diff --git a/docs/handoffs/HANDOFF-2026-08-04-zio-backend.md b/docs/handoffs/HANDOFF-2026-08-04-zio-backend.md
index 0170ab8..bf50f0e 100644
--- a/docs/handoffs/HANDOFF-2026-08-04-zio-backend.md
+++ b/docs/handoffs/HANDOFF-2026-08-04-zio-backend.md
@@ -96,12 +96,22 @@ an rsp-bounds assert never fired, and a 512B park snapshot saw nothing.
 The 4KB-window detector run was cut short by fix 7 making the question
 non-blocking. The no-groups build ran 72 minutes clean.
 
-Status: fiber-native groups are correct under the test suite and a 4.5M
-iteration adversarial storm (`zig build storm`), but NOT trusted under field
-churn. zlay no longer exercises them (fix 7). Before anything else uses
-groups on zio at scale: resume the crash farm (`/root/farm.sh` on the
-machine, alternating group/nogroups builds, saves tails + latest.core) and
-correlate park-shot reports with the crash.
+**Diagnosis progress (2026-08-04, post-certification):** the corruption is
+now confirmed as **stack aliasing** — a parked fiber's stack rewritten with
+ordinary execution frames (spilled compiler constants, code addresses,
+frame chains), i.e. something *ran* on a stack the sched believed parked.
+Bounds and list-membership invariants cannot see this (both aliases are
+in-bounds on the same mapping). A creation-time tripwire (spawn asserts no
+live fiber owns the assigned stack) plus a sweep-time pairwise check are
+deployed in the hunt build; either names both fibers on the next
+occurrence. Transport tripwires localized the garbage error values to
+`HostName.connect`'s internals before the aliasing diagnosis subsumed them.
+
+Status: fiber-native groups pass the suite and the 4.5M-iteration storm,
+but are NOT trusted under field churn until the aliasing path is named.
+zlay no longer exercises them (fix 7). The hunt farm on the machine
+(`/root/huntloop.sh`, artifacts in `/root/hunt/`) runs unattended and is
+fully instrumented.
 
 ## instrumentation that now exists (all in zio, cheap enough to keep)