diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index f284f97..fbfada9 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -186,7 +186,7 @@
 | task | WARDEN-WP-0044-T04 | wait | — | workplans/WARDEN-WP-0044-security-case-follow-through.md |
 | task | WARDEN-WP-0045-T01 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
 | task | WARDEN-WP-0045-T02 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
-| task | WARDEN-WP-0045-T03 | wait | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
+| task | WARDEN-WP-0045-T03 | done | — | workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md |
 | intake | WARDEN-IN-0001 | closed | — | intakes/intakes.md |
 | intake | WARDEN-IN-0002 | closed | — | intakes/intakes.md |
 | intake | WARDEN-IN-0003 | closed | — | intakes/intakes.md |
diff --git a/workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md b/workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md
index 0e08384..8831f98 100644
--- a/workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md
+++ b/workplans/WARDEN-WP-0045-agt-custodian-issuance-profile.md
@@ -69,13 +69,13 @@ coverage counts. Tests: `tests/test_agt_custodian_profile.py`.
 
 ```task
 id: WARDEN-WP-0045-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-blocking_reason: "Supervisor must add agt-custodian to the operator inventory, confirm the Vault agt-role allows user agt-custodian and extension permit-pty (railiance-platform), and do the first attended issuance after railiance-infra maps custodian-agt."
 state_hub_task_id: "166447a5-e704-52f4-9d08-d0fb3061a406"
 ```
 
+2026-10-20 (recorded 2026-10-21): railiance-infra mapped `custodian-agt` (uid 1001) to principal `agt-custodian`. railiance-platform `agt-role` allowed_extensions = `permit-pty`. The founder issued the first attended certificate via `credential.py exec --grant ops-warden/warden-sign`; it carried no extensions. The founder then reissued it after the role fix, valid 2026-10-20T23:24Z-2026-10-21T11:25Z, with `permit-pty` only, and a pty session worked from the custodian-agents distro. Receipt: the-custodian `docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md` (CUST-WP-0073-T02). Done.
+
 Do the operator rollout. Copy the `agt-custodian` block into the operator's
 `~/.config/warden/inventory.yaml`, out of the agent's reach. railiance-platform
 confirms that `ssh/roles/agt-role` has `allowed_users` ⊇ `agt-custodian` and