diff --git a/docs/program/BloomOS_Work_Program_v3.json b/docs/program/BloomOS_Work_Program_v3.json
index b90c3d217..2eca2863c 100644
--- a/docs/program/BloomOS_Work_Program_v3.json
+++ b/docs/program/BloomOS_Work_Program_v3.json
@@ -1091,12 +1091,13 @@
         592,
         594,
         596,
-        598
+        598,
+        600
       ],
       "risk_tier": 2,
       "deployment_tier": "warm",
       "device_gate_required": true,
-      "last_audited_main": "be65bd2890fb93856a15be7d5ad5728663ff3f94",
+      "last_audited_main": "4ebbc5d38b55dce523e54cc4ccb840187bb861f7",
       "evidence": [
         "PR #592 begins NET-07 by making bloom-time the single owner of a bounded NTP opportunity after canonical association; it removes the inherited IP polling, ping retries, insecure time API requests, and duplicate retry loop while preserving an idempotent completion marker and fail-closed live/stale single-flight ownership",
         "exact commit 4335e64de932f87d6235fcd09049abc5cbd29514 passed 749 hosted Shell tests in 2 minutes 13 seconds, 14 focused time-service tests, the 332-component legacy manifest, seven-component provenance policy, six-root transfer policy, and the exact 314688679-byte dependency inventory",
@@ -1110,7 +1111,10 @@
         "a pinned-key Mini Plus /tmp-only gate published and acknowledged associated generation 1 for metadata, update, and sync while preserving Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, association, IP, route, session, transaction, known-good update, listener audit, and signed Shell overlay; all temporary files were removed, no radio restart or update occurred, and remote evidence does not certify physical behavior or other devices; PR #596 squash-merged to main as 94c7d25d1f4d683356e22991b47454d97b5cd472 while normal-runtime client consumption remains follow-up NET-07 scope",
         "PR #598 connects the metadata event client to the persistent library scheduler: association requeues only network-required waiting work, offline transitions park only network-required queued or retry-wait work, exact generations are acknowledged only after validated observation, and consumer failure remains secondary to station ownership; update and sync consumers remain follow-up NET-07 scope",
         "exact head 4c264c153bfe8c58f1b22ff726c41cc65c2ea614 passed all six required checks, including the corrected hosted Shell gate in 2 minutes 22 seconds, Static analysis in 3 minutes 56 seconds, and Check build in 3 minutes 54 seconds; signed workflow 33337476823 passed in 7 minutes 45 seconds and produced the 199849446-byte archive SHA-256 4625898fbfbc72ae71fe73af6daedc2f6b461487194a351f3c49d1562c15d8fe with verified Ed25519 signature and exact reviewed script identities",
-        "a strict pinned-key Mini Plus /tmp-only gate observed and acknowledged synthetic associated generation 1, proved that an injected offline observation failure retained generation 2, and acknowledged it on retry while preserving Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, association, IP, route, session, transaction, known-good update, and listener audit; no live catalog, radio, profile, key, listener, route, process, reboot, or update mutation occurred, all temporary files were removed, and this remote fixture evidence does not certify physical behavior or other devices; PR #598 squash-merged as be65bd2890fb93856a15be7d5ad5728663ff3f94"
+        "a strict pinned-key Mini Plus /tmp-only gate observed and acknowledged synthetic associated generation 1, proved that an injected offline observation failure retained generation 2, and acknowledged it on retry while preserving Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, association, IP, route, session, transaction, known-good update, and listener audit; no live catalog, radio, profile, key, listener, route, process, reboot, or update mutation occurred, all temporary files were removed, and this remote fixture evidence does not certify physical behavior or other devices; PR #598 squash-merged as be65bd2890fb93856a15be7d5ad5728663ff3f94",
+        "PR #600 adds the fixed update event consumer, gives associated events the explicit provider_unconfigured disposition because BloomOS has no configured public release provider, gives offline events the explicit offline disposition, and removes the inherited automatic TLS-bypassing Onion OTA check from normal network reconciliation; it performs no network I/O, download, staging, activation, or installed-state mutation, while sync consumption remains follow-up NET-07 scope",
+        "exact head fdda8cd11394d4b4f5169b2b95c7afd34e5ce7fe passed 59 focused tests and the required hosted Shell gate in 2 minutes 10 seconds; signed workflow 33338726619 passed in 7 minutes 50 seconds and produced the 199839374-byte archive SHA-256 5f5453233e6a790d3142af7c0b4f3889cf46a1640bc1d2b3984375ddbd639962 with verified Ed25519 signature, complete payload reconstruction, and packaged bloom-network, bloom-network-update, and bloom-wifi byte-identical to the reviewed tree",
+        "a strict pinned-key Mini Plus /tmp-only gate proved an injected acknowledgement failure retained synthetic associated generation 1 before provider_unconfigured acknowledgement, then acknowledged synthetic offline generation 2 with the offline disposition; no OTA process existed, existing zero-byte legacy update markers and Shell PID 1125, wpa_supplicant PID 994, udhcpc PID 1280, association, IP, route, session, transaction, known-good update, and listener audit were byte-for-byte or state-equivalent before and after, all temporary files were removed, and this remote evidence does not certify physical behavior or other devices; PR #600 squash-merged as 4ebbc5d38b55dce523e54cc4ccb840187bb861f7"
       ]
     },
     {