diff --git a/10-functional/features/e-sync/e5-mobile-peer.md b/10-functional/features/e-sync/e5-mobile-peer.md
index 66ae686..da4d2ca 100644
--- a/10-functional/features/e-sync/e5-mobile-peer.md
+++ b/10-functional/features/e-sync/e5-mobile-peer.md
@@ -143,11 +143,21 @@ independently reported that store's `database.sqlite` at 2,637,824 bytes, which
 is what rules out the empty 4 KB stub under Application Support that the
 earlier check may have read.
 
-**Android device acceptance is not recorded.** All three gates were taken on one
-handset, an iPhone 12 mini. Nothing here records the same passes on Android, and
-the final plan still names device acceptance on both. The requirements ask for
-real hardware rather than for each platform, so they are met as written; whether
-v2.0 ships without an Android pass is a release call, and nobody has made it.
+**Android device acceptance is partly recorded, and not here.** All three gates
+above were taken on one handset, an iPhone 12 mini, and the final plan still
+names device acceptance on both. Two Android hardware runs have happened since
+and are recorded in the product repository rather than on this page: `E5-R10`'s
+asynchronous cold-start recovery signal was closed on a Galaxy A51 (Android 13)
+with a fingerprint enrolled on 2026-09-09, and `E2-R23` and `E5-R28` were walked
+on the same handset alongside an iPhone 12 mini on 2026-09-13, in that repo's
+walk ledger.
+
+Neither is the same thing as the three gates. What is still unrecorded on
+Android is the local-notification banner and the two-device pairing UAT; the
+backup exclusion is app-wide there and reaches every release build by
+construction rather than by a device run. The requirements ask for real hardware
+rather than for each platform, so they are met as written; whether v2.0 ships
+without an Android pass of those two is a release call, and nobody has made it.
 
 ## Edge cases
 
diff --git a/40-quality/security.md b/40-quality/security.md
index a96b59f..a5df933 100644
--- a/40-quality/security.md
+++ b/40-quality/security.md
@@ -121,7 +121,19 @@ Recorded rather than described as solved:
 | Item | Status |
 |------|--------|
 | A Linux desktop with no keyring | Custody is wired on every platform ([F3-R33](../10-functional/features/f-platform/f3-auth-and-app-lock.md#acceptance-criteria)). Where no keyring is reachable the shell falls back to a store whose key is public, so that machine is **reported as unprotected** rather than credited with custody, and biometric enrolment refuses there ([F3-R37](../10-functional/features/f-platform/f3-auth-and-app-lock.md#acceptance-criteria)). The reader has no passive surface telling them; they learn it by attempting an enrolment. |
-| Mobile backup exclusion | A bridge exists and the mobile build applies it. Android is covered app-wide and reaches every release build. On iOS no pipeline builds an artefact, and whether the exclusion covers the file the app actually opens is [an open question](../10-functional/features/e-sync/e5-mobile-peer.md#open-questions-and-known-gaps) ([E4-R25](../10-functional/features/e-sync/e4-at-rest-encryption.md#acceptance-criteria)). |
+
+**Mobile backup exclusion was in this table and is not outstanding.** It said
+that whether the iOS exclusion covers the file the app actually opens was an
+open question, and linked to the E5 section that had **settled it on
+2026-09-06** — by a re-check naming the path, reading the flag back per node
+rather than trusting the write, and reporting `flagged=7 unflagged=0` against
+`Documents/persisted_data` on an iPhone 12 mini
+([E4-R25](../10-functional/features/e-sync/e4-at-rest-encryption.md#acceptance-criteria),
+[E5](../10-functional/features/e-sync/e5-mobile-peer.md#open-questions-and-known-gaps)).
+The row pointed at its own answer for eight days. Removed here rather than
+quietly, because a security page that overstates a gap is read exactly as
+carefully as one that understates one, and this is the second record on this
+page to have lagged the feature page it cites.
 
 ## Related