diff --git a/workplans/CUST-WP-0079-deterministic-security-flow.md b/workplans/CUST-WP-0079-deterministic-security-flow.md
index 3280ad6..3672c40 100644
--- a/workplans/CUST-WP-0079-deterministic-security-flow.md
+++ b/workplans/CUST-WP-0079-deterministic-security-flow.md
@@ -304,7 +304,9 @@ shared generated-only rejection and existing exact-scope secret scans remained
 in force. No native runtime, credentials, public policy or schedule activation
 was performed by this adoption.
 
-Current provider source revisions at clean-checkout verification:
+All 25 provider checkouts were clean at verification (3 earlier adopters, 11
+security-fleet adoptions, 4 isolation providers and 7 sizing providers). Current
+source revisions:
 
 | Repository | Commit |
 | --- | --- |
@@ -385,3 +387,9 @@ execution remain to be implemented/verified without changing authored source
 inventory dispositions. T03, T04 and T06 retain their independent schedule,
 publication and attended acceptance gates. No new owner acceptance is inferred
 from clean checkouts or the earlier clean seven-day Git window.
+
+State Hub's five older metric snapshots remain intentionally dirty after owner
+review; they were not included in the 25 clean provider claim. Custodian's
+inherited NetKingdom assessment receipts also remain outside these owner cleanup
+commits. Neither source adoption nor clean provider worktrees authorizes deleting
+unrelated observations.