diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
index a0d3ade..98dd466 100644
--- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md
+++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
@@ -135,12 +135,32 @@ Acceptance: no local hub process listening; `127.0.0.1:8000` answers from
 central; MCP `dev-hub` resolves to central; reverse `state-hub-*` tunnels removed
 or repointed; the cache-only recovery export is committed.
 
-**Done (2026-08-24):** `docs/recovery/cache-only-repos-2026-08-24.json` captures
-all 44 cache-only repository records with working-copy presence, classification
-file presence, and HEAD sha — the recovery source for T05.
+**Progress (2026-08-24):** `docs/recovery/cache-only-repos-2026-08-24.json`
+captures all 44 cache-only repository records with working-copy presence,
+classification file presence, and HEAD sha — the recovery source for T05.
 `ops-bridge` now pins local forwards to `127.0.0.1` (commit `2213847`), so a
 contested port fails loudly instead of silently landing on `[::1]`.
 
+The local hub instance is retired: `make api` (uvicorn on `127.0.0.1:8000`) is
+stopped, `state-hub-primary` restarted onto the freed IPv4 address, and the
+orphaned `[::1]` forward removed. Exactly one process now binds 8000 and it is
+the tunnel to central — `/repos/` returns 78 there, not the cache's 122, and
+`statehub status` reports central's 10 active workplans rather than 27. The MCP
+server on `:8001` needed no change: it targets `http://127.0.0.1:8000` and now
+proxies central. No call site was edited; retiring the impersonator made the
+existing defaults correct.
+
+The Postgres container is deliberately left running with its data intact. It is
+the recovery source of last resort until T05 proves central holds all 44, per
+the sequencing above.
+
+**Remaining:** the reverse relay tunnels `state-hub-railiance01` and
+`state-hub-mcp-railiance01` still route remote agents back to this workstation.
+Retiring them requires editing `~/.config/bridge/tunnels.yaml`, which is outside
+any repo and was blocked in-session; the change and its sequencing constraint
+are recorded in `docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md`.
+Remote agents and the documented port map must be repointed *before* removal.
+
 ## Make the hub target explicit and unspoofable
 
 ```task