diff --git a/docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md.tasks.json b/docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md.tasks.json
index dc1114c1..05bf00cd 100644
--- a/docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md.tasks.json
+++ b/docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md.tasks.json
@@ -89,16 +89,18 @@
     {
       "id": 7,
       "subject": "Task 7: #485 empty/corrupt/mismatch coverage on the FetchAndCache paths",
-      "status": "pending",
+      "status": "completed",
       "classification": "high-risk",
       "blockedBy": [
         6
-      ]
+      ],
+      "commit": "fc568ae0",
+      "note": "Regression net, no new mechanism \u2014 all green (no gaps to guard). Pins the NEGATIVE on failure paths: (1) null fetch mid-steady-state -> no RebuildAddressSpace for the failed rev, revision + served state kept (publishProbe.ExpectNoMsg is the discriminator); (2) zero-length blob handed to the actor fails via ReconcileDriversFromBlob's own #485 guard (independent of the fetcher null contract); (3) corrupt cache at boot = GetCurrentUnkeyedAsync null -> Steady-no-revision, no rebuild at boot (no partial apply). Removing the #485 empty guard reddens the zero-length test. Corrupt-cache uses a stub-returns-null (the real ReassembleAsync-null-on-corrupt is LocalDbDeploymentArtifactCacheTests' job)."
     },
     {
       "id": 8,
       "subject": "Task 8: real two-Host gRPC artifact-fetch boundary test + wrong-key falsifiability control",
-      "status": "pending",
+      "status": "completed",
       "classification": "high-risk",
       "blockedBy": [
         3,
@@ -106,7 +108,9 @@
       ],
       "parallelizableWith": [
         9
-      ]
+      ],
+      "commit": "ffbcaa93",
+      "note": "Minimal real Host (WebApplication + h2c-only Kestrel + real ConfigServeAuthInterceptor + real DeploymentArtifactGrpcService + in-memory EF sealed deployment) driven by the REAL GrpcDeploymentArtifactFetcher. 4 green: right-key >256KB reassembles byte-equal + verifies; wrong-key null WHILE right-key succeeds on the SAME server (falsifiability control); unknown-id null; [dead-port,real-port] failover. h2c GrpcChannel.ForAddress(http://) works out of the box in .NET 10 \u2014 no AppContext switch needed. async can't have out params -> StartServerAsync returns a tuple. Tagged [Trait Category=ArtifactBoundary]."
     },
     {
       "id": 9,
@@ -131,5 +135,5 @@
       ]
     }
   ],
-  "lastUpdated": "2026-07-23T01:30:00Z"
+  "lastUpdated": "2026-07-23T02:15:00Z"
 }
\ No newline at end of file