diff --git a/SECURITY_FIXES_FABLE5.1_IGNORED.md b/SECURITY_FIXES_FABLE5.1_IGNORED.md
index 5e68cd2..5f44887 100644
--- a/SECURITY_FIXES_FABLE5.1_IGNORED.md
+++ b/SECURITY_FIXES_FABLE5.1_IGNORED.md
@@ -12,7 +12,10 @@ Findings that only make sense against an internet-facing, multi-tenant threat
 model are noted as such.
 
 Fixed findings are documented in the individual commits on this branch and are
-not repeated here.
+not repeated here. After a cross-review of the three parallel fix branches,
+NET-05, Codex [7] and Codex [12] were ported from the second branch and moved
+from "not fixed" to "fixed" (see the commits touching `justfile`,
+`state_paths.rs` and the bounded wire collections in `lanspread-proto`).
 
 ## Gemini audit
 
@@ -30,15 +33,6 @@ not repeated here.
 - The "information harvesting" sub-point (display names, game lists, Call to
   Play chat visible to any LAN client) is the product.
 
-### NET-05 — Collection allocation before semantic validation
-
-Response frames are capped at 8 MiB and are only read from identity-pinned peers
-this node chose to pull from. Deserialising a few tens of megabytes of transient
-structures before the bounds check rejects the payload is not a meaningful
-resource attack for a desktop app, and the alternative (custom streaming
-deserialisers for every collection) would complicate the strict wire codec for
-no practical benefit.
-
 ### NET-06 — Unauthenticated chunk and Stream Install egress (informational)
 
 By design; see NET-01.
@@ -145,12 +139,6 @@ simultaneous calls degrades the ticker for everyone but this is a prank that the
 room can see and stop. Semantic caps on open calls per author would be a product
 decision (how many calls may one person host?) rather than a security fix.
 
-### [7] `justfile` recipe arguments are interpolated as shell code
-
-The recipes are developer and catalog-operator tooling; the arguments are typed
-by the operator on their own machine. Quoting every interpolation risks breaking
-the build recipes for a threat that requires the operator to attack themselves.
-
 ### [8] Sybil peers can exhaust aggregate state and unbounded UI publication
 
 Worst case is 64 authenticated identities each holding a 4 MiB author slice,
@@ -168,13 +156,6 @@ See SEC-IPC-01.
 The monitored directory is the one the user selected on their own machine.
 Budgeting traversal of the user's own files against the user is out of scope.
 
-### [12] Public state helpers permit marker writes outside the state directory
-
-`setup_done_path` and friends join a raw game ID, but every shipping caller
-validates the ID as a single path component first (the Tauri commands) or takes
-it from the catalog. Making the public helpers fallible would change the crate
-API for an embedding caller that does not exist.
-
 ### [13] Catalog preflight can read outside the package root
 
 Publisher tooling run by the catalog operator over their own package tree; the
@@ -183,8 +164,8 @@ own error message.
 
 ## Summary
 
-| Status          | Findings                                                                                                                          |
-| --------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| Fixed           | NET-02, NET-03, NET-04, EXP2-SEC-03, EXP2-SEC-04, EXP2-SEC-06, SEC-IPC-02, SEC-IPC-03, SEC-DB-01, Codex [2], [6], [9], [14], [15] |
-| Partially fixed | NET-01, EXP2-SEC-01, SEC-IPC-01, SEC-IPC-04, Codex [3], [10]                                                                      |
-| Not fixed       | NET-05, NET-06, EXP2-SEC-02, EXP2-SEC-05, EXP2-SEC-07, SEC-IPC-05, SEC-FE-01, Codex [1], [4], [5], [7], [8], [11], [12], [13]     |
+| Status          | Findings                                                                                                                                             |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Fixed           | NET-02, NET-03, NET-04, NET-05, EXP2-SEC-03, EXP2-SEC-04, EXP2-SEC-06, SEC-IPC-02, SEC-IPC-03, SEC-DB-01, Codex [2], [6], [7], [9], [12], [14], [15] |
+| Partially fixed | NET-01, EXP2-SEC-01, SEC-IPC-01, SEC-IPC-04, Codex [3], [10]                                                                                         |
+| Not fixed       | NET-06, EXP2-SEC-02, EXP2-SEC-05, EXP2-SEC-07, SEC-IPC-05, SEC-FE-01, Codex [1], [4], [5], [8], [11], [13]                                           |