diff --git a/openspec/changes/runtime-database-user/tasks.md b/openspec/changes/runtime-database-user/tasks.md
index c1b0b2e5..867bfb5f 100644
--- a/openspec/changes/runtime-database-user/tasks.md
+++ b/openspec/changes/runtime-database-user/tasks.md
@@ -212,7 +212,7 @@ This section's `make test` passes only after the documented stack respin of item
 
 ## 7. Landing
 
-- [ ] 7.1 With the test stack up, `make test` passes (it runs `make lint` first), and `openspec validate runtime-database-user --strict` passes.
-- [ ] 7.2 Post a comment on #23 under CONTRIBUTING.md's rules for forge text, and close it. The comment states that the console serves from a runtime user that is not a superuser and owns nothing, and migrates on a second connection string that it closes before serving; that the migrations' revokes now bind the console; that the console refuses to start on a configuration that would reopen the bypass, with no exemption; that a host can run migrations as a separate step and keep the migration password out of the running process; that the writer roles now hold only `SELECT`, `INSERT`, `UPDATE` and `DELETE` (no `TRUNCATE`, `TRIGGER`, `MAINTAIN` or `REFERENCES`), that the plan-act obligation move takes its row lock through a function owned by `core_owner`, because a locking read of an enclosed table needs `UPDATE`, that the core baseline's initial partitions are computed in UTC, and that the `-file` keys of the other commands are fixed in the same change; and that a deployment changes its configuration to upgrade, following the procedure in `docs/production-deployment.md`. It names the commits of sections 1 to 6.
-- [ ] 7.3 Post a comment on #252 under the same rules: `core.webhook_events` and its partitions now belong to `core_owner`, and partitions are created by a `SECURITY DEFINER` function it owns; the runtime user is refused when it owns or can act as the owner of the database or any object, whoever owns it, so moving the rest is not needed for the fence; moving them needs a per-object `ALTER ... OWNER TO` loop, because Postgres refuses `REASSIGN OWNED BY` for the bootstrap superuser, and `SET` membership in each owner role for the migration user; and `scripts/db-reader-role.sql` is run by the schemas' owner, which that move would change.
-- [ ] 7.4 Hand the host procedure of `docs/production-deployment.md` to the maintainer, with the values his deployment needs filled in outside the repository. No agent runs it.
+- [x] 7.1 With the test stack up, `make test` passes (it runs `make lint` first), and `openspec validate runtime-database-user --strict` passes.
+- [x] 7.2 Post a comment on #23 under CONTRIBUTING.md's rules for forge text, and close it. The comment states that the console serves from a runtime user that is not a superuser and owns nothing, and migrates on a second connection string that it closes before serving; that the migrations' revokes now bind the console; that the console refuses to start on a configuration that would reopen the bypass, with no exemption; that a host can run migrations as a separate step and keep the migration password out of the running process; that the writer roles now hold only `SELECT`, `INSERT`, `UPDATE` and `DELETE` (no `TRUNCATE`, `TRIGGER`, `MAINTAIN` or `REFERENCES`), that the plan-act obligation move takes its row lock through a function owned by `core_owner`, because a locking read of an enclosed table needs `UPDATE`, that the core baseline's initial partitions are computed in UTC, and that the `-file` keys of the other commands are fixed in the same change; and that a deployment changes its configuration to upgrade, following the procedure in `docs/production-deployment.md`. It names the commits of sections 1 to 6.
+- [x] 7.3 Post a comment on #252 under the same rules: `core.webhook_events` and its partitions now belong to `core_owner`, and partitions are created by a `SECURITY DEFINER` function it owns; the runtime user is refused when it owns or can act as the owner of the database or any object, whoever owns it, so moving the rest is not needed for the fence; moving them needs a per-object `ALTER ... OWNER TO` loop, because Postgres refuses `REASSIGN OWNED BY` for the bootstrap superuser, and `SET` membership in each owner role for the migration user; and `scripts/db-reader-role.sql` is run by the schemas' owner, which that move would change.
+- [x] 7.4 Hand the host procedure of `docs/production-deployment.md` to the maintainer, with the values his deployment needs filled in outside the repository. No agent runs it.