diff --git a/OPEN_THREADS.md b/OPEN_THREADS.md
index eaa5fef..d421ada 100644
--- a/OPEN_THREADS.md
+++ b/OPEN_THREADS.md
@@ -156,7 +156,9 @@ Outstanding:
 - Create endpoint not confirmed idempotent or guarded against double execution
 - Delete flow not confirmed to handle partial failures (container already gone)
 - DNS-based routing must not be used as source of truth — DB is the source of truth
+- **internal.zlh DNS may be introducing timing issues in provisioning hot path** — replace with env-based IP config for all service-to-service calls
 - See `SCRATCH/debug-provisioning-consistency.md` for full audit plan
+- See `SCRATCH/service-discovery.md` for env-based service discovery approach
 
 ---
 
@@ -245,6 +247,7 @@ Outstanding before launch:
 - **Stress testing** — k6 IDE session load test + Minecraft bot test + **code-server memory baseline**
 - **OPNsense audit** — both routers need systematic validation
 - **Provisioning + DB consistency audit** — duplicate creation, state drift, BullMQ idempotency
+- **Service discovery migration** — replace internal.zlh with env-based IPs in API and agent hot paths
 - Remove `testdaemon` binary from zpac-portal repo root
 
 ---