diff --git a/FORK.md b/FORK.md
index e626bce84c..3e7d732862 100644
--- a/FORK.md
+++ b/FORK.md
@@ -40,7 +40,7 @@ Everything on `giantswarm` that is not in the pin (`git log v0.0.29..giantswarm`
 | Let an actor's egress through while it resumes (ateom arms tunneled egress before the first container starts, atenet admits `RESUMING` actors, both hops log a refusal) | an actor whose workload fetches what it needs to become ready — kagent's Go ADK and Claude harnesses materialise git skills before readyz — never got its golden snapshot: atunnel dropped the fetch (`Broken pipe`), atenet would have refused a non-`RUNNING` actor, nothing was logged ([#37742](https://github.com/giantswarm/giantswarm/issues/37742) rows 8 and 13; acceptance test `agentlab skills-test`, [agentlab#137](https://github.com/giantswarm/agentlab/issues/137)) | `fb1b0980` ([#4](https://github.com/giantswarm/substrate/pull/4), squash `181762747bb2` on the v0.0.26 base; first published as `0.0.27-dev.giantswarm.2026-09-10.22-37-39.h1817627`) | to file: the upstream-shaped patch is branch [`upstream/atenet-egress-during-resume`](https://github.com/giantswarm/substrate/tree/upstream/atenet-egress-during-resume) here (`3a95d7cf`, on the mirror `main`); a team member opens the kagent-dev/substrate pull request with DCO sign-off once #37742 has reviewed it. **Complete with the egress dataplane this pull request pins:** the chart's `images.agentgateway` is the check in the request path (the egress config carries the `substrateEgress` policy and no `ext_proc`, so atenet's handler is not consulted); kagent-dev's `c0f5597c7cb8` (a pre-merge build of agentgateway#3237) authorized every CONNECT against ate-api itself — UID, then `RUNNING` — and refused the golden boot (`atunnel failed to open egress tunnel … 403 Forbidden: actor is not running`, agentlab 2026-09-11); upstream agentgateway v1.5.0 has no such check at all (its `substrateEgress` derives the actor from the SPIFFE id and checks nothing else — `agentlab skills-test` green on both halves with it swapped into `atenet-egress`, 2026-09-11, the run that proved the Substrate half). The line runs the agentgateway line's release (`v1.5.1-gs.2` on the v0.0.26 pin, `v1.5.1-gs.4` since the v0.0.29 pin), which keeps #3237's UID and state check and admits `RESUMING` (giantswarm/agentgateway-upstream#4; upstream-facing branch [`upstream/substrate-egress-resuming`](https://github.com/giantswarm/agentgateway-upstream/tree/upstream/substrate-egress-resuming), #37742 row 8). Acceptance test of the combined fix: `agentlab skills-test` on the first build of this merge, recorded on agentlab#137 |
 | Read ate-api-server's PostgreSQL connection string from a Secret (`postgres.connectionStringSecretRef`; the `ate-api-server-envvars` ConfigMap then carries only the schema) | meta chart 4.0 puts Substrate's control-plane database on the platform's CNPG cluster and hands ate-api-server the DSN through a Secret, never a ConfigMap ([giantswarm/agent-platform#342](https://github.com/giantswarm/agent-platform/issues/342); [#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 24) | `bea1c85f` (`git cherry-pick -x 1872249e`) and `851e62ec` (`git cherry-pick -x 41097da7`, the `helm plugin install --verify=false` of the same pull request), [#8](https://github.com/giantswarm/substrate/pull/8) | [kagent-dev/substrate#32](https://github.com/kagent-dev/substrate/pull/32), open (2026-09-04), not ours — falls away at the re-pin onto the first release that carries it |
 | The atelet DaemonSet takes `nodeSelector`, `tolerations` and `affinity` (`atelet.{nodeSelector,tolerations,affinity}`, empty by default) | the platform pins atelet to worker nodes / node pools; the chart had no scheduling knob ([giantswarm/agent-platform#342](https://github.com/giantswarm/agent-platform/issues/342); [#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 23) | `30ed59e9`, [#8](https://github.com/giantswarm/substrate/pull/8) | to file: the upstream-shaped patch is branch [`upstream/atelet-scheduling`](https://github.com/giantswarm/substrate/tree/upstream/atelet-scheduling) here (`b34c1690`, on the mirror `main`); [kagent-dev/substrate#16](https://github.com/kagent-dev/substrate/pull/16) touches the same knob (`atelet.nodeSelector`, no tolerations or affinity) inside a fork-wide 92-file pull request that has conflicted since July — align with the maintainers there; a team member opens the kagent-dev/substrate pull request with DCO sign-off once #37742 has reviewed it |
-| atelet mounts `/var/lib/kubelet/plugins` with `mountPropagation: HostToContainer` | with the default (private) propagation atelet's mount namespace kept a copy of every CSI globalmount on the node; after a pod moved, the volume's filesystem (and LUKS mapper) stayed open there and Longhorn's `NodeUnstageVolume` failed forever with `luksClose: Device is still in use` — the SPIRE outage of 2026-09-11 on the homelab cluster ([giantswarm/giantswarm#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 30) | `2c78c0aa` | to prepare |
+| atelet mounts `/var/lib/kubelet/plugins` with `mountPropagation: HostToContainer` | with the default (private) propagation atelet's mount namespace kept a copy of every CSI globalmount on the node; after a pod moved, the volume's filesystem (and LUKS mapper) stayed open there and Longhorn's `NodeUnstageVolume` failed forever with `luksClose: Device is still in use` — the SPIRE outage of 2026-09-11 on the homelab cluster ([giantswarm/giantswarm#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 30) | `2c78c0aa` | [kagent-dev/substrate#39](https://github.com/kagent-dev/substrate/pull/39) — opened 2026-09-15 from `upstream/atelet-plugins-mount-propagation` (the chart hunk on upstream `main`; the chart test stays fork-only, upstream has no chart tests) |
