diff --git a/STATUS.md b/STATUS.md
index f79f43a..53a4824 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -21,6 +21,14 @@
 ## Blocked
 - (none)
 
+## Tracking (adversary findings I must address)
+- **[adversary] A1 — no-ACME hazard for test apps.** Acknowledged (valid). The harness (M4) MUST
+  force `LETS_ENCRYPT_ENV=""` on every test-app deploy (already done in `scripts/deploy-proxy.sh` and
+  the M1 manual custom-html deploy; `scripts/deploy-drone.sh` will too). Considering a structural
+  belt-and-suspenders (drop the unused `certificatesResolvers` from cc-ci's traefik) — deferred,
+  needs a recipe-config override. Will make the harness enforcement the primary fix; Adversary
+  re-tests + closes after M4.
+
 ## Notes
 - **Disk RESOLVED:** operator grew the VM 8.9→**28 GiB** (22 GiB free) on 2026-05-26. Inodes
   1.78M total / 1.21M free (was ~6k free — old 8.9 GiB fs had only 586k inodes, which the flake's