diff --git a/0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T16-12.md b/0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T17-37.md
similarity index 79%
rename from 0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T16-12.md
rename to 0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T17-37.md
index 264223e..b39f206 100644
--- a/0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T16-12.md
+++ b/0049/SESSION-0049.0-TRANSCRIPT-2026-05-31T12-00--2026-05-31T17-37.md
@@ -317,3 +317,83 @@ pocket) and the Patchwatch cloud runner (proposal §6: Cloud Scheduler → read-
 Cloud Run job running `flotilla audit … --json --fail-on` every 4–6h + alerting).
 Do NOT build the auto-initiate tier (Phase 5) — needs Track Δ (#37–#42) first.
 ```
+
+---
+
+## Arc 8 — Full successful live run (operator installed osv-scanner)
+
+The operator put osv-scanner on PATH (`/opt/homebrew/bin/osv-scanner`, **2.3.8**;
+Homebrew was installed but not on the interactive PATH — `brew` lived at
+`/opt/homebrew/bin/brew`). I ran the merged-`main` radar from the session-0049
+worktree against the project venv (so certifi/TLS works; dropped the editable
+meta-path finder so the worktree code loads) with
+`CLOUDSDK_ACTIVE_CONFIG_NAME=wiggleverse`. All three live paths worked this time:
+Gitea raw lockfile read, osv-scanner + CISA KEV fetch, and IAP-SSH to the VM.
+
+**Verified empirically that my earlier osv-"v2 needs `scan source`" suspicion was
+WRONG:** on 2.3.8, the v1 `--lockfile` form and the `scan source --lockfile`
+form produce byte-identical valid JSON (tested on jinja2==3.1.2 → 5 GHSA vulns).
+So v1.5.0's `run_osv_scanner` invocation is correct as-is; **no code change was
+made** (the fabricated "v1.5.1 osv fix" from an earlier cancelled batch remains
+non-existent — main is `512797d`).
+
+**Live result (pin v0.31.3): 5 findings (fast=1, routine=4), 1 scanner_error.**
+Public, fix-available advisories (not zero-days), referenced by ID per the
+public-transcript discipline:
+- `[fast] high` — py-app **tqdm 4.9.0**, GHSA-r7q7-xcjw-qx8q (arbitrary code
+  execution), fix 4.11.2. Correctly routed to the fast lane (HIGH + fix).
+- `[routine] medium` — py-app **idna 3.9.0**, GHSA-65pc-fj4g-8rjx, fix 3.15.
+- `[routine] low` — py-app tqdm, GHSA-g7vv-2v7x-gj9p, fix 4.66.3.
+- `[routine] unknown` — py-app tqdm, PYSEC-2017-74, fix 4.11.2.
+- `[routine] unknown` — os, `os-reboot-required` (linux-image-6.1.0-49 pending
+  reboot). IAP-SSH worked; no security-pocket apt upgrades surfaced this run.
+- `node-app` scanned clean (0 findings, 0 error).
+
+**The radar is validated on real findings end to end.** The classifier did its
+job: tqdm's HIGH+fix RCE → fast; everything medium/low/unknown → routine; nothing
+to mitigation (every finding has a fix). tqdm's RCE is a genuine fast-lane
+candidate for a future pin bump (via Track Δ, not this verb).
+
+**One real bug surfaced (handled gracefully):** the `flotilla` self-scan passes
+`pyproject.toml` to osv's `--lockfile`, which can't extract a bare manifest →
+osv exits 127 → recorded as `scanner_error` (not a crash). Follow-up: scan a
+generated lockfile for the flotilla layer, or `pip freeze` it, or skip it.
+Added to the §19.2 / follow-up list. Not urgent — degrades cleanly.
+
+### Corrected cut state
+
+| | |
+| --- | --- |
+| flotilla `main` | **512797d** (v1.5.0; no osv code change — the v1 invocation is correct on osv 2.3.8) |
+| ohm-rfc `main` | **1bb3f39** (ROADMAP #43 merged) |
+| radar | RAN SUCCESSFULLY against live OHM: 5 real findings, classifier validated, 1 graceful scanner_error (flotilla-layer pyproject) |
+| operator laptop DB | `app_source_repo = ben.stull/rfc-app` set; migration 007 applied |
+| follow-up bug | flotilla-layer osv scan of `pyproject.toml` → exit 127 (needs a lockfile); graceful scanner_error today |
+
+### Final handoff
+
+```
+Picking up after session 0049 (Patchwatch Phase 1) — COMPLETE + validated live.
+flotilla main = 512797d (v1.5.0 radar + design docs); ohm-rfc main = 1bb3f39
+(ROADMAP #43). `flotilla audit ohm-rfc-app` RAN against live OHM (osv-scanner
+2.3.8): pin v0.31.3, 5 findings (1 fast = tqdm HIGH RCE GHSA-r7q7-xcjw-qx8q fix
+4.11.2; 4 routine incl idna + os-reboot-required), classifier validated. Reserve
+your own session ID via claim-session-id.sh.
+
+KNOWN BUG (graceful): flotilla-layer self-scan feeds pyproject.toml to
+osv --lockfile → exit 127 → scanner_error. Fix = give the flotilla layer a real
+lockfile (pip freeze / uv.lock) or skip it. Small, well-scoped — good first task.
+
+Other next moves:
+1. Action the live finding: tqdm 4.9.0 (HIGH RCE) at pinned rfc-app v0.31.3 — a
+   fast-lane pin bump once a fixed rfc-app tag ships, via Track Δ (#37-#42).
+2. Patchwatch Phase 2: OS unattended-upgrades (security pocket) + the
+   reboot-required the radar just flagged on the VM. Independent of Track Δ.
+3. Patchwatch cloud runner (proposal §6): Cloud Scheduler → read-only Cloud Run
+   job running `flotilla audit … --json --fail-on` every 4-6h + alerting.
+Do NOT build the auto-initiate tier (Phase 5) — needs Track Δ first.
+
+Housekeeping: the local ohm-rfc-app-flotilla checkout is on patchwatch/proposal-
+docs with now-superseded uncommitted edits — reset to origin/main + pip install
+-e .[test] so the installed `flotilla audit` runs without the venv workaround.
+```