diff --git a/FABRIC-3.10.8.md b/FABRIC-3.10.8.md
index d190ad5e..b5a1dbab 100644
--- a/FABRIC-3.10.8.md
+++ b/FABRIC-3.10.8.md
@@ -406,3 +406,28 @@ The table shows the final (rajames) reading. At Hera's prompt, before MINT, the
 - The G string is byte-identical to MC-0c and earlier on all three ISAs, so the O(ncells) audit scan now running under a slot lock didn't move it.
 - The `dict_hash` set is unchanged, and the ledger line reads `stadium_conserved(self)=true`.
 - No stop condition was hit. **MC-0d done, and with it MC-0: one core, fully locked, ready for MC-1.**
+
+## 4. Closing the known issues (plan, 2026-09-26)
+
+Captain Bob, 2026-09-26: *"CONTINUE BY CLOSING KNOWN ISSUES"* -- ahead of MC-1. The list is
+FABRIC-3.10.0 §8's ten known defects plus what MC-0 found. Stages are grouped by subsystem;
+each gets its own commit and three-architecture acceptance (§ header rules), with evidence
+named here before it runs. No DoE.
+
+**Rulings taken for this plan (2026-09-26):**
+- **Released quota cells go to the best donor** (`stadium_best_donor()`: the live slot with
+  the most free cells).
+- **The hosted `make` stops copying its binary into `lfs/`** (it rewrote the tracked
+  `lfs/amd64/starforth` on every compile-sanity build).
+
+| Stage | Closes | Change | Evidence (named in advance) |
+|---|---|---|---|
+| **K-1** | §8 defects 5, 6, 7, 8, 9; plus the kernel `sf_realloc()` | The kernel `sf_realloc()` becomes a real realloc: copy `min(old, new)` bytes (old size from a new `kmalloc_usable_size()`), free the old block, and free-and-return-NULL on size 0. It used to allocate fresh, copy nothing and free nothing. That makes the dictionary index's bucket growth stop leaking (defect 9), and fixes `vm_state_push()`, whose call-state stack lost every saved state past depth 8. The shim's `realloc()` copies `min(old, new)`; it used to over-read the old block when growing. The heat-percentile snapshot is heap-sized to the dictionary (defect 5). A word whose transition metrics can't be allocated is refused whole (defect 6). Both `vm_cleanup()`s free the metrics' inner arrays (defect 7). The most-likely-next cache updates incrementally (defect 8; compiled out of the kernel today). | Standard sequence unchanged. A probe shows: `sf_realloc()` growth preserves contents and returns the old block (heap used bytes back to baseline); a call-state stack pushed to depth 20 pops back intact; kernel heap used bytes after a 20-VM birth/KILL churn return to within one allocation of the pre-churn figure. |
+| **K-2** | §8 defects 1, 2 | `COLD` returns the dictionary to its post-boot fence through FORGET's own path (`latest`, `HERE`, word ids and Stadium cells together); it used to rewind `HERE` only, leaving live words to be compiled over. `PAD` moves below the block I/O window (`BLK_VM_WINDOW_BASE - 512`), outside both the dictionary and the window. | Standard sequence unchanged. A probe on a worker: define three words, `COLD`, and each is gone (not findable), `HERE` equals the fence, a new definition works; `PAD` plus 511 lies below `BLK_VM_WINDOW_BASE` and above the dictionary limit. |
+| **K-3** | §8 defect 4 | The two self-tests that wait for the removed Hermes VM (drain; channel-open policy) are retargeted to live Tripod VMs with the same properties. | Both self-tests print PASS on all three ISAs; no `SKIPPED` line for either. |
+| **K-4** | MC-0d findings 2, 3 | Quota slots are released: on KILL and reap, and at the end of each boot self-test that granted one. Resident patrons are evicted, the cells join the best donor's free list, and the slot is cleared for reuse. The admission fallback no longer evicts message (DELIVER) cells; a message leaves Stadium only through its release. | Standard sequence unchanged; conservation holds on every live VM. A probe: quota slots in use equal live VMs after boot and after a 20-VM churn; a forced admission fallback with a pending message leaves the message cell resident. |
+| **K-5** | §8 defect 10 | The xHCI Input Context is allocated full size (33 contexts) once per slot at Address Device and never swapped, mirroring the Output Device Context fix. Configure Endpoint used to allocate a fresh one on every attach and never free the old. | Standard sequence unchanged (WIREBIND attaches twice). A probe: kernel heap used bytes identical after the second attach as after the first. |
+| **K-6** | §8 defect 3 | riscv64 `vblk_io` timeouts: investigate first. A probe measures completion latency (poll iterations) and whether a timed-out request's completion later arrives. If it does, a timeout leaves a late completion that the next request would take as its own, while the device may still be reading reused descriptors. The fix is chosen from what the probe shows. | Named after the investigation, before the fix: completion-latency distribution per ISA, late completions observed, and after the fix 0 misattributed completions. |
+| **K-7** | the `lfs/` rewrite | The hosted `Makefile` no longer copies the binary into `lfs/`. | After `make`, `git status` shows no change under `lfs/`. |
+
+MC-1 follows once these are closed.