diff --git a/argocd/platform-addons/secret-annotation-guard/README.md b/argocd/platform-addons/secret-annotation-guard/README.md
index f2a31e6..5abf3a3 100644
--- a/argocd/platform-addons/secret-annotation-guard/README.md
+++ b/argocd/platform-addons/secret-annotation-guard/README.md
@@ -45,10 +45,11 @@ existing data templates and remote references. Do not waive ESO from the policy
 or upgrade the controller as a shortcut. Rerun cleanup, native admission tests
 and an ESO refresh integration test, then include the binding and update the pin.
 
-The absent `platform-pg-drill` namespace still has an orphan Secret `drill-minio`,
-a Deployment referencing it, a PVC and Service. Metadata patch fails because the
-namespace is absent. No orphan object was deleted or namespace recreated. Its
-disposition stays in CUST-WP-0073-T03; do not report cluster-wide cleanup complete.
+An orphan Secret `platform-pg-drill/drill-minio` initially blocked complete
+cleanup because its namespace was absent. The founder subsequently approved
+deleting only that Secret. UID-bound deletion and absence were verified; the
+bound 3 GiB PVC was unchanged. No other resources or namespace were changed.
+Receipt: the-custodian/docs/evidence/2026-09-28-orphan-secret-deletion.json.
 
 Source for the diagnosed behavior:
 https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/controllers/externalsecret/externalsecret_controller_template.go
@@ -73,3 +74,12 @@ rotated by the metadata maintenance. ESO uses its normal credential refresh path
 Detailed preflight, publication and before/after integration receipts live in
 `the-custodian/docs/evidence/2026-09-28-eso-*.json`. The earlier rollout failure
 and rescue remain recorded; remediation does not count as unchanged success.
+
+## Verified completion
+
+The binding is active at source `7daf7e9`, application declaration `db51ec8`.
+Argo reports Synced/Healthy. All nine native admission checks pass and all 39
+ExternalSecrets completed fresh successful refreshes under Deny. All 257 Secrets
+in existing namespaces passed the forbidden-annotation scan. The one orphan
+exception was subsequently resolved as above. CUST-WP-0073-T03 is complete;
+agent-runtime isolation and deferred credential rotation are separate tasks.