diff --git a/PROGRESS.md b/PROGRESS.md
index f330c56..bf8f85b 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -9,7 +9,11 @@ and verification. **Merge model:** PR-per-chunk, auto-merge on green CI.
 `DONE` merged to main · `BLOCKED` waiting on a dep or a human step.
 
 ## Locked decisions
-1. PR-per-chunk, auto-merge on green CI; milestone tags on completion.
+1. PR-per-chunk, **merge only when ALL ≥9 CI checks are green** (main is unprotected,
+   so plain `gh pr merge --auto` merges instantly — poll the checks first). Milestones
+   are recorded in this night log, **NOT as git tags**: a non-semver tag (e.g. `m2-done`)
+   breaks the `release-dryrun` job for every PR (goreleaser `git describe`). Only push
+   `v*` tags, and only to cut a release.
 2. `workspace.yaml shared:` is truth; `~/.devstack/config.yaml` = defaults/overrides
    merged *under* the workspace (deterministically, golden-tested).
 3. Account/sudo-gated features: build logic + mock/localstack/temp-file tests; flag
@@ -47,15 +51,15 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
   `devstack_shared`). Unit wiring is mock-tested; e2e was verified manually.
 
 ### M4 secrets (parallel track)
-- [ ] S1 core (`secret://` parser, Provider iface, Registry, batched Resolve) — TODO
-- [ ] S2 SOPS+age — BLOCKED (S1)
+- [x] S1 core (`secret://` parser, Provider iface, Registry, batched Resolve) — **DONE** (PR #14, `bdba2ab`)
+- [ ] S2 SOPS+age — TODO  *(ready; prefer shelling to the `sops` binary — single static binary, no KMS-SDK bloat; integration test build-tagged)*
 - [ ] S3 AWS SM+SSM — BLOCKED (S1)
 - [ ] S4 Infisical (gated) — BLOCKED (S1)
 - [ ] S5 keyring + `secrets login/keygen` — BLOCKED (S1)
 - [ ] S6 post-render resolve + env injection + leak test — BLOCKED (S1,S2,C5)
 
 ### M5 networking (parallel track)
-- [ ] N1 `internal/proxy` (Caddy labels) — TODO
+- [x] N1 `internal/proxy` (Caddy route table + labels) — **DONE** (PR #15, `50e6686`)
 - [ ] N2 `internal/trust` (mkcert; sudo-gated) — TODO
 - [ ] N3 `internal/dns` (/etc/hosts; sudo-gated) — TODO
 - [ ] N4 `internal/tunnel` (cloudflared; account-gated) — TODO
@@ -87,4 +91,5 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (init) scaffolding: PROGRESS.md + Apache-2.0 LICENSE/NOTICE + nightly cron + repo auto-merge enabled.
 - (night 1) **C1 merged** (PR #1, `9900b87`) — `saga_phase` v2 migration + CRUD, race-clean, merge-on-green proven. Next ready (parallel): C2, C3a, S1, N1..N4, X1, X8, X9, G1.
 - (night 2) **C2, C3a, C3b, C3c, C4 merged** (PRs #2–6) — the entire health/hooks substrate: read-only docker inspect/logs, config health/hooks/dependsOn structs, the `internal/health` poller, generate's compose `healthcheck:`/`depends_on` lowering, and the `internal/hooks` runner + `hook_run` ledger. Each green via `make ci`+determinism+`-tags=integration` against the local Engine 29.5.3; PR-poll-then-merge enforces the green gate (main is unprotected, so plain `--auto` would merge instantly). **C5 (core saga) is now unblocked** — its deps C1,C2,C3b,C4 are all in. Also ready: C8, S1, N1..N4, X1, X8, X9, G1.
-- (night 2 cont.) **C5a, C5b, C6, C7, C8 merged** (PRs #8–12) — **M2-remainder complete**. The resumable/compensating orchestrate engine + the real up phases, the `up`/`down`/`status` CLI, and `shared gc`/`doctor --rebuild-state`. Verified the whole `up` saga end-to-end against the host daemon (shared-postgres came up *healthy* via the cross-project gate; re-run all-skips; `--json` matched; `down` dropped refs) then fully tore it down — the machine was clean before and after. Process note: poll ALL ≥9 PR checks to green before merge (an early poll once merged C6 before the slow checks registered — it passed retroactively, but the lesson stuck). **Next ready (all parallel now C5 is in): the provision saga phase (host-port coupling), S1 secrets core, N1–N4 networking, X1 config completion, X8 self-update notifier, X9 migrate/import, G1 integration lane.**
+- (night 2 cont.) **C5a, C5b, C6, C7, C8 merged** (PRs #8–12) — **M2-remainder complete**. The resumable/compensating orchestrate engine + the real up phases, the `up`/`down`/`status` CLI, and `shared gc`/`doctor --rebuild-state`. Verified the whole `up` saga end-to-end against the host daemon (shared-postgres came up *healthy* via the cross-project gate; re-run all-skips; `--json` matched; `down` dropped refs) then fully tore it down — the machine was clean before and after. Process note: poll ALL ≥9 PR checks to green before merge (an early poll once merged C6 before the slow checks registered — it passed retroactively, but the lesson stuck).
+- (night 2 cont.) **S1 + N1 merged** (PRs #14–15) — started the M4 + M5 parallel tracks: the `secret://` core (parser/Provider/registry/batched Resolve) and the Caddy proxy route table + labels. **Gotcha learned the hard way:** pushing a non-semver milestone tag (`m2-done`) broke `release-dryrun` on the next PR (goreleaser `git describe`); deleted the tag, re-ran, green. Decision #1 updated — milestones go in this log, never as tags. **Next ready (all parallel): the provision saga phase (host-port coupling), S2 (SOPS via shelling to `sops`), S3/S5, N2–N4 (sudo/account-gated → mock/temp-file tests), X1 config completion, X8 self-update notifier, X9 migrate/import, G1 integration lane (also unblocks the saga daemon e2e).** Consider G1 next — it activates the already-written `-tags=integration` tests (docker/health/hooks) in CI and provides the isolation harness the saga e2e needs.