diff --git a/PROGRESS.md b/PROGRESS.md
index e37ee74..0b28736 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -184,15 +184,15 @@ The overnight session (`SESSION-05-07-2026.md`, 25 tasks) closed the previous
 1. **Purge + rotate the leaked db key** — a live AES key was committed at
    `deploy/db_key.env` before it was gitignored. It must be scrubbed from git
    history and rotated. Operator action, highest urgency.
-2. **Step-up gate on `/api/revert`** — it mutates the store (voids facts) but
-   has no passkey gate, unlike POST `/tools`. Inconsistent with the auth model.
-3. **Cold-start unlock** — the at-rest key still comes from env/config; the
+2. **Cold-start unlock** — the at-rest key still comes from env/config; the
    passkey→key L3 dance is a documented seam, not a feature. Until then the key
    sits in the container env.
-4. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail.
+3. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail.
 
-Housekeeping: `go.mod` isn't tidied — `onnxruntime_go`, `coder/websocket`, and
-`robfig/cron` are used directly but marked `// indirect`.
+Closed (jul6 follow-ups): `/api/revert` now sits behind the same passkey
+step-up as POST `/tools`; `go.mod` direct deps (`onnxruntime_go`,
+`coder/websocket`, `robfig/cron`) are labeled correctly — `go mod tidy` can't
+run here because it walks the vendored `deps/go` toolchain tree.
 
 Done earlier (2026-07-03): **act tool executor, store-backed, full flow**
 (`internal/tool` + `internal/store/tools.go` + `tools` CoreAPI methods).