diff --git a/STATUS.md b/STATUS.md
index 4295b98..f298fac 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -58,19 +58,19 @@ GitUrlList pruned 56 → 46 accordingly.
 | Ticket | App | Category | Flavor |
 |--------|-----|----------|--------|
 | #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) |
-| #634 | Tirreno | Security | build (already live on Cloudron — verify packaging need) |
-| #635 | Runme | Automation | pending service-story ruling (Go CLI runner, NOT node) |
-| #636 | DataHub | Data-Management | build (heavy; disposition risk) |
-| #637 | Docassemble | Legal | build |
-| #638 | Pimcore | Business-Apps | build |
+| #634 | Tirreno | Security | GO (verify-only; already deployed; local auth) |
+| #635 | Runme | Automation | disposition: OUT OF SCOPE (CLI/editor tool, no service) |
+| #636 | DataHub | Data-Management | BLOCKED (ES + Kafka, ~8 services) |
+| #637 | Docassemble | Legal | GO-with-risk (monolith container; OIDC via social config) |
+| #638 | Pimcore | Business-Apps | GO-with-risk (composer build; OIDC bundle; PHP 8.4 pin) |
 | #639 | Database-Gateway | Infrastructure | DONE (12th package) |
 | #640 | FX | DevOps-Tools | DONE (13th package) |
-| #642 | Rundeck | Automation | build |
-| #643 | HyperSwitch | Financial-Payments | build |
-| #644 | PayrollEngine | Business-Apps | blocked-on-auth (WebApp local-only + MSSQL) |
-| #645 | OpenBoxes | Business-Apps | needs LDAP runtime verification |
+| #642 | Rundeck | Automation | GO (official image; OSS LDAP, no OIDC) |
+| #643 | HyperSwitch | Financial-Payments | GO-with-risk (no-node hit on dashboard; local auth) |
+| #644 | PayrollEngine | Business-Apps | BLOCKED (local-only WebApp + MSSQL) |
+| #645 | OpenBoxes | Business-Apps | GO w/ explicit local-auth acceptance (LDAP = dead config) |
 | #646 | Nautilus Trader | Financial-Trading | disposition: OUT OF SCOPE (framework) — ruling pending |
-| #647 | Fleet | Monitoring | GO-with-risk: SAML-only SSO, mysql+redis addons |
+| #647 | Fleet | Monitoring | GO-with-risk (SAML first-class; build parked pending ruling) |
 | #648 | NetBox | Infrastructure | DONE (16th package) |
 | #649 | SeaTunnel | Data-Management | disposition: OUT OF SCOPE (job engine) — ruling pending |
 | #650 | Rathole | Infrastructure | DONE (11th package) |
@@ -78,20 +78,20 @@ GitUrlList pruned 56 → 46 accordingly.
 | #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) |
 | #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending |
 | #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending |
-| #656 | Gophish | Security | blocked-on-auth |
-| #657 | SniperPhish | Security | upstream gone (404) — ruling pending |
+| #656 | Gophish | Security | BLOCKED (local-only confirmed; phishing-console policy) |
+| #657 | SniperPhish | Security | upstream GONE (404 reconfirmed 09-06) |
 | #658 | InvenTree | Business-Apps | DONE 2026-09-06 (19th package, grind-verified) |
-| #659 | Mender | System-Administration | build |
+| #659 | Mender | System-Administration | BLOCKED (Mongo + NATS + S3, ~10 services) |
 | #661 | WireViz | Documentation-Tools | disposition: covered by wireviz-web package |
-| #662 | KillBill | Business-Apps | build |
+| #662 | KillBill | Business-Apps | GO (killbill+kaui in 1 container; mariadb addon) |
 | #666 | SigNoz | Monitoring | blocked: OSS local-only auth + mandatory ClickHouse |
 | #667 | Sentry | Monitoring | blocked: 56-service Kafka/CH mesh |
 | #668 | ChirpStack | Infrastructure | DONE (14th package) |
 | #669 | eLabFTW | Business-Apps | DONE (15th package) |
-| #671 | Resgrid Core | Project-Management | build |
+| #671 | Resgrid Core | Project-Management | GO-with-risk (bundle RabbitMQ; 5 processes) |
 | #672 | SDRangel | Infrastructure | disposition: OUT OF SCOPE (Qt desktop) — ruling pending |
-| #673 | No-Code Architects Toolkit | Low-Code | build (Python/FastAPI, not node) |
-| #675 | Security Awareness Training | Security | build |
+| #673 | NCA Toolkit | Low-Code | GO (Flask API-key only; proxy-eligible; stale upstream) |
+| #675 | Security Awareness Training | Security | OUT OF SCOPE (Marp slide deck, not an app) |
 
 ## Packaging Patterns Established
 
@@ -166,11 +166,21 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | NetBox | yes | yes | ✅ preferred | OIDC+LDAP native; Cloudron redis addon available (**corrected 2026-09-01** — earlier "no Redis" claim was wrong). Ticket #648 |
 | Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
 
-**Immediate queue:** work the build-ticket batch (#633-#678) via the grind
-pattern; auth research is embedded in each ticket (Sentry #667, SigNoz #666,
-Langfuse #660, Fleet #647, InvenTree #658, GoAlert #633 are the research
-queue).
-**Deferred:** Gophish #656 (blocked-on-auth).
+**State (2026-09-06, end of disposition pass): every remaining ticket
+carries a researched disposition note on Redmine — the full list now
+awaits human rulings before any further builds.**
+
+| Bucket | Tickets |
+|--------|---------|
+| Landed (Resolved) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 |
+| GO — awaiting go-order | #634 (verify-only) · #642 Rundeck · #662 KillBill · #673 NCA Toolkit (proxy) · #645 OpenBoxes (needs explicit local-auth acceptance) · #647 Fleet (SAML risk; research+digest banked) · #833 jamovi (new ticket; proxy; 3-origin risk) |
+| GO-with-risk — heavier | #637 Docassemble · #638 Pimcore · #643 HyperSwitch (no-node dashboard workaround) · #671 Resgrid (bundle RabbitMQ) |
+| BLOCKED | #636 DataHub · #644 PayrollEngine · #656 Gophish · #659 Mender · #666 SigNoz · #667 Sentry |
+| OUT OF SCOPE (ruling pending) | #635 Runme · #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT (slide deck) |
+| Upstream gone / covered | #657 SniperPhish (404) · #661 WireViz (covered by wireviz-web) |
+| Ruled already (removed/k8s) | #660 #641 #670 (no-node) · #663 #678 (k8s) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies |
+
+**Deferred:** Gophish #656 (blocked-on-auth, policy-sensitive).
 **Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
 revise Puter auth.
 
@@ -205,7 +215,7 @@ revise Puter auth.
 | Component | Details |
 |-----------|---------|
 | Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
-| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (57 repos) |
+| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (46 repos after the 09-06 rulings) |
 | Workspace | `Package-Workspace/<Category>/<app>/` (cloned upstream `repo/` dirs are gitignored) |
 | Templates | `Package-Templates/` (python-app, django-app, official-wrapper) |
 | Git remote | `ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git` (`origin/main`) |