diff --git a/docs/method/disclosure.md b/docs/method/disclosure.md
index 33bcc29..364da78 100644
--- a/docs/method/disclosure.md
+++ b/docs/method/disclosure.md
@@ -114,3 +114,28 @@ is not recoverable.
 A `public` finding is handed to `policy-nexus` under its publication contract
 and gets a permanent address there. This repo never serves it and never
 edits it after handover; corrections go through the same route as the original.
+
+## The standing route, when an embargo lifts
+
+`RISK-WP-0002-T03`. Written down because publication will arrive in a trickle
+as conditions clear, not as a batch, and a route improvised each time is a
+route that eventually is not taken.
+
+1. **The check that lifts the embargo records it.** `make checked` on the
+   finding, with the lift as the reason. An embargo lifting is never a clean
+   check — something moved.
+2. **The finding gets publication front-matter**, in the shape `policy-nexus`
+   already requires of everyone: `owner`, `revision`, `last_reviewed`,
+   `review_interval`. No body rewrite.
+3. **This repo asks `policy-nexus` for an entry**, giving `source_repo`,
+   `source_path`, a proposed `canonical_path` under `findings/<id>/<version>/`,
+   and a one-line subtitle. Addressing and permanence are theirs
+   (`POLICY-NEXUS-WP-0001`); this repo does not invent a scheme.
+4. **`publication: published` is recorded back on the finding**, with the URL.
+   A finding that says `public` but has no address is a claim, not a
+   publication — the same class of error as a backup nobody has restored from.
+
+The contract publishes **a file from the owning repo**, so what is handed over
+is exactly what a reader gets. That makes the whole-versus-summary decision
+(T01) a decision about what a finding *file* contains, not about how it is
+rendered.
diff --git a/workplans/RISK-WP-0002-publication-handover.md b/workplans/RISK-WP-0002-publication-handover.md
index 5176ad8..213e75c 100644
--- a/workplans/RISK-WP-0002-publication-handover.md
+++ b/workplans/RISK-WP-0002-publication-handover.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Hand the publishable findings to policy-nexus, and decide what else is a public document"
 domain: infotech
 repo: risk-nexus
-status: proposed
+status: active
 owner: the-custodian
 topic_slug: risk-nexus
 created: "2026-08-20"
@@ -82,7 +82,7 @@ the operator is interrupted, which is not the estate's business to advertise.
 
 ```task
 id: RISK-WP-0002-T03
-status: todo
+status: done
 priority: medium
 ```
 
@@ -92,6 +92,10 @@ and how `publication: published` gets recorded back on the finding.
 Small. It is a paragraph in `docs/method/disclosure.md` plus whatever
 `policy-nexus` needs on their side, not a mechanism.
 
+Completed 2026-08-20. The route is in `docs/method/disclosure.md`: the check that lifts the embargo records it, the finding gets publication front-matter in the shape `policy-nexus` already requires (`owner`, `revision`, `last_reviewed`, `review_interval`), this repo asks for an entry with `source_repo`/`source_path`/proposed `canonical_path`, and `publication: published` plus the URL comes back onto the finding — because a finding that says `public` with no address is a claim, not a publication.
+
+One thing the contract settled for T01: `publication.json` publishes **a file from the source repo**, so a reader gets exactly what is handed over. Whole-versus-summary is therefore a decision about what a finding file contains, not about rendering.
+
 ## Non-goals
 
 - No publication surface here. `policy-nexus` hosts; this repo hands over.