diff --git a/persistent-memory.md b/persistent-memory.md
index fe16551..8e49ba1 100644
--- a/persistent-memory.md
+++ b/persistent-memory.md
@@ -119,7 +119,7 @@ _As of 2026-10-04 ~2300 PT. The newest subsection is first; older subsections ca
 
 ### 2026-10-04: live now (as of 2026-10-04 ~2300 PT)
 
-- **Waiting on Prime (2026-10-05 0355):** reboots for ana-docker/nh3-dev/nh3-extdev/corviduo-dev/vm-esh-nas/esh-vm-db; a daytime window for the held Docker engine bumps; fv-ml1's held ZFS/toolkit/kernel; parked pfi-pteradactyl, pfi-tacticalrmm (certbot), pfi-gx10 (dgx-release); CrowdSec bouncer `updateMaxFailure` 0 → ~3 (lean).
+- **Waiting on Prime (2026-10-05 0355):** reboots for ana-docker/nh3-dev/nh3-extdev/corviduo-dev/vm-esh-nas/esh-vm-db; a daytime window for the held Docker engine bumps; fv-ml1's held ZFS/toolkit/kernel; parked pfi-pteradactyl, pfi-tacticalrmm (certbot), pfi-gx10 (dgx-release); CrowdSec bouncer `updateMaxFailure` 0 → ~3 (lean; less needed now that WAL fixed the root cause).
 - **irv-ml1 `/storetank` ~88% is planned, not a leak (2026-10-05 0035 Beszel 85% alert).** A Foley weights stage (`/tmp/comfy-foley-stage-20261005/stage.py`, lkraven, arbo models, 40 GB over 97 files) has a built-in 200 GiB free-space floor and refuses below it. The alert stays tripped at ~88%.
 - **albok-service now on nh3-albok (VM 110, nh3-pve-2, 10.100.50.44) since 2332; DNS moved. CLOSED 2026-10-05 0021:** albok-dev acceptance passed 0018, the old `/srv/albok` on nh3-docker was deleted on Prime's approval, and the first VM 110 backup is on pbs-ana. The compose tombstone stays on nh3-docker. → `persistent-memory.d/2026-10-04-albok-service-moved-to-nh3-albok.md`
 - **Nothing is mid-action.** Every hypervisor is on PVE 9.2.21 / 7.0.14-20 (pfi-pve 0656, esh-pve 0742, nh3-pve + esh-nas-pve 10-03, nh3-pve-2 fresh) and both PBS on 4.2.7 (1144). → `persistent-memory.d/2026-10-04-fleet-on-pve-9-and-pbs-4.md`
@@ -302,6 +302,7 @@ _As of 2026-10-04 ~2300 PT. The newest subsection is first; older subsections ca
 ## Recent decisions
 
 - `[2026-10-05]` **fv-ml1 Docker → tank zvol + host patched (Prime, park 99 DONE)** — run 1 aborted on its own guard (live rsync walked into an overlay `merged` view; seats down 0218–0228, rolled back); run 2 ok 0231–0240 (`-x`, merged excluded, path-list verify, auto-restore trap). Kernel 6.12.111 broke NVIDIA DKMS → purged + kernel metas removed; ZFS stack + nvidia-container-toolkit held. Root 49%→8%. → `servers/fv-ml1/README.md`
+- `[2026-10-05]` **CrowdSec SQLite → WAL on ana-docker (0418)** — three public 403 blips (0310/0342/0415) were the Traefik bouncer failing closed while LAPI took 26–58 s per stream request (`use_wal: false`, blocklist-mirror polling). WAL brought it to 0.04–2.4 s. → `servers/ana-docker/README.md`
 - `[2026-10-05]` **Fleet guest patching (park 100) DONE 0355** — 15 hosts current, no reboots; parked: pfi-pteradactyl (pre-broken), pfi-tacticalrmm (certbot failing), pfi-gx10 (dgx-release + bootloader + kernel), ana-nas, irv-ml1 (Prime: off-limits). Deferred: kernel reboots (6 hosts), Docker engine bumps (8 hosts), fv-ml1 ZFS/toolkit/kernel. → `docs/runbooks/fleet-guest-patch-2026-10-05.md` § Result
 - `[2026-10-05]` **irv-ml1 storage cleanup + text encoders on worktank (Prime)** — Docker prune +441 G (dangling, old pullable tags, cache >30d); home entries untouched >2 months −82 G (live-but-old kept: act-runner, webhooks, dotfiles, fzf-git); `/storetank/arbo/models/text_encoders` is now ZFS `worktank/arbo-text-encoders` mounted at the same path (sha-verified, ComfyUI sees all 23). Root 84%→54%, storetank 87%→79%, worktank 62%→86%. → `servers/irv-ml1/README.md`
 - `[2026-10-05]` **ana-docker Traefik `readTimeout` 60s → 10m on both entrypoints** — the Traefik v3 default cut skaldsong's 2.5 G registry blob PUTs at exactly 60.0 s (16/16 deploys failed since 05-28). Static file on host, not in `stacks/`. → `servers/ana-docker/README.md`
diff --git a/servers/ana-docker/README.md b/servers/ana-docker/README.md
index 797fa00..86e1e16 100644
--- a/servers/ana-docker/README.md
+++ b/servers/ana-docker/README.md
@@ -40,7 +40,7 @@ General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0
 | Stack | Port(s) | Notes |
 |-------|---------|-------|
 | traefik | 80 / 443 / 8380 | Reverse proxy + TLS (cert resolver `anaprod`) |
-| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin |
+| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin. ⚠ The bouncer FAILS CLOSED: if LAPI does not answer, every public route returns 403. SQLite runs with `use_wal: true` since 2026-10-05. Before that, blocklist-mirror's stream reads held the DB for 26–58 s and caused three public 403 blips (0310/0342/0415); WAL took it to 0.04–2.4 s. Config: `/opt/docker/conf/crowdsec/config.yaml` on the host, not in `stacks/` |
 | gitea | 3000 / 222 | Git hosting — `gitea.phasefinal.com` |
 | vaultwarden | 9080 | Password vault — `vaultwarden.phasefinal.com` |
 | synapse (+ synapse-db, element-web) | internal | Matrix homeserver — `matrix.phasefinal.com`, client at `chat.phasefinal.com` |