diff --git a/docs/session-handoff.md b/docs/session-handoff.md
index 0f898b9..4ef2a13 100644
--- a/docs/session-handoff.md
+++ b/docs/session-handoff.md
@@ -22,28 +22,36 @@ original foundational decisions doc (do not overwrite it).
 
 ---
 
-## 2. OPEN BUG (priority) — fail2ban & UFW falsely shown "nicht installiert"
+## 2. RESOLVED — fail2ban & UFW falsely shown "nicht installiert" (fixed `221e49f`)
 
-**Symptom:** the Hardening checklist shows `fail2ban` and `Firewall (UFW)` as **OFFEN ·
-nicht installiert**, while the fail2ban-Status panel below shows `aktiv · 14 gesperrt` with
+**Was:** the Hardening checklist showed `fail2ban` and `Firewall (UFW)` as **OFFEN ·
+nicht installiert**, while the fail2ban-Status panel below showed `aktiv · 14 gesperrt` with
 real SSH-scanner bans. Contradiction.
 
 **Root cause — two different detection methods (same host):**
-- `HardeningService` (checklist): installed = `dpkg -l <pkg> | grep -q '^ii'`
-  (`PackageManager::isInstalledTest`, apt) / `FirewallTool::installedTest()` for ufw; active =
-  `systemctl is-active`. → asks "is the **apt package** recorded?"
-- `Fail2banService::status` (panel): installed = `command -v fail2ban-client`; active =
-  `systemctl is-active`; jails via `fail2ban-client status`. → asks "is the **binary present +
-  service running**?"
-- The host is Debian/apt and fail2ban is genuinely running (14 real bans), but dpkg does not
-  list it as `^ii` → checklist false-negative. Same for ufw.
+- `HardeningService::state` (checklist): installed = `dpkg -l <pkg> | grep -q '^ii'` /
+  `rpm -q`; active = `systemctl is-active`. → asked "is the **apt/rpm package** recorded?"
+- `Fail2banService::status` + `FirewallTool` (panels): installed = `command -v <client>`;
+  active = `systemctl is-active`. → asked "is the **binary present + service running**?"
+- The host is Debian/apt and fail2ban/ufw is genuinely running, but dpkg does not list it as
+  `^ii` (source install, or dpkg `rc` config-only state) → checklist false-negative.
 
-**Fix direction:** make the checklist's "installed" = (apt `ii`) OR (`command -v` binary
-present) OR (service active) — align with `Fail2banService`. Touch:
-`app/Services/HardeningService.php` (~lines 50–66, the `$cmd` probe),
-`app/Support/Os/PackageManager.php::isInstalledTest`,
-`app/Support/Os/FirewallTool.php::installedTest`. Verify on 10.10.90.162 how fail2ban/ufw are
-actually installed (apt vs source vs `rc` config-only). A task chip was spawned for this.
+**Fix (committed on `feat/v1-foundation`, NOT yet tagged/pushed):** the checklist's installed
+probe in `app/Services/HardeningService.php::state` now ORs three conditions —
+package-manager test (`dpkg ^ii` / `rpm -q`) **OR** client binary on PATH (`command -v`)
+**OR** service active (`systemctl is-active`) — via the local `$anyOf()` helper, for **both**
+fail2ban and the firewall (ufw/firewalld). Consistent with `Fail2banService::status`. Since a
+component can never be active without being installed, this only removes FALSE negatives,
+never adds a false-positive. `PackageManager`/`FirewallTool` were left unchanged (the OR is
+composed in `HardeningService`, not in their primitives).
+
+Verified: new unit test `tests/Feature/HardeningServiceTest.php` (Debian/apt source-install
+fallback) **passes**; Pint clean; Codex review clean (no actionable regression).
+
+**Still pending (deferred this session):** (a) live acceptance check against fleet host
+10.10.90.162 — load Server-Details and confirm fail2ban/ufw now read "installiert"; (b) no
+version bump / CHANGELOG / tag / push — the fix lives on the branch only. The prior session's
+"Fix fail2ban/UFW false negative" task chip is now **stale** (work is done).
 
 ---