diff --git a/PROGRESS.md b/PROGRESS.md
index db02670..fc33655 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -53,8 +53,8 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 ### M4 secrets (parallel track)
 - [x] S1 core (`secret://` parser, Provider iface, Registry, batched Resolve) — **DONE** (PR #14, `bdba2ab`)
 - [x] S2 SOPS+age — **DONE** (PR #31, shells `sops -d`, batch-per-file, RegisterBuiltins)
-- [ ] S3 AWS SM+SSM — TODO  *(ready: S1 in; localstack-testable)*
-- [ ] S4 Infisical (gated) — TODO  *(ready: S1 in)*
+- [x] S3 AWS SM+SSM — **DONE** (PR #64: `aws-sm`/`aws-ssm` via the `aws` CLI — anti-bloat, inherits user AWS auth; SM per-secret batch + JSON `#key`, SSM batched `get-parameters`; fake-runner tested. Real creds/localstack = flagged human/integration step.)
+- [ ] S4 Infisical — **FLAGGED (needs owner)**: pattern is clear (mirror S3 — shell to the `infisical` CLI behind a `CmdRunner`, batch via `infisical export`, inherit `infisical login`/`INFISICAL_TOKEN`), but the exact CLI command/output contract drifts across Infisical versions and can't be verified without a real account. Encoding an unverified contract would violate "flag, don't guess" — needs the owner to confirm the CLI version + export format (or provide a test account/localstack-equivalent).
 - [x] S5 keyring + `secrets login/keygen` — **DONE** (`secrets keygen` PR #39; `secrets login/logout/status` PR #59: zalando/go-keyring `OSKeyring`+`MemKeyring`, `CredentialFor` env→keyring→native, WSL2 no-D-Bus degrade to env-var mode).
 - [x] S6 post-render resolve + env injection + leak test — **DONE** (generate valueless keys PR #41 + saga secrets phase PR #44: collect→Resolve→Compose.Env, value never on disk)
 
@@ -111,3 +111,13 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **X4 merged** (PR #53) — the selective-up profile resolver (internal/profile.Resolve; Q-PROFILE RESOLVED = both planes unioned, `all` default). **52 PRs merged.** X5 (saga --profile slicing + DAG-pruned health) now ready. Remaining: X5, X7 (teardown), provision phase (flagged D8 host-port), S3/S4 (deps+services), S5-login (keyring), X9 (devdock format), G2 (macOS CI), G5 (race e2e).
 - (night 3) **X5 + X7-destroy + memory-budget merged** (PRs #55–57) — selective-up is now end-to-end: `up --profile` slices the saga (inactive projects drop out, compose-up restricted to active services, shared phase + health gate pruned to `active.Shared`), plus the spec-12 `memoryBudgetMB` over-budget warning. `workspace destroy` lands the data-preserving teardown (stacks down, ref/port rows dropped under lock, orphaned shared warm-stopped via GC, `.devstack/` removed; volumes/DBs + machine-global state preserved). **57 PRs merged.** Remaining: X7 remainder (`--purge-data` needs `docker volume rm`; `uninstall` = machine-global incl. CA removal), S5-login (keyring + WSL2 fallback), S3/S4 (aws-sdk/infisical + localstack), provision saga phase (flagged D8 host-port), X9 (devdock format — flagged), G2 (macOS CI), G5 (race e2e), G3 docs remainder (migration/threat-model).
 - (night 3 cont.) **S5-login + X7 COMPLETE merged** (PRs #59, #61) — keyring-backed `secrets login/logout/status` (zalando/go-keyring + WSL2 env-var degrade; `CredentialFor` env→keyring→native) finishes M4's S5; and `uninstall` (machine-global teardown: compose down -v all stacks → external network rm → CA removal across host/Firefox/Windows → /etc/hosts → alias symlinks → XDG ledger/cache/config, best-effort + confirm-gated) finishes X7 alongside `workspace destroy`. **61 PRs merged.** Remaining: S3 (AWS SM+SSM — heavy aws-sdk + localstack), S4 (Infisical — gated), provision saga phase (D8 pgx host-port — decision known, wiring deferred; unblocks X3 firstRun), X3 remainder (firstRun/postPull + hook flags), X9 (devdock import — format unknown, flagged), G2 (macOS CI — unverifiable locally), G3 docs remainder (migration + threat-model), G4 (tap + `.deb`/`.rpm` + tag v1.0), G5 (two-terminal race e2e).
+- (night 3 cont.) **S3 + flaky-open fix merged** (PRs #64, #65) — AWS Secrets Manager + SSM provider via the `aws` CLI (anti-bloat: no aws-sdk; inherits the user's AWS auth; SM per-secret batch + JSON `#key`, SSM batched `get-parameters`, fake-runner tested). Also fixed a recurring CI flake: `state.Open` ran `Ping` (which triggers the `journal_mode=WAL` header write, not covered by `busy_timeout`) **before** the flock — concurrent first-opens hit `SQLITE_BUSY`; moved `Ping` inside `lock.WithLock` so the WAL switch is serialized across processes (spec 08). **65 PRs merged.**
+
+  **Frontier is now flagged / gated / owner-dependent — autonomous progress paused for decisions:**
+  - **provision saga phase** (M2 capstone; unblocks X3 firstRun) — design call (CLAUDE.md): pgx provisions from the host, so shared-Postgres needs a published host port (default is none). Recommended resolution (mirrors the secrets §7.5 pattern, preserves byte-identical determinism): emit `ports: ["${DEVSTACK_SHARED_POSTGRES_PORT}:5432"]` (stable literal) in the shared compose, allocate the port from the ledger (`Manager.FreeHostPort`), inject it via `Compose.Env` at up, and have the provision phase pgx-connect to `127.0.0.1:<port>`. Touches the determinism-golden generate path → wants a focused (non-deep-context) session + golden update.
+  - **S4 Infisical** — flagged: `infisical` CLI contract needs owner verification (see S4 line).
+  - **X9 `import`** — flagged: the legacy `devdock` schema is unknown; need a sample `project.yaml` to map fields.
+  - **X3 remainder** — firstRun hooks need the provision `scope_key` (blocked on the provision phase); `--skip-hooks/--force-hooks` flags + postPull-in-`ws sync` are small, doable next.
+  - **G2 macOS arm64 CI** — owner: needs a macOS runner (cross-compile already covers the target build).
+  - **G4 cut `v1.0`** — owner release decision (goreleaser/`.deb`/`.rpm`/LICENSE already in place).
+  - **G5 two-terminal race e2e** — daemon-dependent + flaky-prone; the lock spine already has a unit concurrency test (`internal/lock`).