diff --git a/.wolf/buglog.json b/.wolf/buglog.json
index 9cdc059c..899e286e 100644
--- a/.wolf/buglog.json
+++ b/.wolf/buglog.json
@@ -18082,9 +18082,9 @@
     },
     {
       "id": "bug-1508",
-      "status": "open",
-      "status_updated": "2026-09-24",
-      "status_note": "worker fetchfile opens any path: no job-ownership/path-traversal check (controller_connector.c)",
+      "status": "fixed",
+      "status_updated": "2026-09-26",
+      "status_note": "7723a4f4: worker fetchfile accepts only <dir>/job_<jobid>_task<N>.out for the request's jobid (exact match), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (user out_file=/etc/shadow).",
       "timestamp": "2026-08-08T00:00:00Z",
       "error_message": "No user report / no test failure -- discovered incidentally during doc-cleanup fact-check audit of src/docs/job_peek.md against current code.",
       "file": "src/worker/src/xcecd_worker.c (handle_fetchfile, jobs-peek fetchfile feature)",