diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 0813cf8..86efb7e 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -227,7 +227,7 @@
 | task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | task | FLEX-WP-0037-T01 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
 | task | FLEX-WP-0037-T02 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
-| task | FLEX-WP-0037-T03 | wait | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
+| task | FLEX-WP-0037-T03 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md b/workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md
index 03e02da..ac8ff3f 100644
--- a/workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md
+++ b/workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md
@@ -90,13 +90,13 @@ The generated runtime twin `values/access-engine/ops-warden.yaml`
 
 ```task
 id: FLEX-WP-0037-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-blocking_reason: "Attended helm upgrade of flex-auth-ops-warden on railiance01 plus an allow smoke; agents may not change the live cluster."
 state_hub_task_id: "26cd6a2d-ac04-5453-9060-d469b439986d"
 ```
 
+2026-10-20 (recorded 2026-10-21): attended `helm upgrade flex-auth-ops-warden` on railiance01 went to revision 3, image `sha256:f7c04991…`, 1/1 ready (rollback: revision 2). Allow smoke: after the upgrade, both an existing actor and agt-custodian pass the gate (stopping at the Vault token stage), where agt-custodian was previously denied `unknown_actor_resource`. Receipt: the-custodian `docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md` (CUST-WP-0073-T02). Done.
+
 ```bash
 helm upgrade --install flex-auth-ops-warden charts/flex-auth \
   --namespace flex-auth -f values/ops-warden.yaml --wait --timeout 2m