 | Keep the `ate.dev` CRDs when the `substrate-crds` release is uninstalled (`helm.sh/resource-policy: keep` on the three CRD templates, set at the generator as a `+kubebuilder:metadata:annotations` marker on the root types, so `hack/verify/crd-chart.sh` keeps the templates a verbatim copy) | the chart ships its CRDs as templates, so an uninstall of that release deleted the CRDs and every `WorkerPool`, `SandboxConfig` and `CSIDriverConfig` with them; a GitOps controller that uninstalls the releases concurrently — a cluster's own Flux finalizing the meta chart's component `HelmRelease`s — can remove the CRDs first, and the `substrate` release's uninstall then fails for good on its `SandboxConfig` (`failed to delete release: substrate`, Helm cannot delete an object whose kind is gone; [giantswarm/agent-platform#385](https://github.com/giantswarm/agent-platform/issues/385)). The kagent line carries the same policy on `kagent-crds` (giantswarm/kagent-upstream#10) ([#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 28). A kept CRD means its objects survive a Substrate uninstall: the consumer deletes its `WorkerPool`s and `SandboxConfig`s, or the CRDs explicitly | `8dd8e936` (as it is on `giantswarm` after the v0.0.29 re-pin), [#12](https://github.com/giantswarm/substrate/pull/12) | to file: the upstream-shaped patch is branch [`upstream/substrate-crds-resource-policy-keep`](https://github.com/giantswarm/substrate/tree/upstream/substrate-crds-resource-policy-keep) here (`41bd9df0`, on the mirror `main`; the pull-request text is in #12); neither kagent-dev/substrate nor agent-substrate/substrate carries or proposes the policy (searched 2026-09-11); a team member opens the kagent-dev/substrate pull request with DCO sign-off once #37742 has reviewed it |
 | Fail an actor whose image the registry refuses instead of resuming it forever (the image cache tags a registry's final word — a 4xx other than 408 or 429: manifest or repository unknown, unauthorized, denied — with `ReasonFailedGetExternalObject`; the Run/Restore boundaries claim it; `maybeCrashActor` returns the crash with its cause and the directive; the ActorTemplate reconciler fails the template with that cause when the resume reports the crash) | a Harness whose `workload.image` could not be pulled never booted and was never reported: atelet's pull failed with the registry's answer, the Run RPC returned it untagged, ate-api retried the resume with backoff, `GoldenSnapshotStatus.ErrorMessage` stayed empty, kagent reported `Ready=False ActorTemplatePending` for as long as anyone waited and a worker stayed pinned to the golden actor ([#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 27; measured in giantswarm/agent's ATS on `v0.0.27-gs.2`: 300 s, no message). Now `Ready=False ActorTemplateFailed` with `GoldenActorCrashed: actor ate-golden/<uid> crashed: … MANIFEST_UNKNOWN: manifest unknown`, in seconds | `00a39294`, [#14](https://github.com/giantswarm/substrate/pull/14) | to file: the upstream-shaped patch is branch [`upstream/golden-boot-image-pull-terminal`](https://github.com/giantswarm/substrate/tree/upstream/golden-boot-image-pull-terminal) here (`4a56c0af`, the same commit on the mirror `main`; its message is the pull-request text). agent-substrate/substrate#1220 (open since 2026-08-26, review comments unaddressed, needs a rebase, does not apply to v0.0.26) proposes to crash actors on every failure not marked retriable and classifies registry answers with `transport.Error.Temporary()`; its reviewer asked for the status-based classification this patch does for the one class that is a registry's final word — the patch applies on its own and folds into #1220's shape if that lands. A team member opens the kagent-dev/substrate pull request with DCO sign-off once #37742 has reviewed it |
 | Keep `podcertificate-controller-system` across an uninstall (`helm.sh/resource-policy: keep` on the chart's `Namespace`; the kubectl-apply manifest and a chart unit test with it) | the namespace holds the two CA pools the podcertificate-controller signs from — provisioned into it out of band (upstream `kubectl-ate admin make-ca-pool`; the platform's connectivity bootstrap hook, which keeps them) — while the signers' `ClusterTrustBundle`s are cluster-scoped and outlive the release. An uninstall took the pools and left the bundles; the reinstall minted new roots, the controller republished the bundles within seconds, but every pod had already read the surviving bundle when it started (`ateapiauth` loads the ate-api CA file once, at dial time) and failed each handshake against ate-api-server with `x509: certificate signed by unknown authority` — no golden boot (the agent-platform ATS own-Flux scenario on the cluster its smoke had uninstalled from, [giantswarm/agent-platform#384](https://github.com/giantswarm/agent-platform/issues/384); [#37742](https://github.com/giantswarm/giantswarm/issues/37742) row 29). Kept, a reinstall signs from the roots the bundles already carry, as `ate-system`'s pools do (`createNamespace: false`) | `a5518699`, [#13](https://github.com/giantswarm/substrate/pull/13) (first release v0.0.27-gs.5) | to file: the upstream-shaped patch is branch [`upstream/keep-podcert-namespace`](https://github.com/giantswarm/substrate/tree/upstream/keep-podcert-namespace) here (`38a4e3a1`, on the mirror `main` @ `007eb1ee`); a team member opens the kagent-dev/substrate pull request with DCO sign-off once #37742 has reviewed it. No upstream issue or pull request covers it (searched kagent-dev/substrate and agent-substrate/substrate, 2026-09-11: agent-substrate#146 and #1166 touch stale CA material in the kind and e2e setups only) |