diff --git a/workplans/CB-WP-0048-a-configuration-not-a-variant.md b/workplans/CB-WP-0048-a-configuration-not-a-variant.md
index 6f8bc1a..1a156c1 100644
--- a/workplans/CB-WP-0048-a-configuration-not-a-variant.md
+++ b/workplans/CB-WP-0048-a-configuration-not-a-variant.md
@@ -63,7 +63,7 @@ shape again and should be closed on its own terms.
 
 ```task
 id: CB-WP-0048-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4b8bfc25-0e4d-4fdc-9dad-5cdb66798207"
 ```
@@ -71,6 +71,29 @@ state_hub_task_id: "4b8bfc25-0e4d-4fdc-9dad-5cdb66798207"
 Per ADR-0022 D1. Identity as data, behaviour exhaustive, `resolve()`
 between them.
 
+**Done 2026-08-08.** `catalog.rs` reads schema 2 (aspects, modules,
+profiles) and **refuses a schema it does not understand by name** — a
+reader that silently accepted schema 1 would answer questions about
+aspects over a file that has none. `config.rs` holds `Configuration`
+(identity), `Rules` (behaviour) and `resolve()`.
+
+Nothing about the aspect list, the defaults, or which modules are
+proposed is written in our source; all of it is read. The tests locate
+the proposed module **by searching the catalog for `status: proposed`**,
+so if ground-game implements it upstream the test looks elsewhere rather
+than going stale.
+
+| mutation | what went red |
+|---|---|
+| the two errors become one sentence | *"a module the catalog HAS was reported as unknown"* |
+| one-per-aspect check removed | *"two modules on one aspect must be refused"* |
+| identity refuses what it cannot run | *"selecting a catalog module must NAME a configuration"* |
+| legacy lookup stops reading the catalog | *"h2 and profile h2 are not the same point in aspect space"* |
+
+`scoped_plus_attack_soothe` now resolves — `problem_stress.scoped` ×
+`attack_relief.self_soothe_ge4`, the combination the three-armed enum
+could not express.
+
 **Controls:**
 - **a proposed module is refused BY NAME**, distinguishably from a typo —
   the two-error requirement is the reason this shape was chosen, so it is