diff --git a/SCOPE.md b/SCOPE.md
index 110a67e..80c972c 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -144,6 +144,13 @@ in-cluster ops-warden pin and moved it to `callerAuth.mode: enforce` once
 ops-warden adopted a calling identity (`WARDEN-WP-0031`): anonymous `/v1/check`
 is 401, a token bound to another protected system is 403.
 
+`FLEX-WP-0037` (2026-10-20) added the supervised-agent actor `agt-custodian`
+to the ops-warden production registry fixture (`9132f9b`, pin `b429dcb`). An
+attended `helm upgrade` of `flex-auth-ops-warden` rolled it out as revision 3,
+with image `sha256:f7c04991…`; the rollback target is revision 2. The registry is
+baked into the image, so adding an actor needs a new image and a helm upgrade,
+not just a config change.
+
 Production `policy.enabled` is **deliberately off, and is not coming back as a
 boolean.** ops-warden's `ADR-0009` (2026-08-22, superseding `ADR-0006`) settles it:
 `policy.enabled` is one repo-wide flag, and with `fail_closed: true` it makes