diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index c1e8c5b..8b6bcde 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -188,7 +188,7 @@
 | task | RPF-WP-0061-T05 | wait | — | workplans/RPF-WP-0061-self-service-ccr-intake.md |
 | task | RPF-WP-0062-T01 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
 | task | RPF-WP-0062-T02 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
-| task | RPF-WP-0062-T03 | wait | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
+| task | RPF-WP-0062-T03 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
 | intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
 | intake | RPF-IN-0002 | open | — | intakes/intakes.md |
 | intake | RPF-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/RPF-WP-0062-custodian-agent-observer-identity.md b/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
index 3a95565..b8c0546 100644
--- a/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
+++ b/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
@@ -91,13 +91,13 @@ introduced the manifests. No `automated` block, no finalizer.
 
 ```task
 id: RPF-WP-0062-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-blocking_reason: "Root and custodian-agents child synced 2026-10-20; impersonated can-i proof passed. Remaining: founder issues the agent token (and, if wanted, a token-based can-i rerun)."
 state_hub_task_id: "c1d2bf34-791e-5bfa-beda-94532448c7b3"
 ```
 
+2026-10-20 (recorded 2026-10-21): the founder issued the 24h ServiceAccount token for `custodian-agents/custodian-agent` (CUST-WP-0073 `issue-agent-credentials.sh kube`). Token-based proof from the agent account: identity `custodian-agents:custodian-agent`, no system:masters, curated `get pods` allowed, 597/597 negative probes denied across 48 namespaces (the-custodian `docs/evidence/2026-10-20-custodian-agent-kube-denials-receipt.json`, passed=true). Done.
+
 2026-10-20: the founder ran the attended `custodian-agents` child sync, pinned to `567d2c6` with the apply strategy and prune/force off. The operation Succeeded and the app is Synced/Healthy. It created exactly four objects: Namespace `custodian-agents`, ServiceAccount `custodian-agent`, ClusterRole `custodian-supervised-observer` and its ClusterRoleBinding. A pre-check confirmed none of these names existed before the sync.
 
 Impersonated `kubectl auth can-i --as=system:serviceaccount:custodian-agents:custodian-agent`: