diff --git a/README.md b/README.md
index 6cced079..ca943c2b 100644
--- a/README.md
+++ b/README.md
@@ -41,5 +41,6 @@ automerge document synced between devices over subduction and the iroh
 relay; pairing by code + SAS into a device group that is the sync policy;
 app content sealed as keyhive/BeeKEM envelopes; Google Drive as a dumb
 ciphertext store (OAuth split between kernel and shell; a fake Drive in
-e2e). Next: passkey unseal and recovery (M5). The settings UI is deliberately minimal
-pending a redesign.
+e2e); app history rolled up as sedimentree fragments. Passkey unseal
+(#166) and recovery kits (#167) are parked as issues. The settings UI is
+deliberately minimal pending a redesign.
diff --git a/docs/design.md b/docs/design.md
index b22650f1..c3e139a3 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -484,8 +484,9 @@ native tests, so browser gates are mandatory for every visor change.
   destination egress, the picker) waits for a second provider: one
   backend does not justify a boundary. S3 is deferred; Drive is what a
   person has.
-- **M5** passkey PRF rung, recovery kits, Drive provider.
-- Parked: app worker (above); native shell; JS producers.
+- Parked, as issues: the passkey PRF unseal rung (#166), recovery kits
+  (#167); app worker (above); native shell; JS producers; S3 and the
+  provider component boundary (a second provider).
 
 ## polyengine is consumed from JSR