than a forced audit upgrade. No application source directly imports `form-data`; this source/test result changes no endpoint or business logic, does not deploy Firebase or the website, and does not change provider or production data. |
 | Part of RISK-024 | SEC-001 protects token documents from every browser client. | OAUTH-001 must still add transactional refresh/versioning, scope/account binding, disconnect/revocation, IAM/encryption decision, and redacted lifecycle audit. |
 | Part of RISK-027 | #99 blocks App Check, Firebase Analytics, and Sentry in local/test and on initial capability-callback startup. OBS-001A1 [#134](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/134) source disables Sentry replay, tracing, browser session tracking, client reports, member user context, breadcrumbs, attachments, transactions, and unapproved default integrations. OBS-001A2 [#139](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/139) source removes every application runtime Firebase Analytics import, initialization, and emission, preserves existing wrapper calls as provider-free no-ops, and removes the direct Waiver SDK bypass. OBS-001A3 [#142](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/142) source routes the remaining render, Auth-email, members-only, and App Check browser diagnostics through five fixed outcome identifiers and prohibits direct console calls elsewhere in application/public runtime source. Synthetic tests use mocks/canaries and make no provider call. | #110/#111 still own any future approved telemetry purpose, consent, event/parameter schema, provider settings, and residual hosted boundary. Source/tests and merge evidence do not prove website publication, the exact `runmprc.com` revision, provider transport/collection, IP/cookie behavior, console history, historical data deletion, retention, access, consent, deletion, or vendor terms. Sentry provider behavior is likewise unverified. Callback protected handoffs remain with ABUSE-001A, DATA-001A, and OAUTH-001C in #88. |