diff --git a/docs/TEMPLATE-MATURITY.md b/docs/TEMPLATE-MATURITY.md
index d24d74f..085b8c8 100644
--- a/docs/TEMPLATE-MATURITY.md
+++ b/docs/TEMPLATE-MATURITY.md
@@ -247,9 +247,20 @@ escapes it only because the scratch crates have no dependencies. The judge
 read the source correctly both times; it failed only on the suite it could
 not run.
 
-Not counted as evidenced until the judge can run the suite itself. How it
-should get the dependencies (offline from the lockfile, registry egress, or
-not at all) is an operator decision about the verifier's isolation.
+**Fixed (e5b42e5), operator decision: offline from the lockfile.** Before
+judging an npm project, the harness copies the mission's npm cache (already on
+the host, since `/zeroclaw-data` is bound from `<mission>/runtime-data`) into
+the verify root and runs `npm ci --offline` against the copy. The judge stays
+offline and never runs agent-built binaries, and every package is checked
+against the lockfile's hashes. Proven live on the re-run (mission 01a0ce15):
+*"DEPENDENCIES: installed by the harness with `npm ci --offline` … node_modules
+is present"*.
+
+That re-run still has no verdict. The GLM judge's weekly quota ran out
+(z.ai 1310, resets 2026-09-25 10:01), and the phase failed on the judge with
+its pass unspent, as designed. The agents' work was green again: 10 tests,
+`tsc -b` clean, +221 lines delivered. Evidenced once a judge with quota
+passes it.
 
 ## One thing both runs showed: agents reach for Bash