diff --git a/projects/hermes-persistent-os/tasks.md b/projects/hermes-persistent-os/tasks.md
index 93bc4a8..111922b 100644
--- a/projects/hermes-persistent-os/tasks.md
+++ b/projects/hermes-persistent-os/tasks.md
@@ -2,10 +2,11 @@
 
 ## Now (2026-09-26)
 
-- [x] Session-end persist Leonard, Hermes web app (`127.0.0.1:8787`), and cloudflared via `\VeriPath\*` Task Scheduler tasks
-- [x] Confirm web app still answers after the old remote-session process was killed
-- [x] Gatekeeper ran `upgrade-to-s4u.ps1`. All three tasks Running / S4U at 09:38 PT
-- [ ] CoS proves the three tasks start with nobody logged in
-- [ ] Do not open the web app on `100.64.0.1` until that proof exists
+- [x] Session-end persist Leonard, web app, cloudflared
+- [x] S4U / session 0 proof without reboot (At startup, parent = Task Scheduler)
+- [x] Gatekeeper ran `upgrade-to-s4u.ps1`
+- [ ] CoS: launcher dies if wrapper dies, so a task stop or crash actually restarts the program
+- [ ] Do not open the web app on `100.64.0.1` until that fix is in
+- [ ] Later: drop Leonard off admin / Highest if it can be done without another Gatekeeper prompt
 
 See `memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md`.