diff --git a/.wolf/buglog.json b/.wolf/buglog.json
index 57f84316..a86381a9 100644
--- a/.wolf/buglog.json
+++ b/.wolf/buglog.json
@@ -21120,9 +21120,9 @@
     },
     {
       "id": "bug-1583",
-      "status": "open",
-      "status_updated": "2026-09-24",
-      "status_note": "apiserver stores resource names the controller rejected (handler.go Put, opupd.c hook list unfiltered)",
+      "status": "fixed",
+      "status_updated": "2026-09-27",
+      "status_note": "70360ccf",
       "timestamp": "2026-08-18T13:35:00.000Z",
       "error_message": "Live task 8.1 run (resource-value-verification, comprehensive e2e validation): injecting resupdate -n totally-fake-resource-xyz -v 1 (a deliberately-unregistered resource name) alongside 9 genuinely-registered names -- the controller correctly rejects it (resval_typeresolve/update_resval's key_find(c->resmgr,...) returns -ENOENT, never written to w->host.resvals, confirmed empty via a direct resval query) and the scheduler correctly discards it (core_events.c's RESVALS_DELTA handler logs 'xce_core_push_events RESVALS_DELTA: unknown resource totally-fake-resource-xyz, skipping' at WARN and never applies it) -- but the apiserver's OnResourceLocationUpdated (src/frontend/apiserver/backend/handler.go:92) has NO such validation: it logged 'resource-location stored {\"resource\": \"totally-fake-resource-xyz\", \"host\": \"resverify-worker\", \"value\": 1}' and unconditionally called store.ResourceLocations.Put() for it, live-confirmed in apiserver.log.",
       "file": "src/frontend/apiserver/backend/handler.go",